id: gdm-automount-removable-media-disabled-check

info:
  name: Ensure GDM Automatic Mounting of Removable Media is Disabled
  author: Th3l0newolf
  severity: medium
  description: |
    This template checks whether automatic mounting of removable media is disabled.
  remediation: |
    Disable automatic mounting and automatic opening of removable media in GDM.
  reference:
    - https://www.cisecurity.org/benchmark/ubuntu_linux
  tags: cis,linux,ubuntu,gdm,media,automount,audit
  metadata:
    verified: true

self-contained: true

code:
  - engine:
      - bash
    args:
      - "-c"
      - |
        automount=$(gsettings get org.gnome.desktop.media-handling automount 2>/dev/null)
        automount_open=$(gsettings get org.gnome.desktop.media-handling automount-open 2>/dev/null)

        if [ "$automount" = "false" ] && [ "$automount_open" = "false" ]; then
          echo "[gdm-automount-removable-media-disabled-check:Policy-Pass] [Automatic mounting of removable media is disabled] [CIS_PASS] [medium]"
        else
          echo "[gdm-automount-removable-media-disabled-check:Policy-Fail] [Automatic mounting of removable media is enabled] [CIS_FAIL] [medium]"
        fi

    matchers:
      - type: word
        name: policy-pass
        words:
          - "Policy-Pass"

      - type: word
        name: policy-fail
        words:
          - "Policy-Fail"
# digest: 4a0a00473045022100d49ac46ebe2172ca1f5fa4fbd1d7e2c4c3964ce081c06e33a29d8d87f5789c020220162bf14558a7cd7eca0d7006654b7ba99ffc23fd118e9bd7df99babf6fe13ced:922c64590222798bb761d5b6d8e72950