cis-ubuntu1804-v220-1-8-8

name	cis-ubuntu1804-v220-1-8-8
description	Ensure GDM autorun-never is enabled
category	cis-networking
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","gdm","gnome","autorun-never","dconf"]
cis_id	1.8.8
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

1.8.8 Ensure GDM autorun-never is enabled (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

The autorun-never setting allows the GNOME Desktop Display Manager to disable autorun through GDM.

Rationale

Malware on removable media may taking advantage of Autorun features when the media is inserted into a system and execute.

Audit Procedure

Command Line

Run the following script to verify that autorun-never is set to true for GDM:

#!/usr/bin/env bash

{
    l_pkgoutput="" l_output="" l_output2=""
    # Check if GNOME Desktop Manager is installed. If package isn't installed, recommendation is Not Applicable\n
    # determine system's package manager
    if command -v dpkg-query > /dev/null 2>&1; then
        l_pq="dpkg-query -s"
    elif command -v rpm > /dev/null 2>&1; then
        l_pq="rpm -q"
    fi
    # Check if GDM is installed
    l_pcl="gdm gdm3" # Space separated list of packages to check
    for l_pn in $l_pcl; do
        $l_pq "$l_pn" > /dev/null 2>&1 && l_pkgoutput="$l_pkgoutput\n - Package: \"$l_pn\" exists on the system\n - checking configuration"
    done
    echo -e "$l_pkgoutput"
    # Check configuration (If applicable)
    if [ -n  ]; 
         -e 
        
        l_kfile=
        
         [ -f  ]; 
            l_gpname=.
        
        
         [ -n  ]; 
            l_gpdir=
            
             grep -Pq --  /etc/dconf/profile/*; 
                l_output=
            
                l_output2=
            
            
             [ -f  ]; 
                l_output=
            
                l_output2=
            
            
             [ -d  ]; 
                l_output=
            
                l_output2=
            
            
             grep -Pqrs --  ; 
                l_output=
            
                l_output2=
            
        
            
            l_output2=
        
    
        l_output=
    
    
     [ -z  ]; 
         -e 
    
         -e 
        [ -n  ] &&  -e 
    
}