← All rules
SOCLE-CLD-GEN-016// GNOME desktop (dconf)mediumpersistent config

Set GNOME3 Screensaver Lock Delay After Activation Period

Sets the delay between screensaver activation and screen lock via lock-delay in the system dconf database, locked against user override.

Checked against the content of a persistent configuration file, the source of truth that survives reboots.

A pass proves? running now✓ on disk✓ survives rebootthe qualified verdict →
Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 4 standards

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

Once the screensaver activates on idle, lock-delay controls how long afterward the screen actually locks. A short, fixed lock-delay closes the gap between the screen blanking and requiring a password. If it is unset or large, the screensaver can be running while the session is still unlocked, so a passer-by can simply move the mouse and resume the user's session without authenticating.

What Pavois checks

Pavois verifies in the effective dconf configuration that a drop-in under /etc/dconf/db/*.d/ sets lock-delay, and that /org/gnome/desktop/screensaver/lock-delay is in a locks/ file so users cannot lengthen it. Reading the resolved dconf database catches the value wherever a keyfile defines it.

only_if { command('dconf').exist? }
describe command('{ grep -rqE \'^[[:space:]]*lock-delay[[:space:]]*=\' /etc/dconf/db/*.d/* 2>/dev/null && grep -rqxF \'/org/gnome/desktop/screensaver/lock-delay\' /etc/dconf/db/*/locks/* 2>/dev/null && echo ok; } || echo ko') do
  its('stdout.strip') { should eq 'ok' }
end

How to verify it is applied

Run dconf read /org/gnome/desktop/screensaver/lock-delay (or gsettings get org.gnome.desktop.screensaver lock-delay); the expected output is a small uint32, e.g. uint32 0 to lock immediately or uint32 5. Confirm the lock with grep -r lock-delay /etc/dconf/db/*/locks/.

Inspect & investigate

Screensaver activation and lock transitions are logged in the user session journal: journalctl --user -u gnome-session and via journalctl _COMM=gnome-shell. The current lock state is exposed over D-Bus by org.gnome.ScreenSaver.

Remediation

Pavois's harden plan uses the dconf resource to write the keyfile setting lock-delay to a small value and a matching locks/ entry, then runs dconf update. Apply with pavois harden apply.

Pavois applies this with its own harden engine, the plan below, not a shell script:

keyorg/gnome/desktop/screensaver/lock-delay
resourcedconf
valueuint32 5
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Low impact: it only changes how quickly the lock engages after the screensaver starts; users re-authenticate as normal. Precaution: a very short delay combined with an aggressive idle-delay can lock users out during brief pauses, tune lock-delay and idle-delay together. Affects only hosts running the GNOME desktop; exempt kiosks/dashboards that must stay unlocked.

Standards mapping

StandardReferenceTypeVersionConfidence
CIS1.7.4, 1.8.5, 1.7.5, 8.2.8directper OS, see the benchmark tablehigh
NIST3.1.10, AC-11(a), CM-6(a)supporting800-53 Rev 5 · 800-171 Rev 2 (pinned)medium
PCI DSS8.2.8supporting4.0.1medium
DISA STIGUBTU-22-271025, UBTU-24-200020directper OS STIG releasehigh

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references