Disable GNOME3 Automounting
Prevents GNOME from automatically mounting removable media by setting automount=false and locking the key.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Automatically mounting removable media (USB drives, optical disks) lets an attacker with brief physical access introduce malware or hostile filesystems that are processed by the kernel and userspace the moment the device is inserted. Setting automount=false and locking it forces a deliberate user action to mount media. The trade-off is that legitimate removable-media use becomes less convenient for desktop users.
What Pavois checks
Pavois checks the effective dconf state: the last definition of automount across /etc/dconf/db/*.d/* must resolve to false, and the key /org/gnome/desktop/media-handling/automount must appear in a dconf lock file. Evaluating the resolved precedence (last drop-in wins) plus the lock mirrors how dconf computes the real value, so a later drop-in re-enabling automount or unlocking the key is correctly flagged.
only_if { command('dconf').exist? }
describe command('{ s=$(grep -rhE \'^[[:space:]]*automount[[:space:]]*=\' /etc/dconf/db/*.d/* 2>/dev/null | tail -1 | sed -E \'s/^[^=]*=[[:space:]]*//\' | tr -d "\'\\""); [ "$s" = "false" ] && grep -rqxF \'/org/gnome/desktop/media-handling/automount\' /etc/dconf/db/*/locks/* 2>/dev/null && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
After dconf update, run gsettings get org.gnome.desktop.media-handling automount (should print false) and confirm the key is locked by checking /etc/dconf/db/*/locks/* for /org/gnome/desktop/media-handling/automount.
Inspect & investigate
dconf produces no runtime log; verify with gsettings get org.gnome.desktop.media-handling automount and inspect /etc/dconf/db/*.d/* and /etc/dconf/db/*/locks/*. Device-insertion events handled by udev/udisks can be observed with journalctl -u udisks2 or journalctl -f while plugging media.
Remediation
Pavois's harden plan uses the dconf resource to write automount=false into a system dconf profile drop-in, add /org/gnome/desktop/media-handling/automount to a locks file, and run dconf update to compile the database. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | org/gnome/desktop/media-handling/automount |
|---|---|
| resource | dconf |
| value | false |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Applies only to GNOME desktops; irrelevant on headless servers. After applying, removable media will no longer auto-mount, users must mount manually from Files/Nautilus or with udisksctl mount. Precaution: communicate this change to desktop users who rely on USB/optical media, and pair it with automount-open and autorun-never for full coverage. No reboot is required; dconf update is enough.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.7.6, 1.7.7, 3.4.2, 1.8.6, 1.8.4 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.7, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 3.4.2 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.