lowservicesunverified

Ensure GDM Xorg/Xwayland is configured

gdm-xwayland-disabled · RHEL ≥ 8 · 1 impl

Description

If GNOME Display Manager is in use, X11/Xwayland forwarding and legacy X should be constrained per site policy (WaylandEnable managed in /etc/gdm/custom.conf). On a host without GDM the control is not applicable.

Rationale

Legacy X11/Xwayland exposes a broad, historically vulnerable display protocol; where a graphical login is present it must be deliberately configured.

Check → Remediate

Checkcommand

# NA where GDM is not installed (headless server).
if ! rpm -q gdm >/dev/null 2>&1 && [ ! -f /etc/gdm/custom.conf ]; then
  echo "NOT APPLICABLE: GDM not installed"
  exit 0
fi
# WaylandEnable must not be forced false (which drops to Xorg) unless intended.
if grep -qiE '^\s*WaylandEnable\s*=\s*false' /etc/gdm/custom.conf 2>/dev/null; then
  echo "FAIL: WaylandEnable=false forces legacy Xorg in /etc/gdm/custom.conf"
  exit 1
fi
echo "OK: GDM does not force legacy Xorg (Wayland default retained)"
exit 0

expected_exit:: 0

Remediatemanual

note:: Remove or set WaylandEnable=true in /etc/gdm/custom.conf per site policy.

Framework references

CIS

rhel8 1.8.7rhel10 1.8.6

NIST 800-53

CM-7

#gdm#gnome#xwayland#wayland#cis