mediumsystemunverifiedrollback-safe

Prevent users from overriding screensaver lock-enabled setting

gdm-screensaver-lock-override · RHEL ≥ 8 · 1 impl

Description

RHEL 8 must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface. The lock-enabled setting must be locked in the dconf system database.

Rationale

Allowing users to disable the screen lock defeats the purpose of requiring automatic session locks. Locking the dconf setting prevents users from circumventing the session lock security control.

Check → Remediate

Checkcommand

if ! rpm -q gdm >/dev/null 2>&1; then exit 0; fi
grep -rq '/org/gnome/desktop/screensaver/lock-enabled' \
  /etc/dconf/db/local.d/locks/ 2>/dev/null

expected_exit:: 0

Remediatedconf_set

schema:: org/gnome/desktop/screensaver
key:: lock-enabled
value:: true
file:: 00-screensaver
lock:: true

Framework references

STIG

V-281277 / RHEL-10-700740V-258022 / RHEL-09-271060V-244539

NIST 800-53

AC-11CM-6

#gdm#graphical#dconf#screensaver#lock#stig