cirsec Baselines
Esc
Debian GNU/Linux · Desktop environment

Never run software automatically from inserted media in GNOME

When it fails: GNOME can start programs from inserted media. When a disc or USB device is inserted, GNOME may offer or start the program the medium declares, which a crafted medium can abuse.

CB-DEB-DESK-004mediumactiveautomatedautomated fixprofile desktop

As released in v0.1.0 beta · pre-release. Current state.

Description

org.gnome.desktop.media-handling autorun-never set to true stops GNOME from prompting for or launching programs when media are inserted. The key is set in the system dconf database local and locked.

Debian 13 already defaults to true; Debian 12 defaults to false. In both, users can change it unless the key is locked.

Rationale

Autorun turns the insertion of a medium into code execution with one click, or none if the user chose "always". It is a classic infection path for removable media.

Impact

Users open media content themselves from the file manager.

Applies when

Detected: when: GNOME desktop is installed A scanner reports the control not applicable when one is false.

Setting

Location/etc/dconf/db/local.d/, key /org/gnome/desktop/media-handling/autorun-never
Defaultfalse (Debian 12), true (Debian 13), not locked
Recommendedtrue, locked

Audit

  1. dconf read /org/gnome/desktop/media-handling/autorun-never must print true.
  2. The key must be listed in a file of /etc/dconf/db/local.d/locks/.

Automated: every check must pass. Scanners report each check by its id.

autorun-never

GNOME never runs software from inserted media.

engine: dconf (GNOME)when: GNOME desktop is installed
key: /org/gnome/desktop/media-handling/autorun-never
value: 'true'

Remediation

  1. Make sure /etc/dconf/profile/user contains user-db:user and system-db:local.
  2. Create /etc/dconf/db/local.d/00-media-autorun: 
    [org/gnome/desktop/media-handling]
autorun-never=true
  3. List /org/gnome/desktop/media-handling/autorun-never in /etc/dconf/db/local.d/locks/00-media-autorun.
  4. Run dconf update.
Restartusers must log in again
Disruptionnone

Rollback

Delete the files written in /etc/dconf/db/local.d/ and its locks/ directory, then run dconf update.

autorun-never

engine: dconf (GNOME)when: GNOME desktop is installed

Generated from check autorun-never: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1CM-7related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1091
  • related CB-DEB-DESK-001 Disable automatic mounting of removable media in GNOME

People and lifecycle

Authors
Verified2026-10-18 by Sn0wAlice on 12, Proxmox VM with minimal GNOME (gdm3, gnome-shell), Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Generated dconf check and fix (desktop-hardened) on GNOME; value and lock confirmed with gsettings as a user; state kept after reboot.
Verified2026-10-18 by Sn0wAlice on 13, Proxmox VM with minimal GNOME (gdm3, gnome-shell), Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Generated dconf check and fix (desktop-hardened) on GNOME; value and lock confirmed with gsettings as a user; state kept after reboot.
Introduced inv0.1.0
Created, updated2026-10-18, 2026-10-18
Translationsfr