Detections
Analytics
RHEL-10-700730 - RHEL 10 must prevent a user from overriding the disabling of the graphical user smart card removal action.
Information
A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.The session lock is implemented at the point where session activity can be determined. Rather than be forced to wait for a period of time to expire before the user session can be locked, RHEL 10 must provide users with the ability to manually invoke a session lock so users can secure their session if they must temporarily vacate the immediate physical vicinity.
Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011
Solution
Configure RHEL 10 to prevent a user from overriding the disabling of the graphical user smart card removal action.Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user override of the smart card removal action:
/org/gnome/settings-daemon/peripherals/smartcard/removal-action
Update the dconf system databases:
$ sudo dconf update
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_10_V1R1_STIG.zip
Item Details
Audit Name: DISA Red Hat Enterprise Linux 10 STIG v1r1
Category: ACCESS CONTROL
References: 800-53|AC-11a., 800-53|AC-11b., CAT|II, CCI|CCI-000056, CCI|CCI-000057, Rule-ID|SV-281276r1166780_rule, STIG-ID|RHEL-10-700730, Vuln-ID|V-281276
Plugin: Unix
Control ID: bbb00a5f5934bff1fb3512d67081a14bd9afcd049886b879a53acda59454b1cb