Add ensure_redhat_gpgkey_installed to RHEL CIS#14531
Open
jan-cerny wants to merge 3 commits intoComplianceAsCode:masterfrom
Open
Add ensure_redhat_gpgkey_installed to RHEL CIS#14531jan-cerny wants to merge 3 commits intoComplianceAsCode:masterfrom
jan-cerny wants to merge 3 commits intoComplianceAsCode:masterfrom
Conversation
We have discovered that after hardening a RHEL 9 system with CIS profile people can't install any RPM packages using dnf. Originally, we thought that the problem was caused by the recent PR ComplianceAsCode#14316 but it isn't caused by that because the problem is reproducible also with the latest released version 0.1.79. The actual reason is that the profile requires GPG checks everywhere but the GPG key isn't installed because the CIS profile doesn't contain rule `ensure_redhat_gpgkey_installed` that would install the GPG key. The rule is listed in the CIS RHEL9 control file but the requirement is manual. This is a bad user experience. In CIS Benchmark, the requirement is manual, because of GPG keys for 3rd party repositories. But, add the rule `ensure_redhat_gpgkey_installed` to the profile because the requirement 1.2.1.2 adds `ensure_gpgcheck_never_disabled` which requires GPG key checking. If the Red Hat GPG key wouldn't be installed, people won't be able to install any RPM package using dnf. Therefore, we will add the rule `ensure_redhat_gpgkey_installed` to RHEL 9 CIS.
|
Skipping CI for Draft Pull Request. |
openshift-ci
bot
added
the
do-not-merge/work-in-progress
Add rule ensure_redhat_gpgkey_installed to RHEL 8 CIS and RHEL 10 CIS profiles. Similar to previous commit
jan-cerny
changed the title
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
Mab879
approved these changes
Mar 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We have discovered that after hardening a RHEL 9 system with CIS profile people can't install any RPM packages using dnf.
Originally, we thought that the problem was caused by the recent PR #14316 but it isn't caused by that because the problem is reproducible also with the latest released version 0.1.79.
The actual reason is that the profile requires GPG checks everywhere but the GPG key isn't installed because the CIS profile doesn't contain rule ensure_redhat_gpgkey_installed that would install the GPG key. This is a bad user experience.
The rule ensure_redhat_gpgkey_installed is listed in the CIS control files but the control is manual so the rule isn't include to the profile. In the CIS Benchmark, the requirement is manual, because of GPG keys for 3rd party repositories. But, we can automate the part for Red Hat GPG key.
This PR changes RHEL 8, 9 and 10 CIS profiles.