Implement Blank Screensaver
Forces the GNOME screensaver to display a blank screen (empty picture-uri) and locks that setting so users cannot override it.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Setting the screensaver mode to blank-only conceals the contents of the display from passersby.
What Pavois checks
Pavois verifies, via the effective dconf database under /etc/dconf/db/*.d/, that the picture-uri key is set system-wide AND that /org/gnome/desktop/screensaver/picture-uri appears in a locks/ file. Inspecting the compiled-source dconf keyfiles plus their lock entries is what proves the policy is both applied and non-overridable, a check that only read a user's ~/.config would miss the mandatory system policy.
only_if { command('dconf').exist? }
describe command('{ grep -rqE \'^[[:space:]]*picture-uri[[:space:]]*=\' /etc/dconf/db/*.d/* 2>/dev/null && grep -rqxF \'/org/gnome/desktop/screensaver/picture-uri\' /etc/dconf/db/*/locks/* 2>/dev/null && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run gsettings get org.gnome.desktop.screensaver picture-uri (expect an empty string '') and confirm the lock with grep -r picture-uri /etc/dconf/db/*/locks/. Re-running the InSpec command should print ok.
Inspect & investigate
dconf changes are not logged to syslog; inspect state directly with gsettings get org.gnome.desktop.screensaver picture-uri and list the active databases with ls /etc/dconf/db/. After editing keyfiles, dconf update recompiles the binary databases.
Remediation
pavois harden apply uses the dconf resource to write picture-uri='' into a system dconf keyfile, add the matching entry to the locks/ directory, then run dconf update so the policy takes effect for all users.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | org/gnome/desktop/screensaver/picture-uri |
|---|---|
| resource | dconf |
| value | '' |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low risk: only the screensaver background is affected, no login or service disruption. After applying, users must log out and back in (or run dconf update) for the new mandatory policy to load. This rule only matters on systems with a GNOME desktop installed; on headless servers it is not applicable.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | 3.1.10, AC-11(1), AC-11(1).1, CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 8.2.8 | supporting | 4.0.1 | medium |
| CIS | 8.2.8 | direct | per OS, see the benchmark table | high |
| DISA STIG | UBTU-24-200043 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.