Disable GNOME3 Automount running
Disables GNOME autorun of software on inserted removable media by setting autorun-never=true and locking the key.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
GNOME's autorun feature can execute software shipped on removable media when it is inserted, allowing an attacker to run code on the system simply by getting a user to plug in a crafted device. Setting autorun-never=true and locking it disables this automatic execution. Legitimate auto-run convenience is lost, which is an acceptable trade-off for the reduced risk.
What Pavois checks
Pavois checks the effective dconf state: the last definition of autorun-never across /etc/dconf/db/*.d/* must resolve to true, and the key /org/gnome/desktop/media-handling/autorun-never must appear in a dconf lock file. Evaluating resolved precedence (last drop-in wins) plus the lock matches how dconf actually computes the value, catching a later drop-in that re-enables autorun or unlocks the key.
only_if { command('dconf').exist? }
describe command('{ s=$(grep -rhE \'^[[:space:]]*autorun-never[[:space:]]*=\' /etc/dconf/db/*.d/* 2>/dev/null | tail -1 | sed -E \'s/^[^=]*=[[:space:]]*//\' | tr -d "\'\\""); [ "$s" = "true" ] && grep -rqxF \'/org/gnome/desktop/media-handling/autorun-never\' /etc/dconf/db/*/locks/* 2>/dev/null && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
After dconf update, run gsettings get org.gnome.desktop.media-handling autorun-never (should print true) and confirm the key is locked by checking /etc/dconf/db/*/locks/* for /org/gnome/desktop/media-handling/autorun-never.
Inspect & investigate
dconf has no runtime log; verify with gsettings get org.gnome.desktop.media-handling autorun-never and inspect /etc/dconf/db/*.d/* and /etc/dconf/db/*/locks/*. Media events can be watched with journalctl -u udisks2 or journalctl -f while inserting a device.
Remediation
Pavois's harden plan uses the dconf resource to write autorun-never=true into a system dconf profile drop-in, add /org/gnome/desktop/media-handling/autorun-never to a locks file, and run dconf update. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | org/gnome/desktop/media-handling/autorun-never |
|---|---|
| resource | dconf |
| value | true |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Applies only to GNOME desktops; irrelevant on headless servers. Low-risk and low-severity: it stops media-resident apps from auto-launching but does not block users from manually running them. Best applied together with automount=false and automount-open=false for defense in depth. No reboot is required; dconf update is sufficient.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.7.8, 1.7.9, 1.8.8, 1.8.5 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.7, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-24-200041 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.