mediumservicesunverifiedrollback-safe

Ensure GDM automatic mounting of removable media is disabled

gdm-automount-disabled · RHEL ≥ 8 · 1 impl

Description

If GNOME Display Manager is in use, automatic mounting of removable media must be disabled — both the automount and automount-open dconf keys set to false.

Rationale

Automatic mounting of removable media can allow unauthorized data transfer or execution of malicious code. Disabling it improves security.

Check → Remediate

Checkcommand

# CIS requires BOTH automount=false AND automount-open=false.
if grep -qr 'automount=false' /etc/dconf/db/local.d/ 2>/dev/null \
   && grep -qr 'automount-open=false' /etc/dconf/db/local.d/ 2>/dev/null; then
  echo "OK: GDM automount and automount-open are disabled"
  exit 0
fi
echo "FAIL: GDM automount / automount-open not both disabled"
exit 1

expected_exit:: 0

Remediatedconf_set

schema:: org/gnome/desktop/media-handling
key:: automount
value:: false
file:: 00-media-automount

Framework references

CIS

rhel9 1.8.6rhel8 1.8.4rhel10 1.8.4

STIG

V-258014 / RHEL-09-271020

NIST 800-53

CM-7

#gdm#gnome#automount#security