Lock the session when the screen saver starts and when the system suspends

Description

• GNOME locks the screen when it blanks and before the system suspends (lid close, suspend key, idle suspend) when org.gnome.desktop.screensaver lock-enabled is true, and lets users lock at all when org.gnome.desktop.lockdown disable-lock-screen is false. Both keys are set in the system dconf database local and locked.
• KDE Plasma locks on resume when LockOnResume is not false in the [Daemon] group of kscreenlockerrc; the system file /etc/xdg/kscreenlockerrc must mark the group immutable ([Daemon][$i]).

These are Debian's defaults, but users can change them unless the keys are locked. With Xfce, check by hand that xfce4-power-manager locks the screen on suspend (setting lock-screen-suspend-hibernate). The KDE check was written from the KDE documentation and not tested in a lab; it has no automated fix.

Rationale

Mobile machines are mostly left suspended, not idle. If the session is not locked at suspend, anyone who gets the laptop resumes into the user's open session, without a password, and the idle lock never triggers.

Impact

Users type their password after resume. They cannot disable the screen lock.

Setting

Audit

1. GNOME: dconf read /org/gnome/desktop/screensaver/lock-enabled must print true and dconf read /org/gnome/desktop/lockdown/disable-lock-screen must print false; both keys must be listed in /etc/dconf/db/local.d/locks/.
2. KDE Plasma: /etc/xdg/kscreenlockerrc must have a [Daemon][$i] group that does not set LockOnResume=false.

Automated: every check must pass. Scanners report each check by its id.

gnome-lock-enabled

GNOME locks the screen when it blanks and before suspend.

key: /org/gnome/desktop/screensaver/lock-enabled
value: 'true'

gnome-lock-allowed

GNOME users cannot disable the lock screen.

key: /org/gnome/desktop/lockdown/disable-lock-screen
value: 'false'

kde

The KDE screen locker locks on resume and users cannot change it.

script: |
  f=/etc/xdg/kscreenlockerrc
  [ -f "$f" ] || { echo "$f missing"; exit 1; }
  o=$(awk '/^[ \t]*\[/ { s = ($0 ~ /^[ \t]*\[Daemon\]\[\$i\][ \t]*$/); if (s) imm = 1; next }
    s && /^[ \t]*LockOnResume[ \t]*=/ { v = $0; sub(/^[^=]*=[ \t]*/, "", v) }
    END { printf "immutable=%d LockOnResume=%s\n", imm, v }' "$f")
  echo "$o"
  case $o in *immutable=1*) ;; *) exit 1 ;; esac
  case $o in *LockOnResume=false*) exit 1 ;; esac

Remediation

1. GNOME: make sure /etc/dconf/profile/user contains user-db:user and system-db:local, then create /etc/dconf/db/local.d/00-lock-screen:

   [org/gnome/desktop/screensaver]
   lock-enabled=true
   
   [org/gnome/desktop/lockdown]
   disable-lock-screen=false
   

   list both keys in /etc/dconf/db/local.d/locks/00-lock-screen and run dconf update.
2. KDE Plasma: add LockOnResume=true to the [Daemon][$i] group of /etc/xdg/kscreenlockerrc (see CB-DEB-DESK-008).

Rollback

Delete the files written in /etc/dconf/db/local.d/ and its locks/ directory, then run dconf update.

gnome-lock-enabled

Generated from check gnome-lock-enabled: the engine writes the fix for every output, it sets the expected value and the check runs again after.

gnome-lock-allowed

Generated from check gnome-lock-allowed: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• GNOME System Administration Guide - Lock the screen when the user is idle The GNOME Project, vendor-doc, accessed 2026-10-18
• gsettings-desktop-schemas - org.gnome.desktop.screensaver schema The GNOME Project, vendor-doc, accessed 2026-10-18
• kscreenlocker - kscreenlockerrc settings (kscreenlockersettings.kcfg) KDE, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R32) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-DESK-003 Lock GNOME sessions after a short inactivity delay
• related CB-DEB-DESK-008 Lock idle sessions outside GNOME, through logind and the KDE screen locker

People and lifecycle