mediumservicesunverifiedrollback-safe

Ensure GDM autorun-never is enabled

gdm-autorun-never · RHEL ≥ 8 · 1 impl

Description

If GNOME Display Manager is in use, automatic execution of programs on removable media should be disabled.

Rationale

Autorun can be exploited to execute malicious code from removable media. Disabling it prevents this attack vector.

Check → Remediate

Checkcommand

# Check if autorun-never is configured
if grep -qr "autorun-never=true" /etc/dconf/db/local.d/ 2>/dev/null; then
  echo "OK: GDM autorun-never is enabled"
  exit 0
fi
echo "FAIL: GDM autorun-never is not enabled"
exit 1

expected_exit:: 0

Remediatedconf_set

schema:: org/gnome/desktop/media-handling
key:: autorun-never
value:: true
file:: 00-media-autorun

Framework references

CIS

rhel9 1.8.8rhel8 1.8.5rhel10 1.8.5

STIG

V-258016 / RHEL-09-271030

NIST 800-53

CM-7

#gdm#gnome#autorun#security