mediumservicesunverifiedrollback-safe

Ensure GDM autorun-never is not overridden

gdm-autorun-never-override · RHEL ≥ 8 · 1 impl

Description

If GNOME Display Manager is in use, users should not be able to override the autorun-never setting.

Rationale

Preventing users from enabling autorun ensures the security policy is enforced consistently across all users.

Check → Remediate

Checkcommand

# Check if autorun setting is locked
if [ -f /etc/dconf/db/local.d/locks/00-media-autorun ]; then
  if grep -q "/org/gnome/desktop/media-handling/autorun-never" /etc/dconf/db/local.d/locks/00-media-autorun 2>/dev/null; then
    echo "OK: GDM autorun-never setting is locked"
    exit 0
  fi
fi
echo "FAIL: GDM autorun-never setting can be overridden"
exit 1

expected_exit:: 0

Remediatedconf_set

schema:: org/gnome/desktop/media-handling
key:: autorun-never
value:: true
file:: 00-media-autorun
lock:: true

Framework references

CIS

rhel9 1.8.9

STIG

V-281274 / RHEL-10-700710V-258017 / RHEL-09-271035

NIST 800-53

CM-7

#gdm#gnome#autorun#security