Title

Ubuntu 24.04 LTS must prevent a user from overriding the disabling of the graphical user interface autorun function. (Cat II impact)

Discussion

Techniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators. Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227

Check Content

Note: This requirement assumes the use of the Ubuntu 24.04 LTS default graphical user interface, the GNOME desktop environment. If the system does not have any graphical user interface installed, this requirement is Not Applicable. Verify Ubuntu 24.04 LTS disables ability of the user to override the graphical user interface autorun setting. Determine which profile the system database is using with the following command: $ gsettings writable org.gnome.desktop.media-handling autorun-never false If "autorun-never" is writable, the result is "true". If this is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Fix Text

Configure the Ubuntu 24.04 LTS GNOME desktop to not allow a user to change the setting that disables autorun on removable media. Add the following line to "/etc/dconf/db/local.d/locks/00-security-settings-lock" to prevent user modification: /org/gnome/desktop/media-handling/autorun-never Update the dconf system databases: $ sudo dconf update

Additional Identifiers

Rule ID: SV-274872r1107297_rule

Vulnerability ID: V-274872

Group Title: SRG-OS-000114-GPOS-00059

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.