mediumservicesunverifiedrollback-safe

Ensure GDM session lock displays a blank or publicly viewable image

gdm-screensaver-blank · RHEL ≥ 8 · 1 impl

Description

If GNOME Display Manager is in use, the session lock screen must conceal information previously visible on the display by showing a blank screen or publicly viewable image.

Rationale

Without concealing the screen contents when the session locks, sensitive information previously displayed remains visible to anyone who approaches the workstation, creating a confidentiality risk even when access is otherwise restricted.

Check → Remediate

Checkcommand

# Check if picture-options is set to 'none' or picture-uri is empty
if grep -qr "^picture-options='none'" /etc/dconf/db/local.d/ 2>/dev/null || \
   grep -qr '^picture-options='"'"'none'"'" /etc/dconf/db/local.d/ 2>/dev/null || \
   grep -qr "^picture-uri=''" /etc/dconf/db/local.d/ 2>/dev/null; then
  echo "OK: GDM screensaver is configured to display a blank screen"
  exit 0
fi
echo "FAIL: GDM screensaver may display sensitive screen contents"
exit 1

expected_exit:: 0

Remediatedconf_set

schema:: org/gnome/desktop/screensaver
key:: picture-uri
value:: ''
file:: 00-screensaver

Framework references

STIG

V-258027 / RHEL-09-271085

NIST 800-53

AC-11(1)

#gdm#gnome#screen-lock#screensaver#security