documentation_complete: true

title: 'Disable User Access to Untrusted Sources Settings'

description: |-
    To ensure that users cannot change the untrusted sources settings,
    add <tt>deployment.security.askgrantdialog.notinca.locked</tt> to
    <tt>/etc/.java/deployment/deployment.properties</tt>.

rationale: |-
    Permitting execution of signed Java applets from un-trusted sources may
    result in malware running on the system, and risks system modification,
    invasion of privacy, or denial of service. As such, ensuring users cannot
    change the permission settings which control the execution of signed Java
    applets contributes to a more consistent security profile.

severity: medium

identifiers:
    cce: ""

references:
    disa: ""
    nist: DCBP-1
    stigid: JRE0010-UX

ocil_clause: 'it does not exist or is not configured properly'

ocil: |-
    To verify that users cannot change the untrusted sources settings,
    run the following command:
    <pre>$ grep 'askgrantdialog.notinca.locked' /etc/.java/deployment/deployment.properties</pre>
    If properly configured, the output should return:
    <pre>deployment.security.askgrantdialog.notinca.locked</pre>
