Disable GNOME3 Automount Opening
Prevents GNOME from automatically opening a file-manager window for inserted media by setting automount-open=false and locking the key.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Beyond auto-mounting, GNOME can automatically open a file-manager window for newly inserted media, which triggers thumbnailers and previewers that parse untrusted file content. This widens the attack surface for malicious removable devices. Setting automount-open=false and locking it forces the user to open media deliberately. The trade-off is reduced convenience for legitimate removable-media use.
What Pavois checks
Pavois checks the effective dconf state: the last definition of automount-open across /etc/dconf/db/*.d/* must resolve to false, and the key /org/gnome/desktop/media-handling/automount-open must appear in a dconf lock file. Evaluating resolved precedence (last drop-in wins) plus the lock matches how dconf computes the real value, so a later drop-in re-enabling auto-open or unlocking the key is flagged.
only_if { command('dconf').exist? }
describe command('{ s=$(grep -rhE \'^[[:space:]]*automount-open[[:space:]]*=\' /etc/dconf/db/*.d/* 2>/dev/null | tail -1 | sed -E \'s/^[^=]*=[[:space:]]*//\' | tr -d "\'\\""); [ "$s" = "false" ] && grep -rqxF \'/org/gnome/desktop/media-handling/automount-open\' /etc/dconf/db/*/locks/* 2>/dev/null && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
After dconf update, run gsettings get org.gnome.desktop.media-handling automount-open (should print false) and confirm the key is locked by checking /etc/dconf/db/*/locks/* for /org/gnome/desktop/media-handling/automount-open.
Inspect & investigate
dconf has no runtime log; verify with gsettings get org.gnome.desktop.media-handling automount-open and inspect /etc/dconf/db/*.d/* and /etc/dconf/db/*/locks/*. Media-insertion handling can be observed with journalctl -u udisks2 or journalctl -f while plugging in a device.
Remediation
Pavois's harden plan uses the dconf resource to write automount-open=false into a system dconf profile drop-in, add /org/gnome/desktop/media-handling/automount-open to a locks file, and run dconf update. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | org/gnome/desktop/media-handling/automount-open |
|---|---|
| resource | dconf |
| value | false |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Applies only to GNOME desktops; irrelevant on headless servers. After applying, inserted media no longer pops open a file-manager window, users open it manually. This is best combined with automount=false and autorun-never. Precaution: inform desktop users who expect media to open automatically. No reboot is required; dconf update is sufficient.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.7.6, 1.7.7, 3.4.2, 1.8.6, 1.8.4 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.7, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 3.4.2 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-24-200040 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.