Detections
Analytics

1.2.1.4 Ensure access to /etc/apt/trusted.gpg.d directory is configured

Information

The /etc/apt/trusted.gpg.d directory stores individual GPG key files that APT uses to verify the authenticity of packages and repositories.

Solution

Run the following commands to set /etc/apt/trusted.gpg.d Uid and Gid to 0/root and access to 0755 or more restrictive:

# chown root:root /etc/apt/trusted.gpg.d
# chmod u=rwx,g=rx,o=rx /etc/apt/trusted.gpg.d

Impact:

A non-privileged user with write access to /etc/apt/trusted.gpg.d can compromise the chain of trust by adding new public keys to APT trusted keys configuration.

See Also

https://workbench.cisecurity.org/benchmarks/26893

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5, CSCv7|14.6

Plugin: Unix

Control ID: ea3c374d77b8016dad935fa450f70695f414e68fe17b385394f5612bf9880905