ComplianceAsCode / ComplianceAsCode/content

Discrepency between rule description and rule check, remediation snippet/script in Debian 12 guide anssi bp28 high and enhanced

Open
#13,731 2 comments 0 reactions 0 assignees View on GitHub
triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

Rule descriptions in "Ensure That the sudo Binary Has the Correct Permissions" for guide bp28 enhanced and high of debian 12 differ from the rule checked and the remediation snippet and script.

In xccdf_org.ssgproject.content_rule_file_permissions_sudo in ssg-debian12-guide-anssi_bp28_enhanced and ssg-debian12-guide-anssi_bp28_high the rule says:

_To properly set the permissions of /usr/bin/sudo, run the command:
$ sudo chmod 4111 /usr/bin/sudo_

However the rule fails if permissions are not 4110 and using remediation snippet and script mention 4110:

_chmod 4110 /usr/bin/sudo_

Using the remediation script would make sudo unusable unless the default Debian group owner of sudo is changed from root to sudo.

#### SCAP Security Guide Version:
0.1.76

ssg-debian12-guide-anssi_bp28_enhanced
ssg-debian12-guide-anssi_bp28_high

#### Operating System Version:
Debian 12

#### Proposed change:

Change the rule check and remediation snippets and scripts to use 4111 instead of 4110.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.