documentation_complete: true


title: 'Ensure gpgcheck Enabled for Local Packages'

description: |-
    <tt>{{{ pkg_manager }}}</tt> should be configured to verify the signature(s) of local packages
    prior to installation. To configure <tt>{{{ pkg_manager }}}</tt> to verify signatures of local
    packages, set the <tt>localpkg_gpgcheck</tt> to <tt>1</tt> in <tt>{{{ pkg_manager_config_file }}}</tt>.

rationale: |-
    Changes to any software components can have significant effects to the overall security
    of the operating system. This requirement ensures the software has not been tampered and
    has been provided by a trusted vendor.
    <br /><br />
    Accordingly, patches, service packs, device drivers, or operating system components must
    be signed with a certificate recognized and approved by the organization.

severity: high

identifiers:
    cce@rhel8: CCE-80791-7
    cce@rhel9: CCE-83463-0
    cce@rhel10: CCE-89409-7
    cce@sle12: CCE-91475-4
    cce@sle15: CCE-91167-7
    cce@sle16: CCE-95830-6

references:
    cis-csc: 11,3,9
    cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05
    cui: 3.4.8
    hipaa: 164.308(a)(1)(ii)(D),164.312(b),164.312(c)(1),164.312(c)(2),164.312(e)(2)(i)
    isa-62443-2009: 4.3.4.3.2,4.3.4.3.3
    isa-62443-2013: 'SR 7.6'
    iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4
    nist: CM-11(a),CM-11(b),CM-6(a),CM-5(3),SA-12,SA-12(10)
    nist-csf: PR.IP-1
    ospp: FPT_TUD_EXT.1,FPT_TUD_EXT.2
    srg: SRG-OS-000366-GPOS-00153
    stigid@ol7: OL07-00-020060
    stigid@ol8: OL08-00-010371

ocil_clause: 'there is no process to validate certificates for local packages that is approved by the organization'

ocil: |-
    Verify that {{{ pkg_manager }}} verifies the signature of local packages prior to install with the following command:

    <pre>$ grep localpkg_gpgcheck {{{ pkg_manager_config_file }}}</pre>

    <pre>localpkg_gpgcheck=1</pre>

    If "localpkg_gpgcheck" is not set to "1", or if the option is missing or commented out, ask the System Administrator how the certificates for patches and other operating system components are verified.

platform: package[{{{ pkg_manager }}}]

fixtext: |-
    Configure {{{ full_name }}} to always check package signatures before installation of local packages.

    Add or update the following line in [main] section of the {{{ pkg_manager_config_file }}} file:

    localpkg_gpgcheck=1

srg_requirement: '{{{ full_name }}} must check the GPG sign of locally installed packages.'
