mediumservicesunverifiedrollback-safe

Ensure GDM screen locks cannot be overridden

gdm-screen-lock-override · RHEL ≥ 8 · 1 impl

Description

If GNOME Display Manager is in use, users should not be able to override the screen lock settings.

Rationale

Preventing users from disabling screen lock ensures the security policy is enforced consistently.

Check → Remediate

Checkcommand

# Check if lock settings are locked
if [ -f /etc/dconf/db/local.d/locks/00-screensaver ]; then
  if grep -q "/org/gnome/desktop/screensaver/lock-delay" /etc/dconf/db/local.d/locks/00-screensaver 2>/dev/null; then
    echo "OK: GDM screen lock settings are locked"
    exit 0
  fi
fi
echo "FAIL: GDM screen lock settings can be overridden"
exit 1

expected_exit:: 0

Remediatedconf_set

schema:: org/gnome/desktop/screensaver
key:: lock-delay
value:: 5
value_type:: uint32
file:: 00-screensaver
lock:: true

Framework references

CIS

rhel9 1.8.5

NIST 800-53

AC-11

#gdm#gnome#screen-lock#security