Remove the Ctrl-Alt-Del shortcut from GNOME

Description

org.gnome.settings-daemon.plugins.media-keys logout binds Ctrl-Alt-Del to the log out dialog, which also offers restart and power off. Setting it to [''] removes the binding; the key is set in the system dconf database local and locked.

This only concerns the GNOME shortcut. Ctrl-Alt-Del on a text console is handled by systemd (ctrl-alt-del.target).

Rationale

Ctrl-Alt-Del is pressed by reflex on machines used alongside Windows, and on a shared console it gives anyone a quick path to restarting the machine. Removing the shortcut avoids accidental or opportunistic restarts of the workstation.

Impact

Users log out or power off from the system menu. Ctrl-Alt-Del does nothing in GNOME.

Applies when

Detected: when: GNOME desktop is installed A scanner reports the control not applicable when one is false.

Setting

Audit

1. dconf read /org/gnome/settings-daemon/plugins/media-keys/logout must print [''].
2. The key must be listed in a file of /etc/dconf/db/local.d/locks/.

Automated: every check must pass. Scanners report each check by its id.

logout-key

No GNOME shortcut opens the log out dialog.

key: /org/gnome/settings-daemon/plugins/media-keys/logout
value: '['''']'

Remediation

1. Make sure /etc/dconf/profile/user contains user-db:user and system-db:local.
2. Create /etc/dconf/db/local.d/00-ctrl-alt-del:

   [org/gnome/settings-daemon/plugins/media-keys]
   logout=['']
   

3. List /org/gnome/settings-daemon/plugins/media-keys/logout in /etc/dconf/db/local.d/locks/00-ctrl-alt-del and run dconf update.

Rollback

Delete the files written in /etc/dconf/db/local.d/ and its locks/ directory, then run dconf update.

logout-key

Generated from check logout-key: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• gnome-settings-daemon - media-keys schema The GNOME Project, vendor-doc, accessed 2026-10-18
• GNOME System Administration Guide - Lock down specific settings The GNOME Project, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle