Install GNOME Software
Ensures the gnome-software package is installed so a GNOME desktop has a graphical channel for software and firmware updates.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
On a GNOME workstation, gnome-software provides the graphical front-end through which users and the system receive software and firmware updates. Without it, a desktop user has no clear, supported channel to discover and apply security updates, increasing the chance that the system runs known-vulnerable packages. Ensuring it is installed keeps the patching path available on graphical systems.
What Pavois checks
Pavois queries package('gnome-software') against the package database, reporting the effective presence of the update front-end rather than relying on a desktop config hint. The package manager is the authoritative source for whether the tool can actually be launched.
describe package('gnome-software') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q gnome-software. The rule passes when a versioned package name is printed (e.g. gnome-software-4x.x-x.fcXX.x86_64) and fails on package gnome-software is not installed.
Inspect & investigate
Install state: rpm -q gnome-software. The application's runtime messages appear in the user session journal (journalctl --user -u gnome-software or journalctl /usr/bin/gnome-software); installs are recorded in /var/log/dnf.log / dnf history.
Remediation
Pavois's harden plan installs the gnome-software package (resource package, action install) when you run pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | gnome-software |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Misconfiguration impact: without the graphical updater, desktop users may miss security and firmware updates. Precaution: this rule is meant for GNOME workstations; installing gnome-software on a headless server adds unneeded GUI dependencies and is unnecessary there. Apply it only where a graphical desktop is intended.