Ensure apt_get Removes Previous Package Versions

An XCCDF Rule

Description

apt_get should be configured to remove previous software components after new versions have been installed. To configure apt_get to remove the previous software components after updating, set the ::Remove-Unused-Dependencies and ::Remove-Unused-Kernel-Packages to true in /etc/apt/apt.conf.

Rationale

Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by some adversaries.

ID: xccdf_org.ssgproject.content_rule_clean_components_post_updating
Severity: Low
References: 18 20 4

APO12.01 APO12.02 APO12.03 APO12.04 BAI03.10 DSS05.01 DSS05.02

3.4.8

CCI-002617

4.2.3 4.2.3.12 4.2.3.7 4.2.3.9

A.12.6.1 A.14.2.3 A.16.1.3 A.18.2.2 A.18.2.3

CM-11(a) CM-11(b) CM-6(a) SI-2(6)

ID.RA-1 PR.IP-12

SRG-OS-000437-GPOS-00194
Updated: about 1 year ago


flag1=1
flag2=1

for file in /etc/apt/apt.conf.d/*; do
    if [ -e "$file" ]; then        if grep -qi "Unattended-Upgrade::Remove-Unused-Dependencies" $file; then
            sed -i --follow-symlinks "s/^.*Unattended-Upgrade::Remove-Unused-Dependencies.*/Unattended-Upgrade::Remove-Unused-Dependencies \"true\";/I" $file
            flag1=0
        fi

        if grep -qi "Unattended-Upgrade::Remove-Unused-Kernel-Packages" $file; then
            sed -i --follow-symlinks "s/^.*Unattended-Upgrade::Remove-Unused-Kernel-Packages.*/Unattended-Upgrade::Remove-Unused-Kernel-Packages \"true\";/I" $file
            flag2=0
        fi
    fi
done

if [ $flag1 ] || [ $flag2 ]; then
    echo "Unattended-Upgrade::Remove-Unused-Dependencies \"true\";" >> /etc/apt/apt.conf.d/50unattended-upgrades
    echo "Unattended-Upgrade::Remove-Unused-Kernel-Packages \"true\";" >> /etc/apt/apt.conf.d/50unattended-upgrades
fi

Ensure apt_get Removes Previous Package Versions

Description

Rationale

Remediation - Shell Script