Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period
Ensures the screensaver lock policy (lock-enabled) is both set and locked in the system dconf database so users cannot disable it.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Setting the screensaver lock is not enough if any user can flip it back off. This rule ensures /org/gnome/desktop/screensaver/lock-enabled is locked in the dconf database, so the policy cannot be overridden per-user. Without the lock, a user could disable screen locking from GNOME Settings and silently reopen the unattended-session exposure the policy was meant to close.
What Pavois checks
Pavois verifies in the effective dconf configuration that a drop-in under /etc/dconf/db/*.d/ sets lock-enabled, and crucially that /org/gnome/desktop/screensaver/lock-enabled appears in a locks/ file, the lock is what this rule enforces. Reading the resolved dconf database (default DB keyfiles + locks) is the only way to confirm the setting is non-overridable, which a per-user GUI check could not.
only_if { command('dconf').exist? }
describe command('{ grep -rqE \'^[[:space:]]*lock-enabled[[:space:]]*=\' /etc/dconf/db/*.d/* 2>/dev/null && grep -rqxF \'/org/gnome/desktop/screensaver/lock-enabled\' /etc/dconf/db/*/locks/* 2>/dev/null && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Confirm the lock entry with grep -r '/org/gnome/desktop/screensaver/lock-enabled' /etc/dconf/db/*/locks/ (it must be listed). As a user, gsettings set org.gnome.desktop.screensaver lock-enabled false should be rejected/ineffective, and dconf read /org/gnome/desktop/screensaver/lock-enabled should stay true.
Inspect & investigate
Screensaver lock/unlock activity is logged in the user session journal: journalctl --user -u gnome-session and via journalctl _COMM=gnome-shell. The live state is exposed over D-Bus by org.gnome.ScreenSaver.
Remediation
Pavois's harden plan uses the dconf resource to write both the keyfile setting lock-enabled=true and the locks/ entry that pins it, then runs dconf update so users can no longer change it. Apply with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | org/gnome/desktop/screensaver/lock-enabled |
|---|---|
| resource | dconf |
| value | true |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low impact, but stricter than just enabling the lock: users lose the ability to turn screen locking off for their session. Precaution: this is intentional, only exempt hosts (kiosks, dashboards) where an always-unlocked screen is a documented, physically-controlled requirement. Make sure the locked value is the secure one (true) before pinning it, since the lock prevents users from correcting a mistakenly-locked insecure value.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | 3.1.10 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.