Detections
Analytics

1.351 RHEL-10-700790

Information

RHEL 10 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

GROUP ID: V-281282RULE ID: SV-281282r1166798

Setting the screensaver mode to blank-only conceals the contents of the display from passersby.

Solution

Configure RHEL 10 to prevent a user from overriding the picture-uri setting for graphical user interfaces.

Note: The example below is using the database "local" for the system. If the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory.

Update the "/etc/dconf/db/local.d/00-security-settings" file to prevent a user from overriding the "picture-uri" setting:

$ sudo vi /etc/dconf/db/local.d/00-security-settings

[org/gnome/desktop/screensaver]picture-uri=''

Update the "/etc/dconf/db/local.d/locks/00-security-settings-lock" file to prevent a user from modifying the lock applied to the "picture-uri" setting:

$ sudo vi /etc/dconf/db/local.d/locks/00-security-settings-lock

/org/gnome/desktop/screensaver/picture-uri

Update the dconf system databases:

$ sudo dconf update

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-11(1), CAT|II, CCI|CCI-000060, Rule-ID|SV-281282r1166798_rule, STIG-ID|RHEL-10-700790, Vuln-ID|V-281282

Plugin: Unix

Control ID: 78f535c8645ca3eb40f5e79e6e63b2cb836211874b06d6038e82a80d55a8f3c6