ComplianceAsCode / ComplianceAsCode/content

/etc/sudoers.d regex is incomplete

Open
#12,588 0 comments 0 reactions 0 assignees View on GitHub
triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

There are rules (e.g. `sudo_require_reauthentication`, but probably others) that check `sudo`'s configuration by scanning `/etc/sudoers` and all files in `/etc/sudoers.d`. For example, `sudo_require_reauthentication` uses the regex `^\/etc\/(sudoers|sudoers\.d\/.*)$`.

This is mostly correct, assuming `/etc/sudoers` actually has an includedir for that directory, but `sudo` ignores certain filename patterns. From the `sudoers` man page:

> For example, given:
>
> @includedir /etc/sudoers.d
>
> sudo will suspend processing of the current file and read each file in /etc/sudoers.d, skipping file names that end in ‘~’ or contain a ‘.’ character to avoid causing problems with package manager or editor temporary/backup files.

So if `/etc/sudoers.d/example.conf` contains `Defaults timestamp_timeout=1`, `sudo` will ignore it but an oscap run will mark it as passing.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.