The system must verify that package updates are digitally signed.

From Solaris 11 X86 Security Technical Implementation Guide

Associated with: CCI-000352

SV-60755r1_rule The system must verify that package updates are digitally signed.

Vulnerability discussion

Digitally signed packages ensure that the source of the package can be identified.

Check content

Determine what the signature policy is for pkg publishers: # pkg property | grep signature-policy Check that output produces: signature-policy verify If the output does not confirm that signature-policy verify is active, this is a finding.

Fix text

The Software Installation Profile is required. Configure the package system to ensure that digital signatures are verified. # pfexec pkg set-property signature-policy verify

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.