<def-group>
  <definition class="compliance" id="dconf_gnome_disable_automount" version="1">
    <metadata>
      <title>Disable GNOME3 Automounting</title>
      <affected family="unix">
        <platform>Red Hat Enterprise Linux 7</platform>
        <platform>multi_platform_fedora</platform>
      </affected>
      <description>The system's default desktop environment, GNOME3, will mount
      devices and removable media (such as DVDs, CDs and USB flash drives)
      whenever they are inserted into the system. Disable automount and autorun
      within GNOME3.</description>
      <reference source="galford" ref_id="20140824" ref_url="test_attestation" />
    </metadata>
    <criteria operator="OR">
      <extend_definition comment="dconf installed" definition_ref="package_dconf_installed" negate="true" />
      <criteria comment="Disable GNOME3 automount/autorun and prevent user from changing it" operator="AND">
        <extend_definition comment="dconf user profile exists" definition_ref="enable_dconf_user_profile" />
        <criterion comment="Disable automount in GNOME3" test_ref="test_dconf_gnome_disable_automount" />
        <criterion comment="Disable automount-open in GNOME3" test_ref="test_dconf_gnome_disable_automount_open" />
        <criterion comment="Disable autorun in GNOME3" test_ref="test_dconf_gnome_disable_autorun" />
        <criterion comment="Prevent user from changing automount setting" test_ref="test_prevent_user_gnome_automount" />
        <criterion comment="Prevent user from changing automount-open setting" test_ref="test_prevent_user_gnome_automount_open" />
        <criterion comment="Prevent user from changing autorun setting" test_ref="test_prevent_user_gnome_autorun" />
      </criteria>
    </criteria>
  </definition>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="Disable automount in GNOME3"
  id="test_dconf_gnome_disable_automount" version="1">
    <ind:object object_ref="obj_dconf_gnome_disable_automount" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_dconf_gnome_disable_automount"
  version="1">
    <ind:path>/etc/dconf/db/local.d/</ind:path>
    <ind:filename operation="pattern match">^.*$</ind:filename>
    <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling]([^\n]*\n+)+?automount=false$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="Prevent user from changing automount setting"
  id="test_prevent_user_gnome_automount" version="1">
    <ind:object object_ref="obj_prevent_user_gnome_automount" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_prevent_user_gnome_automount"
  version="1">
    <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
    <ind:filename operation="pattern match">^.*$</ind:filename>
    <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="Disable automount-open in GNOME"
  id="test_dconf_gnome_disable_automount_open" version="1">
    <ind:object object_ref="obj_dconf_gnome_disable_automount_open" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_dconf_gnome_disable_automount_open"
  version="1">
    <ind:path>/etc/dconf/db/local.d/</ind:path>
    <ind:filename operation="pattern match">^.*$</ind:filename>
    <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling]([^\n]*\n+)+?automount-open=false$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="Prevent user from changing automount-open setting"
  id="test_prevent_user_gnome_automount_open" version="1">
    <ind:object object_ref="obj_prevent_user_gnome_automount_open" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_prevent_user_gnome_automount_open"
  version="1">
    <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
    <ind:filename operation="pattern match">^.*$</ind:filename>
    <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount-open$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="Disable autorun in GNOME"
  id="test_dconf_gnome_disable_autorun" version="1">
    <ind:object object_ref="obj_dconf_gnome_disable_autorun" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_dconf_gnome_disable_autorun"
  version="1">
    <ind:path>/etc/dconf/db/local.d/</ind:path>
    <ind:filename operation="pattern match">^.*$</ind:filename>
    <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling]([^\n]*\n+)+?autorun-never=true$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="Prevent user from changing autorun setting"
  id="test_prevent_user_gnome_autorun" version="1">
    <ind:object object_ref="obj_prevent_user_gnome_autorun" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_prevent_user_gnome_autorun"
  version="1">
    <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
    <ind:filename operation="pattern match">^.*$</ind:filename>
    <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/autorun-never$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
</def-group>
