ComplianceAsCode / ComplianceAsCode/content
Discrepency between rule description and rule check, remediation snippet/script in Debian 12 guide anssi bp28 high and enhanced
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
Rule descriptions in "Ensure That the sudo Binary Has the Correct Permissions" for guide bp28 enhanced and high of debian 12 differ from the rule checked and the remediation snippet and script.
In xccdf_org.ssgproject.content_rule_file_permissions_sudo in ssg-debian12-guide-anssi_bp28_enhanced and ssg-debian12-guide-anssi_bp28_high the rule says:
_To properly set the permissions of /usr/bin/sudo, run the command:
$ sudo chmod 4111 /usr/bin/sudo_
However the rule fails if permissions are not 4110 and using remediation snippet and script mention 4110:
_chmod 4110 /usr/bin/sudo_
Using the remediation script would make sudo unusable unless the default Debian group owner of sudo is changed from root to sudo.
#### SCAP Security Guide Version:
0.1.76
ssg-debian12-guide-anssi_bp28_enhanced
ssg-debian12-guide-anssi_bp28_high
#### Operating System Version:
Debian 12
#### Proposed change:
Change the rule check and remediation snippets and scripts to use 4111 instead of 4110.
Contributor guide
Assessment
This issue has not been assessed yet.