Detections
Analytics

1.2.1.4 Ensure access to /etc/apt/trusted.gpg.d directory is configured

Information

The /etc/apt/trusted.gpg.d directory stores individual GPG key files that APT uses to verify the authenticity of packages and repositories.

Solution

Run the following commands to set /etc/apt/trusted.gpg.d Uid and Gid to 0/root and access to 0755 or more restrictive:

# chown root:root /etc/apt/trusted.gpg.d
# chmod u=rwx,g=rx,o=rx /etc/apt/trusted.gpg.d

Impact:

A non-privileged user with write access to /etc/apt/trusted.gpg.d can compromise the chain of trust by adding new public keys to APT trusted keys configuration.

See Also

https://workbench.cisecurity.org/benchmarks/26891

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5, CSCv7|14.6

Plugin: Unix

Control ID: 6eef761f135db9a052e9b9d43863d5034700198d67e180331de8cde8b6877d95