# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEB-DESK-001
title: Disable automatic mounting of removable media in GNOME
finding:
  title: GNOME mounts and opens removable media as soon as they are plugged in
  description: A USB stick or disc plugged into the machine is mounted and opened without any user decision, exposing the file manager and its thumbnailers to crafted content.
status: active
profiles: [server, desktop-hardened]
risk:
  severity: medium
assessment: automated
tags: [gnome, dconf, removable-media]

applicability:
  facts: [desktop-gnome]

description: |
  GNOME mounts removable media when they are inserted (`org.gnome.desktop.media-handling
  automount`) and opens a file manager window on them (`automount-open`). Both keys are set to
  `false` in the system dconf database `local` and locked, so users cannot turn them back on.
rationale: |
  Mounting a device parses its file system in the kernel, and opening it runs thumbnailers and
  indexers on files an attacker controls. Bugs in these parsers have been used to compromise
  machines from a USB stick. Requiring an explicit action keeps the user in control and leaves
  time to check the device.
impact: |
  Users mount removable media by clicking them in the file manager. Removable media are not
  opened automatically.
notes: |
  The setting only affects GNOME sessions. The dconf profile `/etc/dconf/profile/user` must list
  `system-db:local`; the fix creates it when it does not exist. On a server without GNOME the
  control is not applicable.

setting:
  location: /etc/dconf/db/local.d/, key /org/gnome/desktop/media-handling/automount and automount-open
  default_value: "true"
  recommended_value: false, locked

audit:
  manual: |
    1. `cat /etc/dconf/profile/user` must contain `system-db:local`.
    2. `dconf read /org/gnome/desktop/media-handling/automount` and
       `dconf read /org/gnome/desktop/media-handling/automount-open` must both print `false`.
    3. Both keys must be listed in a file of `/etc/dconf/db/local.d/locks/`.
  checks:
    - id: automount
      engine: dconf
      description: GNOME does not mount removable media on insertion.
      facts: [desktop-gnome]
      spec:
        key: /org/gnome/desktop/media-handling/automount
        value: "false"
    - id: automount-open
      engine: dconf
      description: GNOME does not open a window for mounted media.
      facts: [desktop-gnome]
      spec:
        key: /org/gnome/desktop/media-handling/automount-open
        value: "false"

remediation:
  manual: |
    1. Make sure `/etc/dconf/profile/user` contains:
       ```
       user-db:user
       system-db:local
       ```
    2. Create `/etc/dconf/db/local.d/00-media-automount`:
       ```
       [org/gnome/desktop/media-handling]
       automount=false
       automount-open=false
       ```
    3. Create `/etc/dconf/db/local.d/locks/00-media-automount`:
       ```
       /org/gnome/desktop/media-handling/automount
       /org/gnome/desktop/media-handling/automount-open
       ```
    4. Run `dconf update`. Users get the new values at their next login.
  effects:
    restart: session
    disruption: low
    lockout_risk: false
  rollback: |
    Delete the files written in `/etc/dconf/db/local.d/` and `/etc/dconf/db/local.d/locks/`
    and run `dconf update`.
  scripts:
    - id: automount
      from_check: automount
    - id: automount-open
      from_check: automount-open

references:
  - title: GNOME System Administration Guide - Lock down specific settings
    url: https://help.gnome.org/admin/system-admin-guide/stable/dconf-lockdown.html.en
    publisher: The GNOME Project
    kind: vendor-doc
    accessed: 2026-10-18
  - title: gsettings-desktop-schemas - org.gnome.desktop.media-handling schema
    url: https://gitlab.gnome.org/GNOME/gsettings-desktop-schemas/-/blob/master/schemas/org.gnome.desktop.media-handling.gschema.xml.in
    publisher: The GNOME Project
    kind: vendor-doc
    accessed: 2026-10-18
  - title: dconf(7), Debian manual pages
    url: https://manpages.debian.org/trixie/dconf-cli/dconf.7.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
mappings:
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "1.7.4"
    relation: equivalent
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "1.7.4"
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: CM-7
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: MP-7
    relation: related
threats:
  - framework: mitre-attack
    id: T1091
  - framework: mitre-attack
    id: T1200
related_controls:
  - id: CB-DEB-DESK-004
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["12"]
    environment: Proxmox VM with minimal GNOME (gdm3, gnome-shell), Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64
    notes: "Generated dconf check and fix for profiles server-hardened and desktop-hardened on GNOME (gdm3, gnome-shell); values and locks confirmed with gsettings get/writable as a user under dbus-run-session; state kept after reboot."
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["13"]
    environment: Proxmox VM with minimal GNOME (gdm3, gnome-shell), Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64
    notes: "Generated dconf check and fix for profiles server-hardened and desktop-hardened on GNOME (gdm3, gnome-shell); values and locks confirmed with gsettings get/writable as a user under dbus-run-session; state kept after reboot."
introduced_in: 0.1.0
created: 2026-10-18
updated: 2026-10-18