Disable Full User Name on Splash Shield
Sets the GNOME screensaver show-full-name-in-top-bar key to false and locks it so the logged-in user's full name is not shown on the lock/splash shield.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
Why this rule matters
Setting the splash screen to not reveal the logged in user's name conceals who has access to the system from passersby.
What Pavois checks
Pavois reads the effective system dconf keyfiles under /etc/dconf/db/*.d/, takes the last (winning) show-full-name-in-top-bar value, requires it to equal false, and confirms a matching entry exists in locks/. Resolving the keyfiles in precedence order plus the lock proves the setting is mandatory and cannot be re-enabled by a user, something a per-file glance could not establish.
only_if { command('dconf').exist? }
describe command('{ s=$(grep -rhE \'^[[:space:]]*show-full-name-in-top-bar[[:space:]]*=\' /etc/dconf/db/*.d/* 2>/dev/null | tail -1 | sed -E \'s/^[^=]*=[[:space:]]*//\' | tr -d "\'\\""); [ "$s" = "false" ] && grep -rqxF \'/org/gnome/desktop/screensaver/show-full-name-in-top-bar\' /etc/dconf/db/*/locks/* 2>/dev/null && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run gsettings get org.gnome.desktop.screensaver show-full-name-in-top-bar (expect false) and confirm the lock with grep -r show-full-name-in-top-bar /etc/dconf/db/*/locks/. Re-running the InSpec command should print ok.
Inspect & investigate
dconf does not log to syslog; check the live value with gsettings get org.gnome.desktop.screensaver show-full-name-in-top-bar and list active databases with ls /etc/dconf/db/. dconf update recompiles the binary databases after a keyfile change.
Remediation
pavois harden apply uses the dconf resource to write show-full-name-in-top-bar=false into a system dconf keyfile, add the matching entry to locks/, then run dconf update to enforce it for all users.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | org/gnome/desktop/screensaver/show-full-name-in-top-bar |
|---|---|
| resource | dconf |
| value | false |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low risk: only the on-screen label changes, no authentication or service impact. Users must re-login (or dconf update must run) for the mandatory policy to load. Applicable only to GNOME desktop systems; irrelevant on headless servers.