SV-216127r958404: The operating system session lock mechanism, when activated on a device with a display screen, must place a publicly viewable pattern onto the associated display, hiding what was previously visible on the screen. | Solaris 11 X86 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The operating system session lock mechanism, when activated on a device with a display screen, must place a publicly viewable pattern onto the associated display, hiding what was previously visible on the screen.

Description

Discussion Text

A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the system but does not log out because of the temporary nature of the absence. The session lock will also include an obfuscation of the display screen to prevent other users from reading what was previously displayed.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000060V-48139SV-61011

References

DPMS Target Solaris 11 X86 DISA DPMS Target Solaris 11 X86 4021

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.solaris11:def:82
# The operating system session lock mechanism, when activated on a device with a display screen, must place a publicly viewable pattern onto the associated display, hiding what was previously visible on the screen.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - textfilecontent54_object (textfilecontent54_test) -- All user .xscreensaver files must list blank as the mode.: no extractor for field "subexpression"

# Check to see if CDM is being run by the system.
# smf_object (smf_test)
test_1() {
  (svcs -H -o state 'svc://localhost/application/graphical-login/gdm:default') | grep -qxF 'ONLINE'
}
# Check to see if XDM is being run by the system.
# smf_object (smf_test)
test_2() {
  (svcs -H -o state 'svc://localhost/application/graphical-login/xdm:default') | grep -qxF 'ONLINE'
}
# The XScreenSaver file must list blank as the mode.
# textfilecontent54_object (textfilecontent54_test)
test_3() {
  (sed -En 's/^\s*\*mode:\s*(\S+)\s*$/\1/p' '/usr/share/X11/app-defaults/XScreenSaver') | grep -qxF 'blank'
}

if ( test_1 || test_2 || test_3 ); then
  echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
  echo "FAIL (or see MANUAL REVIEW note above)"
fi

Remediation

For Solaris 11, 11.1, 11.2, and 11.3:
In the GNOME 2 desktop: System >> Preferences >> Screensaver.

For Solaris 11.4 or newer:
If using the default GNOME desktop: Activities >> Show Applications >> select “Screensaver” icon.

If using the GNOME Classic desktop: Applications >> Other >> Screensaver.

Click on Mode's pull-down.

Select: "Blank Screen Only". 

Ensure that "Blank Screen Only" is selected.