mediumservicesunverifiedrollback-safe

Ensure GDM disabling automatic mounting of removable media is not overridden

gdm-automount-override · RHEL ≥ 8 · 1 impl

Description

If GNOME Display Manager is in use, users should not be able to override the automount disabled setting.

Rationale

Preventing users from enabling automount ensures the security policy is enforced consistently across all users.

Check → Remediate

Checkcommand

# Check if automount setting is locked
if [ -f /etc/dconf/db/local.d/locks/00-media-automount ]; then
  if grep -q "/org/gnome/desktop/media-handling/automount" /etc/dconf/db/local.d/locks/00-media-automount 2>/dev/null; then
    echo "OK: GDM automount setting is locked"
    exit 0
  fi
fi
echo "FAIL: GDM automount setting can be overridden"
exit 1

expected_exit:: 0

Remediatedconf_set

schema:: org/gnome/desktop/media-handling
key:: automount
value:: false
file:: 00-media-automount
lock:: true

Framework references

CIS

rhel9 1.8.7

STIG

V-281273 / RHEL-10-700700V-258015 / RHEL-09-271025

NIST 800-53

CM-7

#gdm#gnome#automount#security