Disable the GNOME3 Login Restart and Shutdown Buttons
Removes the restart and shutdown buttons from the GNOME (GDM) login screen by setting disable-restart-buttons=true and locking the key.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The GDM login screen normally offers restart and shutdown buttons that anyone with physical access can press without authenticating. Pressing them causes an unplanned reboot or power-off, a short-term loss of availability that an unauthenticated person at the console should not be able to trigger. Setting disable-restart-buttons=true and locking it removes these buttons from the greeter.
What Pavois checks
Pavois checks the effective dconf state: the last definition of disable-restart-buttons across /etc/dconf/db/*.d/* must resolve to true, and the key /org/gnome/login-screen/disable-restart-buttons must appear in a dconf lock file. Evaluating resolved precedence (last drop-in wins) plus the lock matches how dconf computes the value, catching a later drop-in that re-enables the buttons or unlocks the key.
only_if { command('dconf').exist? }
describe command('{ s=$(grep -rhE \'^[[:space:]]*disable-restart-buttons[[:space:]]*=\' /etc/dconf/db/*.d/* 2>/dev/null | tail -1 | sed -E \'s/^[^=]*=[[:space:]]*//\' | tr -d "\'\\""); [ "$s" = "true" ] && grep -rqxF \'/org/gnome/login-screen/disable-restart-buttons\' /etc/dconf/db/*/locks/* 2>/dev/null && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
After dconf update, run gsettings get org.gnome.login-screen disable-restart-buttons (should print true) and confirm the key is locked by checking /etc/dconf/db/*/locks/* for /org/gnome/login-screen/disable-restart-buttons. The buttons should no longer appear on the GDM greeter.
Inspect & investigate
dconf has no runtime log; verify with gsettings get org.gnome.login-screen disable-restart-buttons and inspect /etc/dconf/db/*.d/* and /etc/dconf/db/*/locks/*. Actual power-state changes are logged by systemd, review with journalctl -b -1 (previous boot) or last -x | grep -E 'reboot|shutdown'.
Remediation
Pavois's harden plan uses the dconf resource to write disable-restart-buttons=true into a system dconf profile drop-in, add /org/gnome/login-screen/disable-restart-buttons to a locks file, and run dconf update. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | org/gnome/login-screen/disable-restart-buttons |
|---|---|
| resource | dconf |
| value | true |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Applies only to RHEL 9 GNOME/GDM hosts; irrelevant on headless servers. After applying, no one can reboot or power off from the login screen without authenticating first. Precaution: ensure authorized administrators retain a way to reboot/shut down (authenticated session, systemctl reboot/poweroff, or out-of-band/IPMI) so legitimate maintenance is not blocked. No reboot needed; dconf update is sufficient.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | 3.1.2 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.