RHEL 10 must initiate a session lock for graphical user interfaces when the screensaver is activated.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-281280 | RHEL-10-700770 | SV-281280r1166792_rule | CCI-000057 | medium |
| Description | ||||
| A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. Satisfies: SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012 | ||||
| STIG | Date | |||
| Red Hat Enterprise Linux 10 Security Technical Implementation Guide | 2026-03-11 | |||
Related Frameworks
3 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
AC-11
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1711 mapping
3.1.10
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000057
1.00
- DISA · V1R1 · disa_xccdf · related
Details
Check Text (C-281280r1166792_chk)
Note: This requirement assumes the use of the RHEL 10 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is not applicable.
Verify RHEL 10 initiates a session lock for graphical user interfaces when the screensaver is activated with the following command:
$ gsettings get org.gnome.desktop.screensaver lock-delay
uint32 5
If the "uint32" setting is not set to "5" or less, or is missing, this is a finding.
Fix Text (F-85746r1166791_fix)
Configure RHEL 10 to initiate a session lock for graphical user interfaces when a screensaver is activated.
Note: The example below is using the database "local" for the system. If the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory.
Create a database to contain the systemwide screensaver settings (if it does not already exist) with the following command:
$ sudo vi /etc/dconf/db/local.d/00-screensaver
[org/gnome/desktop/screensaver]
lock-delay=uint32 5
The "uint32" must be included along with the integer key values as shown.
Update the system databases:
$ sudo dconf update