mediumsystemunverifiedrollback-safe

Ensure screensaver lock delay is 5 seconds or less

gdm-screensaver-lock · RHEL ≥ 8 · 1 impl

Description

RHEL 8 must initiate a session lock for graphical user interfaces when the screensaver is activated. The lock-delay dconf setting must be configured to 5 seconds or less (lock-delay=uint32 5) in the local user database.

Rationale

A session lock is a temporary action taken when a user stops work and moves away from their workstation. Configuring a session lock ensures the screen is locked when the screensaver activates, preventing unauthorized access.

Check → Remediate

Checkcommand

if ! rpm -q gdm >/dev/null 2>&1; then exit 0; fi
# Check lock-delay setting from dconf database files
delay=$(grep -rhs '^\s*lock-delay\s*=' \
  /etc/dconf/db/local.d/ /etc/dconf/db/gdm.d/ 2>/dev/null |
  tail -1 | sed 's/^[^=]*=\s*//' | tr -d "'" | grep -oE '^uint32 [0-9]+|^[0-9]+' |
  grep -oE '[0-9]+' || true)
if [ -z "$delay" ]; then
  delay=$(DCONF_PROFILE=/etc/dconf/profile/gdm dconf read \
    /org/gnome/desktop/screensaver/lock-delay 2>/dev/null |
    sed "s/^uint32 //" | tr -d "'" || true)
fi
if [ -z "$delay" ]; then
  echo "FAIL: lock-delay not configured"
  exit 1
fi
if [ "$delay" -gt 5 ] 2>/dev/null; then
  echo "FAIL: lock-delay=$delay (must be <= 5)"
  exit 1
fi
echo "OK: lock-delay=$delay"

expected_exit:: 0

Remediatedconf_set

schema:: org/gnome/desktop/screensaver
key:: lock-delay
value:: 5
value_type:: uint32
file:: 00-screensaver

Framework references

STIG

V-244535

NIST 800-53

AC-11CM-6

#gdm#graphical#screensaver#session-lock#stig