RHEL 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-258030	RHEL-09-271100	SV-258030r991589_rule		Medium

Description
A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons are pressed at the login screen, this can create the risk of short-term loss of availability of systems due to reboot.

STIG	Date
Red Hat Enterprise Linux 9 Security Technical Implementation Guide	2024-06-04

Details

Check Text ( C-61771r926075_chk )
Verify RHEL 9 prevents a user from overriding the disable-restart-buttons setting for graphical user interfaces. Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Determine which profile the system database is using with the following command: $ sudo grep system-db /etc/dconf/profile/user system-db:local Check that graphical settings are locked from nonprivileged user modification with the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ grep disable-restart-buttons /etc/dconf/db/local.d/locks/* /org/gnome/login-screen/disable-restart-buttons If the command does not return at least the example result, this is a finding.

Check Text ( C-61771r926075_chk )

Verify RHEL 9 prevents a user from overriding the disable-restart-buttons setting for graphical user interfaces.

Note: This requirement assumes the use of the RHEL 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable.

Determine which profile the system database is using with the following command:

$ sudo grep system-db /etc/dconf/profile/user

system-db:local

Check that graphical settings are locked from nonprivileged user modification with the following command:

Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used.

$ grep disable-restart-buttons /etc/dconf/db/local.d/locks/*

/org/gnome/login-screen/disable-restart-buttons

If the command does not return at least the example result, this is a finding.

Fix Text (F-61695r926076_fix)
Configure RHEL 9 to prevent a user from overriding the disable-restart-buttons setting for graphical user interfaces. Create a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command: $ sudo touch /etc/dconf/db/local.d/locks/session Add the following line to prevent nonprivileged users from modifying it: /org/gnome/login-screen/disable-restart-buttons Run the following command to update the database: $ sudo dconf update

Fix Text (F-61695r926076_fix)

Configure RHEL 9 to prevent a user from overriding the disable-restart-buttons setting for graphical user interfaces.

Create a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command:

$ sudo touch /etc/dconf/db/local.d/locks/session

Add the following line to prevent nonprivileged users from modifying it:

/org/gnome/login-screen/disable-restart-buttons

Run the following command to update the database:

$ sudo dconf update