Detections
Analytics

RHEL-10-700790 - RHEL 10 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.

Information

Setting the screensaver mode to blank-only conceals the contents of the display from passersby.

Solution

Configure RHEL 10 to prevent a user from overriding the picture-uri setting for graphical user interfaces.

Note: The example below is using the database "local" for the system. If the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory.

Update the "/etc/dconf/db/local.d/00-security-settings" file to prevent a user from overriding the "picture-uri" setting:

$ sudo vi /etc/dconf/db/local.d/00-security-settings

[org/gnome/desktop/screensaver]
picture-uri=''

Update the "/etc/dconf/db/local.d/locks/00-security-settings-lock" file to prevent a user from modifying the lock applied to the "picture-uri" setting:

$ sudo vi /etc/dconf/db/local.d/locks/00-security-settings-lock

/org/gnome/desktop/screensaver/picture-uri

Update the dconf system databases:

$ sudo dconf update

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_10_V1R1_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-11(1), CAT|II, CCI|CCI-000060, Rule-ID|SV-281282r1166798_rule, STIG-ID|RHEL-10-700790, Vuln-ID|V-281282

Plugin: Unix

Control ID: 1c3b932ad2a2f7ce8d56eebbb42b9e45925b44d36ccf4efc46bd07aea074dcb8