Remove the GDM Package Group
Removes the GNOME Display Manager (gdm) so headless and server systems carry no graphical login stack.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The GNOME Display Manager (gdm) pulls in a full graphical login stack that is unnecessary on servers, virtualization hypervisors and headless hosts. Each extra service is additional code that can contain vulnerabilities and additional attack surface. Removing the graphical environment from systems that do not need it enforces the principle of least functionality required by CIS and NIST CM-7.
What Pavois checks
Pavois queries the package database with package('gdm') to report the effective install state. This is more reliable than checking the default systemd target or an X session file: the display manager package can remain installed even when the system boots to multi-user.target, and only a package query reveals that residual surface.
describe package('gdm3') do
it { should_not be_installed }
endHow to verify it is applied
On RHEL-family run rpm -q gdm; on Debian/Ubuntu run dpkg -s gdm3 (the package is named gdm3 there). The rule passes when the result is package ... is not installed.
Inspect & investigate
Confirm removal with rpm -q gdm / dpkg -s gdm3. The display manager's own activity (when present) is in journalctl -u gdm / journalctl -u gdm3; removal is logged in /var/log/dnf.log or /var/log/dpkg.log.
Remediation
Pavois's harden plan removes the gdm package (resource package, action remove) when you run pavois harden apply. Removing the display manager stops the graphical login, so the host will boot to a text console afterwards.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | gdm3 |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Do not apply on workstations or any host where a graphical desktop is required, removing gdm disables the graphical login and may drag in dependent GNOME packages. Precaution: only run this on servers/hypervisors that are administered over SSH or a text console; ensure you have working remote/console access before removing, since the local graphical session will no longer be available.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.7.1, 1.8.1, 2.1.21 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.