Enable GNOME3 Screensaver Lock After Idle Period
Forces the GNOME screensaver to lock the session when it activates, via lock-enabled=true in the system dconf database, locked against user override.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
lock-enabled is the master switch that makes the GNOME screensaver actually require a password when it activates. With idle-delay and idle-activation set but lock-enabled=false, the screensaver runs but never locks, the session stays accessible, defeating the whole point of an idle timeout. Enabling it ensures an unattended workstation demands re-authentication.
What Pavois checks
Pavois reads the effective dconf configuration: it resolves the last-defined lock-enabled value across /etc/dconf/db/*.d/ drop-ins, requires true, and checks /org/gnome/desktop/screensaver/lock-enabled is in a locks/ file so users cannot disable locking. Evaluating the resolved value (last keyfile wins) mirrors how dconf applies the policy and avoids a false pass if a later drop-in turns it off.
only_if { command('dconf').exist? }
describe command('{ s=$(grep -rhE \'^[[:space:]]*lock-enabled[[:space:]]*=\' /etc/dconf/db/*.d/* 2>/dev/null | tail -1 | sed -E \'s/^[^=]*=[[:space:]]*//\' | tr -d "\'\\""); [ "$s" = "true" ] && grep -rqxF \'/org/gnome/desktop/screensaver/lock-enabled\' /etc/dconf/db/*/locks/* 2>/dev/null && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run dconf read /org/gnome/desktop/screensaver/lock-enabled (or gsettings get org.gnome.desktop.screensaver lock-enabled); the expected output is true. Confirm the lock with grep -r lock-enabled /etc/dconf/db/*/locks/.
Inspect & investigate
Lock and unlock events are logged in the user session journal: journalctl --user -u gnome-session and via journalctl _COMM=gnome-shell. The live lock state is exposed over D-Bus by org.gnome.ScreenSaver (gdbus call ... GetActive).
Remediation
Pavois's harden plan uses the dconf resource to write the keyfile setting lock-enabled=true and a matching locks/ entry, then runs dconf update. Apply with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | org/gnome/desktop/screensaver/lock-enabled |
|---|---|
| resource | dconf |
| value | true |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low impact: users will need to re-authenticate after the screensaver activates, which is the intended behavior. Precaution: ensure users know their password (especially on systems where they normally only use a smartcard or SSO), and exempt kiosk/dashboard hosts that must keep the screen accessible. Combine with a sensible idle-delay so locking is not premature.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.7.4, 1.7.5, 8.2.8 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), 3.1.10 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 8.2.8 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-271020, UBTU-24-200020 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.