{"description": "\n\n\nTo set the screensaver mode in the GNOME3 desktop to a blank screen,\nadd or set <tt>picture-uri</tt> to <tt>string ''</tt> in\n<tt>/etc/dconf/db/local.d/00-security-settings</tt>. For example:\n<pre>[org/gnome/desktop/screensaver]\npicture-uri=string ''\n</pre>\nOnce the settings have been added, add a lock to\n<tt>/etc/dconf/db/local.d/locks/00-security-settings-lock</tt> to prevent user modification.\nFor example:\n<pre>/org/gnome/desktop/screensaver/picture-uri</pre>\nAfter the settings have been set, run <tt>dconf update</tt>.", "rationale": "Setting the screensaver mode to blank-only conceals the\ncontents of the display from passersby.", "severity": "medium", "references": {"cis-csc": ["1", "12", "15", "16"], "cjis": ["5.5.5"], "cobit5": ["DSS05.04", "DSS05.10", "DSS06.10"], "cui": ["3.1.10"], "isa-62443-2009": ["4.3.3.6.1", "4.3.3.6.2", "4.3.3.6.3", "4.3.3.6.4", "4.3.3.6.5", "4.3.3.6.6", "4.3.3.6.7", "4.3.3.6.8", "4.3.3.6.9"], "isa-62443-2013": ["SR 1.1", "SR 1.10", "SR 1.2", "SR 1.5", "SR 1.7", "SR 1.8", "SR 1.9"], "iso27001-2013": ["A.18.1.4", "A.9.2.1", "A.9.2.4", "A.9.3.1", "A.9.4.2", "A.9.4.3"], "nist": ["AC-11(1)", "CM-6(a)", "AC-11(1).1"], "nist-csf": ["PR.AC-7"], "pcidss": ["Req-8.1.8"], "srg": ["SRG-OS-000031-GPOS-00012"], "pcidss4": ["8.2.8", "8.2"]}, "control_references": {"pcidss4": ["8.2.8", "8.2"]}, "components": [], "identifiers": {}, "ocil_clause": "it is not set or configured properly", "ocil": "To ensure the screensaver is configured to be blank, run the following command:\n<pre>$ gsettings get org.gnome.desktop.screensaver picture-uri</pre>\nIf properly configured, the output should be <tt>''</tt>.\n\nTo ensure that users cannot set the screensaver background, run the following:\n<pre>$ grep picture-uri /etc/dconf/db/local.d/locks/*</pre>\nIf properly configured, the output should be <tt>/org/gnome/desktop/screensaver/picture-uri</tt>", "oval_external_content": null, "fixtext": "The dconf settings can be edited in the /etc/dconf/db/* location.\n\nFirst, add or update the [org/gnome/desktop/screensaver] section of the \"/etc/dconf/db/local.d/00-security-settings\" database file and add or update the following lines:\n\n[org/gnome/desktop/screensaver]\npicture-uri=string ''\n\nThen, add the following line to \"/etc/dconf/db/local.d/locks/00-security-settings-lock\" to prevent user modification:\n\n/org/gnome/desktop/screensaver/picture-uri\n\nFinally, update the dconf system databases:\n\n$ sudo dconf update", "checktext": "", "vuldiscussion": "", "srg_requirement": "", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {"stig": {"srg_requirement": "Ubuntu 22.04 must conceal, via the session lock, information previously visible on the display with a publicly viewable image.", "fixtext": "Configure Ubuntu 22.04 to prevent a user from overriding the picture-uri setting for graphical user interfaces.\n\nIn the file \"/etc/dconf/db/local.d/00-security-settings\", add or update the following lines:\n\n[org/gnome/desktop/screensaver]\npicture-uri=''\n\nPrevent user modification by adding the following line to \"/etc/dconf/db/local.d/locks/00-security-settings-lock\":\n\n/org/gnome/desktop/screensaver/picture-uri\n\nUpdate the dconf system databases:\n\n$ sudo dconf update", "checktext": "Note: This requirement assumes the use of the Ubuntu 22.04 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable.\n\nTo ensure the screensaver is configured to be blank, run the following command:\n\n$ gsettings writable org.gnome.desktop.screensaver picture-uri\n\nfalse\n\nIf \"picture-uri\" is writable and the result is \"true\", this is a finding.", "vuldiscussion": "Setting the screensaver mode to blank-only conceals the contents of the display from passersby."}}, "platform": null, "platforms": [], "sce_metadata": {}, "inherited_platforms": ["package[gdm]"], "cpe_platform_names": [], "inherited_cpe_platform_names": ["package_gdm"], "bash_conditional": null, "fixes": {}, "title": "Implement Blank Screensaver", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/rule.yml", "template": null}