STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Mar 2026:

TOSS 5 must disable the graphical user interface autorun function unless required.

DISA Rule

SV-282588r1200744_rule

Vulnerability Number

V-282588

Group Title

SRG-OS-000368-GPOS-00154

Rule Version

TOSS-05-000266

Severity

CAT II

CCI(s)

CCI-001764 - Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.

Weight

Fix Recommendation

Configure the GNOME desktop to disable the autorun function on removable media.

The dconf settings can be edited in the /etc/dconf/db/* location.

Update the [org/gnome/desktop/media-handling] section of the "/etc/dconf/db/local.d/00-security-settings" database file and add or update the following lines:

[org/gnome/desktop/media-handling]
autorun-never=true

Update the dconf system databases:

$ sudo dconf update

Check Contents

Verify TOSS 5 disables the graphical user interface autorun function using the following command:

Note: This requirement assumes the use of the TOSS 5 default graphical user interface—the GNOME desktop environment. If the system does not have a graphical user interface installed, this requirement is not applicable.

$ gsettings get org.gnome.desktop.media-handling autorun-never

true

If "autorun-never" is set to "false" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Vulnerability Number

V-282588

Documentable

False

Rule Version

TOSS-05-000266

Severity Override Guidance

Check Content Reference

Target Key

5738