mediumservicesunverifiedrollback-safe
Ensure GDM smart card removal action cannot be overridden
gdm-smartcard-removal-lock · RHEL ≥ 8 · 1 impl
Description
If GNOME Display Manager is in use, the smart card removal action must be set to lock the screen and users must not be able to override this setting.
Rationale
Preventing users from overriding the smart card removal action ensures that removing a smart card automatically locks the screen, maintaining access control when the authentication token is removed.
Check → Remediate
Checkcomposed · 2 sub-checks (all must pass)
- 1. command:
- run=if grep -rqE "^[[:space:]]*removal-action[[:space:]]*=[[:space:]]*'lock-screen'" /etc/dconf/db/*.d/ 2>/dev/null; then echo "OK: removal-action set to 'lock-screen'" exit 0 fi echo "FAIL: removal-action not set to 'lock-screen'" exit 1 expected_exit=0
- 2. command:
- run=for lockfile in /etc/dconf/db/*.d/locks/*; do if [ -f "$lockfile" ] && grep -q "/org/gnome/settings-daemon/peripherals/smartcard/removal-action" "$lockfile" 2>/dev/null; then echo "OK: GDM smart card removal action is locked" exit 0 fi done echo "FAIL: GDM smart card removal action can be overridden" exit 1 expected_exit=0
Remediatedconf_set
- schema:
- org/gnome/settings-daemon/peripherals/smartcard
- key:
- removal-action
- value:
- 'lock-screen'
- file:
- 00-smartcard
- lock:
- true
Framework references
STIG
V-281276 / RHEL-10-700730V-258020 / RHEL-09-271050V-258019 / RHEL-09-271045V-230351 / RHEL-08-020050
NIST 800-53
AC-11IA-3
#gdm#gnome#smartcard#screen-lock#security