documentation_complete: true

prodtype: rhel7,fedora

title: 'Disable All GNOME3 Thumbnailers'

description: |-
    The system's default desktop environment, GNOME3, uses
    a number of different thumbnailer programs to generate thumbnails
    for any new or modified content in an opened folder. To disable the
    execution of these thumbnail applications, add or set <tt>disable-all</tt>
    to <tt>true</tt> in <tt>/etc/dconf/db/local.d/00-security-settings</tt>.
    For example:
    <pre>[org/gnome/desktop/thumbnailers]
    disable-all=true</pre>
    Once the settings have been added, add a lock to
    <tt>/etc/dconf/db/local.d/locks/00-security-settings-lock</tt> to prevent user modification.
    For example:
    <pre>/org/gnome/desktop/thumbnailers/disable-all</pre>
    After the settings have been set, run <tt>dconf update</tt>.
    This effectively prevents an attacker from gaining access to a
    system through a flaw in GNOME3's Nautilus thumbnail creators.

rationale: |-
    An attacker with knowledge of a flaw in a GNOME3 thumbnailer application could craft a malicious
    file to exploit this flaw. Assuming the attacker could place the malicious file on the local filesystem
    (via a web upload for example) and assuming a user browses the same location using Nautilus, the
    malicious file would exploit the thumbnailer with the potential for malicious code execution. It
    is best to disable these thumbnailer applications unless they are explicitly required.

severity: unknown

identifiers:
    cce@rhel7: 80123-3

references:
    nist: CM-7

ocil_clause: 'GNOME thumbnailers are not disabled'

ocil: |-
    These settings can be verified by running the following:
    <pre>$ gsettings get org.gnome.desktop.thumbnailers disable-all</pre>
    If properly configured, the output should be <tt>true</tt>.
    To ensure that users cannot how long until the the screensaver locks, run the following:
    <pre>$ grep disable-all /etc/dconf/db/local.d/locks/*</pre>
    If properly configured, the output should be <tt>/org/gnome/desktop/thumbnailers/disable-all</tt>
