documentation_complete: true


title: 'Ensure Oracle Linux GPG Key Installed'

description: |-
    To ensure the system can cryptographically verify base software
    packages come from Oracle (and to connect to the Unbreakable Linux Network to
    receive them), the Oracle GPG key must properly be installed.
    To install the Oracle GPG key, run:
    <pre>$ sudo uln_register</pre>
    If the system is not connected to the Internet,
    then install the Oracle GPG key from trusted media such as
    the Oracle installation CD-ROM or DVD. Assuming the disc is mounted
    in <tt>/media/cdrom</tt>, use the following command as the root user to import
    it into the keyring:
    <pre>$ sudo rpm --import /media/cdrom/RPM-GPG-KEY-oracle</pre>

    Alternatively, the key may be pre-loaded during the Oracle installation. In
    such cases, the key can be installed by running the following command:
    <pre>sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-oracle</pre>

rationale: |-
    Changes to software components can have significant effects on the
    overall security of the operating system. This requirement ensures
    the software has not been tampered with and that it has been provided
    by a trusted vendor. The Oracle GPG key is necessary to
    cryptographically verify packages are from Oracle.

severity: high

references:
    cis-csc: 11,2,3,9
    cis@ol7: 1.2.2
    cis@ol8: 1.2.2
    cobit5: APO01.06,BAI03.05,BAI06.01,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS06.02
    isa-62443-2009: 4.3.4.3.2,4.3.4.3.3,4.3.4.4.4
    isa-62443-2013: 'SR 3.1,SR 3.3,SR 3.4,SR 3.8,SR 7.6'
    iso27001-2013: A.11.2.4,A.12.1.2,A.12.2.1,A.12.5.1,A.12.6.2,A.14.1.2,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4
    nist: CM-5(3),SI-7,SC-12,SC-12(3),CM-6(a),CM-11(a),CM-11(b)
    nist-csf: PR.DS-6,PR.DS-8,PR.IP-1
    pcidss: Req-6.2
    stigid@ol7: OL07-00-010019
    stigid@ol8: OL08-00-010019

ocil_clause: 'the Oracle GPG Key is not installed'

ocil: |-
    To ensure that the GPG key is installed, run:
    <pre>$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey</pre>
    The command should return the string below:
    <pre>gpg(Oracle OSS group (Open Source Software group) &lt;build@oss.oracle.com&gt;</pre>
