Red Hat Enterprise Linux 9 Security Technical Implementation Guide

The Red Hat Enterprise Linux 9 Security Technical Implementation Guide (V2 R9) has 445 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

445STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R9

ArchivedPublished Wed Jul 01 2026

RHEL 9 must disable the ability of a user to restart the system from the login screen.

Red Hat Enterprise Linux 9 Security Technical Implementation Guide

Assessment Title

Rule Text

RHEL 9 must disable the ability of a user to restart the system from the login screen.

Description

Discussion Text

A user who is at the console can reboot the system at the login screen. If restart or shutdown buttons are pressed at the login screen, this can create the risk of short-term loss of availability of systems due to reboot.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-258029

Rule

SV-258029r1045109_rule

Severity

medium

Rule Version

RHEL-09-271095

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Note: This requirement assumes the use of the RHEL 9 default graphical user interface, Gnome Shell. If the system does not have any graphical user interface installed, this requirement is Not Applicable.

Verify RHEL 9 disables a user's ability to restart the system with the following command:

$ gsettings get org.gnome.login-screen disable-restart-buttons
 
true
 
If "disable-restart-buttons" is "false", this is a finding.

Implementation Procedure

Fix Text

Configure RHEL 9 to disable a user's ability to restart the system.

$ gsettings set org.gnome.login-screen disable-restart-buttons true

Update the dconf system databases:

$ sudo dconf update

STIG check 243 of 445 in the Red Hat Enterprise Linux 9 STIG checklist

← Previous · V-258028RHEL 9 effective dconf policy must match the policy keyfiles.Next · V-258030 →RHEL 9 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.