AlmaLinux OS 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-269280 | ALMA-09-022570 | SV-269280r1050162_rule | Medium |
| Description |
| A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons are pressed at the login screen, this can create the risk of short-term loss of availability of systems due to reboot. |
| STIG | Date |
| CloudLinux AlmaLinux OS 9 Security Technical Implementation Guide | 2025-05-22 |
Details
| Check Text (C-73311r1049432_chk) |
| Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify AlmaLinux OS 9 prevents a user from overriding the disable-restart-buttons setting for graphical user interfaces. Determine which profile the system database is using with the following command: $ grep system-db /etc/dconf/profile/user system-db:local Check that graphical settings are locked from nonprivileged user modification with the following command: Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. $ grep disable-restart-buttons /etc/dconf/db/local.d/locks/* /org/gnome/login-screen/disable-restart-buttons If the command does not return at least the example result, this is a finding. |
| Fix Text (F-73212r1049433_fix) |
| Configure AlmaLinux OS 9 to prevent a user from overriding the disable-restart-buttons setting for graphical user interfaces. Create a database to contain the systemwide graphical user logon settings (if it does not already exist) with the following command: $ touch /etc/dconf/db/local.d/locks/session Add the following line to prevent nonprivileged users from modifying it: /org/gnome/login-screen/disable-restart-buttons Run the following command to update the database: $ dconf update |