Set GNOME3 Screensaver Lock Delay After Activation Period
Sets the delay between screensaver activation and screen lock via lock-delay in the system dconf database, locked against user override.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Once the screensaver activates on idle, lock-delay controls how long afterward the screen actually locks. A short, fixed lock-delay closes the gap between the screen blanking and requiring a password. If it is unset or large, the screensaver can be running while the session is still unlocked, so a passer-by can simply move the mouse and resume the user's session without authenticating.
What Pavois checks
Pavois verifies in the effective dconf configuration that a drop-in under /etc/dconf/db/*.d/ sets lock-delay, and that /org/gnome/desktop/screensaver/lock-delay is in a locks/ file so users cannot lengthen it. Reading the resolved dconf database catches the value wherever a keyfile defines it.
only_if { command('dconf').exist? }
describe command('{ grep -rqE \'^[[:space:]]*lock-delay[[:space:]]*=\' /etc/dconf/db/*.d/* 2>/dev/null && grep -rqxF \'/org/gnome/desktop/screensaver/lock-delay\' /etc/dconf/db/*/locks/* 2>/dev/null && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run dconf read /org/gnome/desktop/screensaver/lock-delay (or gsettings get org.gnome.desktop.screensaver lock-delay); the expected output is a small uint32, e.g. uint32 0 to lock immediately or uint32 5. Confirm the lock with grep -r lock-delay /etc/dconf/db/*/locks/.
Inspect & investigate
Screensaver activation and lock transitions are logged in the user session journal: journalctl --user -u gnome-session and via journalctl _COMM=gnome-shell. The current lock state is exposed over D-Bus by org.gnome.ScreenSaver.
Remediation
Pavois's harden plan uses the dconf resource to write the keyfile setting lock-delay to a small value and a matching locks/ entry, then runs dconf update. Apply with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | org/gnome/desktop/screensaver/lock-delay |
|---|---|
| resource | dconf |
| value | uint32 5 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low impact: it only changes how quickly the lock engages after the screensaver starts; users re-authenticate as normal. Precaution: a very short delay combined with an aggressive idle-delay can lock users out during brief pauses, tune lock-delay and idle-delay together. Affects only hosts running the GNOME desktop; exempt kiosks/dashboards that must stay unlocked.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.7.4, 1.8.5, 1.7.5, 8.2.8 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.10, AC-11(a), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 8.2.8 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-271025, UBTU-24-200020 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.