documentation_complete: true

prodtype: rhel7,fedora

title: 'Enable GNOME3 Screensaver Idle Activation'

description: "To activate the screensaver in the GNOME3 desktop after a period of inactivity,\nadd or set <tt>idle-activation-enabled</tt> to <tt>true</tt> in \n<tt>/etc/dconf/db/local.d/00-security-settings</tt>. For example:\n<pre>[org/gnome/desktop/screensaver]\nidle_activation_enabled=true</pre>\nOnce the setting has been added, add a lock to\n<tt>/etc/dconf/db/local.d/locks/00-security-settings-lock</tt> to prevent user modification.\nFor example:\n<pre>/org/gnome/desktop/screensaver/idle-activation-enabled</pre>\nAfter the settings have been set, run <tt>dconf update</tt>."

rationale: |-
    A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
    physical vicinity of the information system but does not logout because of the temporary nature of the absence.
    Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,
    GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the
    session lock.
    <br /><br />
    Enabling idle activation of the screensaver ensures the screensaver will
    be activated after the idle delay.  Applications requiring continuous,
    real-time screen display (such as network management products) require the
    login session does not have administrator rights and the display station is located in a
    controlled-access area.

severity: medium

identifiers:
    cce@rhel7: 80111-8

references:
    cjis: 5.5.5
    cui: 3.1.10
    disa: 57
    nist: AC-11(a)
    ospp@rhel7: FMT_MOF_EXT.1
    pcidss: Req-8.1.8
    srg: SRG-OS-000029-GPOS-00010
    stigid@rhel7: "010100"

ocil_clause: 'idle_activation_enabled is not enabled or configured'

ocil: |-
    To check the screensaver mandatory use status, run the following command:
    <pre>$ gsettings get org.gnome.desktop.screensaver idle-activation-enabled</pre>
    If properly configured, the output should be <tt>true</tt>.
    To ensure that users cannot disable the screensaver idle inactivity setting, run the following:
    <pre>$ grep idle-activation-enabled /etc/dconf/db/local.d/locks/*</pre>
    If properly configured, the output should be <tt>/org/gnome/desktop/screensaver/idle-activation-enabled</tt>
