documentation_complete: true

title: 'Enable Only Approved Extensions'

description: |-
    An organization might need to use an internal or third party developed extension. Any
    organizationally approved extenstion should be enabled. To enable approved extensions,
    set <tt>ExtensionInstallWhitelist</tt> to <tt><sub idref="var_extension_whitelist" /></tt>
    in the Chromium policy file.
    If there are no approved extensions, <tt>ExtensionInstallWhitelist</tt> should be set to
    <tt><sub idref="var_extension_whitelist" selector="default" /></tt>.

rationale: |-
    The whitelist should only contain organizationally approved extensions. This is to prevent
    a user from accidently whitelisitng a malicious extension.

severity: unknown

identifiers:
    cce: ""

references:
    disa: ""
    nist: ""
    stigid: DTBC0003

ocil_clause: 'approved extensions are not set'

ocil: |-
    To verify that approved extensions are whitelisted, run the following command:
    <pre>$ grep ExtensionInstallWhitelist /etc/chromium/policies/managed/*.json</pre>
    The output should contain:
    <pre>"ExtensionInstallWhitelist": ["<sub idref="var_extension_whitelist" />"],</pre>
