Enable the GNOME3 Screen Locking On Smartcard Removal
Configures GNOME to lock the screen automatically when the user's smartcard is removed, enforced system-wide via the dconf database and locked against user override.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
On smartcard-authenticated workstations, the card is the user's physical token of presence. If removing it does not lock the session, a user who walks away while pocketing their badge leaves an unlocked, authenticated session exposed to anyone nearby. Setting removal-action='lock-screen' ties the session lock to the physical token, closing the window of unattended access.
What Pavois checks
Pavois confirms two things in the effective dconf configuration: that a key file under /etc/dconf/db/*.d/ actually sets removal-action, and that /org/gnome/settings-daemon/peripherals/smartcard/removal-action appears in a locks/ file so users cannot override it. Reading the resolved dconf database (not a single GUI dialog) catches the value wherever a drop-in defines it.
only_if { command('dconf').exist? }
describe command('{ grep -rqE \'^[[:space:]]*removal-action[[:space:]]*=\' /etc/dconf/db/*.d/* 2>/dev/null && grep -rqxF \'/org/gnome/settings-daemon/peripherals/smartcard/removal-action\' /etc/dconf/db/*/locks/* 2>/dev/null && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
As a logged-in desktop user run gsettings get org.gnome.settings-daemon.peripherals.smartcard active-action (or inspect dconf read /org/gnome/settings-daemon/peripherals/smartcard/removal-action); the expected output is 'lock-screen'. Confirm the lock with grep -r removal-action /etc/dconf/db/*/locks/.
Inspect & investigate
Smartcard removal and session-lock events surface in the user session journal: journalctl --user -u gnome-session and journalctl -u gdm. The smartcard subsystem (pcscd / opensc) logs card insert/remove via journalctl -u pcscd.
Remediation
Pavois's harden plan uses the dconf resource to write the key file setting removal-action='lock-screen' and a matching locks/ entry, then runs dconf update so the change takes effect for all users. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | org/gnome/settings-daemon/peripherals/smartcard/removal-action |
|---|---|
| resource | dconf |
| value | 'lock-screen' |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Functional impact is minimal: only sessions on smartcard-equipped machines are affected, and the lock simply requires re-authentication. Precaution: if smartcards are also the only login method, removing the card now locks the screen and re-insertion + PIN is needed to return, make sure a working fallback (a known PIN or an admin account) exists before rollout so a misread card does not strand a user. On servers with no graphical session this rule has no runtime effect.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| DISA STIG | UBTU-24-200042 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.