Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
Neutralizes the GNOME Ctrl-Alt-Del logout media-key binding and locks it so users cannot reboot or end the session via the shortcut.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
A user logged in at the GNOME console who presses Ctrl-Alt-Del can trigger the logout media-key action and reboot or end the session. If pressed accidentally, common in mixed-OS environments where the sequence means something else, this causes a short-term loss of availability. Defining the logout key binding and locking it removes the reboot/logout shortcut so it cannot be triggered by mistake.
What Pavois checks
Pavois checks the effective dconf state: the logout key must be defined under /etc/dconf/db/*.d/* (set to an empty binding to disable the shortcut) and /org/gnome/settings-daemon/plugins/media-keys/logout must appear in a dconf lock file. Evaluating the compiled profile plus the lock, not a single editable file, matches how dconf resolves key bindings, so an unlocked or overridden binding is correctly flagged.
only_if { command('dconf').exist? }
describe command('{ grep -rqE \'^[[:space:]]*logout[[:space:]]*=\' /etc/dconf/db/*.d/* 2>/dev/null && grep -rqxF \'/org/gnome/settings-daemon/plugins/media-keys/logout\' /etc/dconf/db/*/locks/* 2>/dev/null && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
After dconf update, run gsettings get org.gnome.settings-daemon.plugins.media-keys logout (should return an empty binding such as [''] or @as []) and confirm the key is locked by checking /etc/dconf/db/*/locks/* for /org/gnome/settings-daemon/plugins/media-keys/logout.
Inspect & investigate
dconf has no runtime log; verify with gsettings get org.gnome.settings-daemon.plugins.media-keys logout and inspect /etc/dconf/db/*.d/* and /etc/dconf/db/*/locks/*. Actual reboot/logout events (if any slip through) are recorded by systemd and visible with journalctl -b -1 (previous boot) or last -x | grep -E 'reboot|shutdown'.
Remediation
Pavois's harden plan uses the dconf resource to define the logout media-key binding (empty value) in a system dconf profile drop-in, add /org/gnome/settings-daemon/plugins/media-keys/logout to a locks file, and run dconf update. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | org/gnome/settings-daemon/plugins/media-keys/logout |
|---|---|
| resource | dconf |
| value | '' |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Applies only to GNOME desktops; irrelevant on headless servers. After applying, the Ctrl-Alt-Del logout shortcut no longer works for desktop users, a deliberate availability protection. This does not affect the systemd ctrl-alt-del.target at the text console (that is a separate control); it only neutralizes the GNOME media-key binding. Precaution: ensure operators have a documented, intentional reboot procedure (menu, systemctl reboot) before relying on the shortcut being gone. No reboot needed; dconf update is sufficient.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | 3.1.2, AC-6(1), CM-6(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-271030, UBTU-24-300025 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.