STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 must prevent a user from overriding the disabling of the graphical user smart card removal action.

DISA Rule

SV-269110r1049992_rule

Vulnerability Number

V-269110

Group Title

SRG-OS-000028-GPOS-00009

Rule Version

ALMA-09-002110

Severity

CAT II

CCI(s)

• CCI-000056 - Retain the device lock until the user reestablishes access using established identification and authentication procedures.

Weight

10

Fix Recommendation

Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user override of the smart card removal action:

/org/gnome/settings-daemon/peripherals/smartcard/removal-action

Then, update the dconf system databases:

$ dconf update

Check Contents

Verify AlmaLinux OS 9 disables the ability of the user to override the smart card removal action setting.

Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable.

Determine which profile the system database is using with the following command:

$ grep system-db /etc/dconf/profile/user

system-db:local

Check that the removal action setting is locked from nonprivileged user modification with the following command:

Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used.

$ grep 'removal-action' /etc/dconf/db/local.d/locks/*

/etc/dconf/db/local.d/locks/00-security-settings-lock:/org/gnome/settings-daemon/peripherals/smartcard/removal-action

If the command does not return at least the example result, this is a finding.

Vulnerability Number

V-269110

Documentable

False

Rule Version

ALMA-09-002110

Severity Override Guidance

Verify AlmaLinux OS 9 disables the ability of the user to override the smart card removal action setting.

Note: This requirement assumes the use of the AlmaLinux OS 9 default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable.

Determine which profile the system database is using with the following command:

$ grep system-db /etc/dconf/profile/user

system-db:local

Check that the removal action setting is locked from nonprivileged user modification with the following command:

Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used.

$ grep 'removal-action' /etc/dconf/db/local.d/locks/*

/etc/dconf/db/local.d/locks/00-security-settings-lock:/org/gnome/settings-daemon/peripherals/smartcard/removal-action

If the command does not return at least the example result, this is a finding.

Check Content Reference

M

Target Key

5664