cirsec Baselines
Esc
Ubuntu · Desktop environment

Never run software automatically from inserted media in GNOME

When it fails: GNOME can start programs from inserted media. When a disc or USB device is inserted, GNOME may offer or start the program the medium declares, which a crafted medium can abuse.

CB-UBU-DESK-004mediumactiveautomatedautomated fixprofile desktop

As released in v0.1.2 (beta). Current state.

Description

org.gnome.desktop.media-handling autorun-never set to true stops GNOME from prompting for or launching programs when media are inserted. The key is set in the system dconf database local and locked.

Ubuntu 24.04 and 26.04 (GNOME 46 and 50) already default to true; 20.04 and 22.04 (GNOME 3.36 and 42) default to false. In every version, users can change it unless the key is locked.

Rationale

Autorun turns the insertion of a medium into code execution with one click, or none if the user chose "always". It is a classic infection path for removable media.

Impact

Users open media content themselves from the file manager.

Applies when

Detected: when: GNOME desktop is installed A scanner reports the control not applicable when one is false.

Setting

Location/etc/dconf/db/local.d/, key /org/gnome/desktop/media-handling/autorun-never
Defaultfalse (20.04, 22.04), true (24.04, 26.04), not locked
Recommendedtrue, locked

Audit

  1. dconf read /org/gnome/desktop/media-handling/autorun-never must print true.
  2. The key must be listed in a file of /etc/dconf/db/local.d/locks/.

Automated: every check must pass. Scanners report each check by its id.

autorun-never

GNOME never runs software from inserted media.

engine: dconf (GNOME)when: GNOME desktop is installed
key: /org/gnome/desktop/media-handling/autorun-never
value: 'true'

Remediation

  1. Make sure /etc/dconf/profile/user contains user-db:user and system-db:local.
  2. Create /etc/dconf/db/local.d/00-media-autorun: 
    [org/gnome/desktop/media-handling]
autorun-never=true
  3. List /org/gnome/desktop/media-handling/autorun-never in /etc/dconf/db/local.d/locks/00-media-autorun.
  4. Run dconf update.
Restartusers must log in again
Disruptionnone

Rollback

Delete the files written in /etc/dconf/db/local.d/ and its locks/ directory, then run dconf update.

autorun-never

engine: dconf (GNOME)when: GNOME desktop is installed

Generated from check autorun-never: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1CM-7related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1091
  • related CB-UBU-DESK-001 Disable automatic mounting of removable media in GNOME

People and lifecycle

Authors
Verified2026-10-19 by Sn0wAlice on 20.04, Proxmox VM with Ubuntu Desktop (GNOME 3.36, gdm3), Ubuntu 20.04.6, kernel 5.4.0-216-generic. Generated dconf check and fix (desktop-hardened); value and lock confirmed with gsettings get/writable as a user under dbus-run-session (write refused); second remediation reported compliant; state kept after reboot.
Verified2026-10-19 by Sn0wAlice on 22.04, Proxmox VM with Ubuntu Desktop (GNOME 42, gdm3), Ubuntu 22.04.5, kernel 5.15.0-198-generic. Generated dconf check and fix (desktop-hardened); value and lock confirmed with gsettings get/writable as a user under dbus-run-session (write refused); second remediation reported compliant; state kept after reboot.
Verified2026-10-19 by Sn0wAlice on 24.04, Proxmox VM with Ubuntu Desktop (GNOME 46, gdm3), Ubuntu 24.04.5, kernel 6.8.0-147-generic. Generated dconf check and fix (desktop-hardened); value and lock confirmed with gsettings get/writable as a user under dbus-run-session (write refused); second remediation reported compliant; state kept after reboot.
Verified2026-10-19 by Sn0wAlice on 26.04, Proxmox VM with Ubuntu Desktop (GNOME 50, gdm3), Ubuntu 26.04.1, kernel 7.0.0-38-generic. Generated dconf check and fix (desktop-hardened); value and lock confirmed with gsettings get/writable as a user under dbus-run-session (write refused); second remediation reported compliant; state kept after reboot.
Introduced inv0.1.0
Created, updated2026-10-19, 2026-10-19
Translationsfr