Lock GNOME sessions after a short inactivity delay

Description

Two GNOME keys control when an idle session gets locked:

• org.gnome.desktop.session idle-delay: seconds of inactivity before the session is considered idle and the screen blanks;
• org.gnome.desktop.screensaver lock-delay: seconds between the screen blanking and the lock.

Both are set in the system dconf database local and locked. The lock itself requires lock-enabled, set by CB-DEB-DESK-009.

Debian's defaults are already 300 and 0 seconds, but users can change them. The check expects exactly the configured values. dconf read as root reads the system database, which wins over user values for locked keys.

Rationale

A session left open on an unattended machine gives its access to anyone passing by. Locking after a short delay limits that window, and locking the keys stops users from disabling it.

Impact

Sessions lock after {{ idle_delay }} seconds of inactivity, plus {{ lock_delay }} seconds. Users cannot change these delays. Presentations and video calls inhibit the idle delay while they run.

Applies when

Detected: when: GNOME desktop is installed A scanner reports the control not applicable when one is false.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. dconf read /org/gnome/desktop/session/idle-delay must print uint32 {{ idle_delay }}.
2. dconf read /org/gnome/desktop/screensaver/lock-delay must print uint32 {{ lock_delay }}.
3. Both keys must be listed in a file of /etc/dconf/db/local.d/locks/.

Automated: every check must pass. Scanners report each check by its id.

idle-delay

Inactivity delay before the screen blanks.

key: /org/gnome/desktop/session/idle-delay
value: uint32 {{ idle_delay }}

lock-delay

Delay between blanking and locking.

key: /org/gnome/desktop/screensaver/lock-delay
value: uint32 {{ lock_delay }}

Remediation

1. Make sure /etc/dconf/profile/user contains user-db:user and system-db:local.
2. Create /etc/dconf/db/local.d/00-screen-lock:

   [org/gnome/desktop/session]
   idle-delay=uint32 {{ idle_delay }}
   
   [org/gnome/desktop/screensaver]
   lock-delay=uint32 {{ lock_delay }}
   

3. List /org/gnome/desktop/session/idle-delay and /org/gnome/desktop/screensaver/lock-delay in /etc/dconf/db/local.d/locks/00-screen-lock.
4. Run dconf update.

Rollback

Delete the files written in /etc/dconf/db/local.d/ and its locks/ directory, then run dconf update.

idle-delay

Generated from check idle-delay: the engine writes the fix for every output, it sets the expected value and the check runs again after.

lock-delay

Generated from check lock-delay: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• GNOME System Administration Guide - Lock the screen when the user is idle The GNOME Project, vendor-doc, accessed 2026-10-18
• GNOME System Administration Guide - Lock down specific settings The GNOME Project, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R32) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-DEB-DESK-009 Lock the session when the screen saver starts and when the system suspends
• related CB-DEB-DESK-008 Lock idle sessions outside GNOME, through logind and the KDE screen locker

People and lifecycle