id: gdm-autorun-never-enabled-check

info:
  name: Ensure GDM autorun-never is Enabled
  author: Th3l0newolf
  severity: medium
  description: |
    This template checks whether GDM is configured to disable autorun for removable media.
  remediation: |
    Enable the `autorun-never` setting to prevent automatic execution of content
    from removable media.
  reference:
    - https://www.cisecurity.org/benchmark/ubuntu_linux
  tags: cis,linux,ubuntu,gdm,autorun,media,audit
  metadata:
    verified: true

self-contained: true

code:
  - engine:
      - bash
    args:
      - "-c"
      - |
        autorun_never=$(gsettings get org.gnome.desktop.media-handling autorun-never 2>/dev/null)

        if [ "$autorun_never" = "true" ]; then
          echo "[gdm-autorun-never-enabled-check:Policy-Pass] [GDM autorun-never is enabled] [CIS_PASS] [medium]"
        else
          echo "[gdm-autorun-never-enabled-check:Policy-Fail] [GDM autorun-never is not enabled] [CIS_FAIL] [medium]"
        fi

    matchers:
      - type: word
        name: policy-pass
        words:
          - "Policy-Pass"

      - type: word
        name: policy-fail
        words:
          - "Policy-Fail"
# digest: 490a0046304402206c80c1a86743871e9f595f4dcd2a4514b546b38bc6d19526607164c2e3cae9a4022051f4b192684563ca0434b43e54043fdf0111dcd7cc59c761d5ac11d4ae9f7af0:922c64590222798bb761d5b6d8e72950