Disable automatic mounting of removable media in GNOME

Description

GNOME mounts removable media when they are inserted (org.gnome.desktop.media-handling automount) and opens a file manager window on them (automount-open). Both keys are set to false in the system dconf database local and locked, so users cannot turn them back on.

The setting only affects GNOME sessions. The dconf profile /etc/dconf/profile/user must list system-db:local; the fix creates it when it does not exist. On a server without GNOME the control is not applicable.

Rationale

Mounting a device parses its file system in the kernel, and opening it runs thumbnailers and indexers on files an attacker controls. Bugs in these parsers have been used to compromise machines from a USB stick. Requiring an explicit action keeps the user in control and leaves time to check the device.

Impact

Users mount removable media by clicking them in the file manager. Removable media are not opened automatically.

Applies when

Detected: when: GNOME desktop is installed A scanner reports the control not applicable when one is false.

Setting

Audit

1. cat /etc/dconf/profile/user must contain system-db:local.
2. dconf read /org/gnome/desktop/media-handling/automount and dconf read /org/gnome/desktop/media-handling/automount-open must both print false.
3. Both keys must be listed in a file of /etc/dconf/db/local.d/locks/.

Automated: every check must pass. Scanners report each check by its id.

automount

GNOME does not mount removable media on insertion.

key: /org/gnome/desktop/media-handling/automount
value: 'false'

automount-open

GNOME does not open a window for mounted media.

key: /org/gnome/desktop/media-handling/automount-open
value: 'false'

Remediation

1. Make sure /etc/dconf/profile/user contains:

   user-db:user
   system-db:local
   

2. Create /etc/dconf/db/local.d/00-media-automount:

   [org/gnome/desktop/media-handling]
   automount=false
   automount-open=false
   

3. Create /etc/dconf/db/local.d/locks/00-media-automount:

   /org/gnome/desktop/media-handling/automount
   /org/gnome/desktop/media-handling/automount-open
   

4. Run dconf update. Users get the new values at their next login.

Rollback

Delete the files written in /etc/dconf/db/local.d/ and /etc/dconf/db/local.d/locks/ and run dconf update.

automount

Generated from check automount: the engine writes the fix for every output, it sets the expected value and the check runs again after.

automount-open

Generated from check automount-open: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• GNOME System Administration Guide - Lock down specific settings The GNOME Project, vendor-doc, accessed 2026-10-18
• gsettings-desktop-schemas - org.gnome.desktop.media-handling schema The GNOME Project, vendor-doc, accessed 2026-10-18
• dconf(7), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-DESK-004 Never run software automatically from inserted media in GNOME

People and lifecycle