Enable GNOME3 Screensaver Idle Activation
Enables automatic screensaver activation after the idle delay via idle-activation-enabled=true in the system dconf database, locked against user override.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
A session time-out lock is taken when a user steps away without logging out. Rather than trusting users to lock manually, GNOME can detect an idle session and activate the screensaver. Setting idle-activation-enabled=true is the trigger that makes the idle delay and lock-on-screensaver settings actually fire. If it is off, an unattended desktop stays open indefinitely, exposing the live session to anyone who walks up.
What Pavois checks
Pavois reads the effective dconf configuration: it resolves the last-defined idle-activation-enabled value across /etc/dconf/db/*.d/ drop-ins, requires true, and checks /org/gnome/desktop/screensaver/idle-activation-enabled is in a locks/ file so users cannot disable it. Evaluating the resolved value (last keyfile wins) mirrors how dconf applies the policy and avoids a false pass if a later drop-in turns it off.
only_if { command('dconf').exist? }
describe command('{ s=$(grep -rhE \'^[[:space:]]*idle-activation-enabled[[:space:]]*=\' /etc/dconf/db/*.d/* 2>/dev/null | tail -1 | sed -E \'s/^[^=]*=[[:space:]]*//\' | tr -d "\'\\""); [ "$s" = "true" ] && grep -rqxF \'/org/gnome/desktop/screensaver/idle-activation-enabled\' /etc/dconf/db/*/locks/* 2>/dev/null && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run dconf read /org/gnome/desktop/screensaver/idle-activation-enabled (or gsettings get org.gnome.desktop.screensaver idle-activation-enabled); the expected output is true. Confirm the lock with grep -r idle-activation-enabled /etc/dconf/db/*/locks/.
Inspect & investigate
Screensaver activation and idle transitions are logged in the user session journal: journalctl --user -u gnome-session and via journalctl _COMM=gnome-shell. The current state can be queried live with gnome-screensaver-command -q where available.
Remediation
Pavois's harden plan uses the dconf resource to write the keyfile setting idle-activation-enabled=true and a matching locks/ entry, then runs dconf update. Apply with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | org/gnome/desktop/screensaver/idle-activation-enabled |
|---|---|
| resource | dconf |
| value | true |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low impact: the screensaver simply starts after the configured idle delay. Precaution: kiosks, dashboards, or monitoring stations that must keep the screen on continuously will be interrupted, exempt those hosts (and rely on their controlled-access location and non-privileged session instead), and pair this with a sensible idle-delay so users are not locked out mid-task.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | 3.1.10 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 8.2.8 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.