# Cis Ubuntu2004 V300 1 7 7

> Ensure GDM disabling automatic mounting of removable media is not overridden

- Skill: `cyberstrikeus/cis-ubuntu2004-v300-1-7-7` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-ubuntu2004-v300-1-7-7`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-ubuntu2004-v300-1-7-7/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-ubuntu2004-v300-1-7-7

---


# 1.7.7 Ensure GDM disabling automatic mounting of removable media is not overridden (Automated)

## Profile

- Level 1 - Server
- Level 2 - Workstation

## Description

By default GNOME automatically mounts removable media when inserted as a convenience to the user.

By using the lockdown mode in dconf, you can prevent users from changing specific settings. To lock down a dconf key or subpath, create a locks subdirectory in the keyfile directory. The files inside this directory contain a list of keys or subpaths to lock. Just as with the keyfiles, you may add any number of files to this directory.

## Rationale

With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in system even if they lacked permissions to mount it themselves.

## Impact

The use of portable hard drives is very common for workstation users.

## Audit Procedure

### Command Line

Run the following command to verify `automount=false` and `automount-open=false` is correctly configured to ensure automatic mounting of removable media is not overridden:

```bash
# grep -Psi "automount" /etc/dconf/db/*/locks/*
```

```
/etc/dconf/db/local.d/locks/00-media-automount:automount=false
/etc/dconf/db/local.d/locks/00-media-automount:automount-open=false
```

## Expected Result

Lock entries for `automount` and `automount-open` should be present.

## Remediation

### Command Line

1. To prevent the user from overriding these settings, create the file `/etc/dconf/db/local.d/locks/00-media-automount` with the following content:

```
[org/gnome/desktop/media-handling]
automount=false
automount-open=false
```

2. Update the systems databases:

```bash
# dconf update
```

Note:

- A user profile must exist in order to apply locks. If a user profile does not exist review the remediation steps in the previous recommendation.
- Users must log out and back in again before the system-wide settings take effect.

## References

1. https://help.gnome.org/admin/system-admin-guide/stable/dconf-lockdown.html.en
2. NIST SP 800-53 Rev. 5: CM-1, CM-2, CM-6, CM-7, IA-5
3. https://manpages.ubuntu.com/manpages/trusty/man1/gsettings.1.html
4. https://access.redhat.com/solutions/20107

MITRE ATT&CK Mappings: T1091, T1091.000 | TA0001, TA0008 | M1042