Ensure That the sudo Binary Has the Correct Permissions
An XCCDF Rule
Description
To properly set the permissions of /usr/bin/sudo, run the command:
$ sudo chmod 4111 /usr/bin/sudo
Rationale
The sudoers program should only be usable by people who have the correct permissions.
- ID
- xccdf_org.ssgproject.content_rule_file_permissions_sudo
- Severity
- Medium
- References
- Updated
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- configure_strategy
- file_permissions_sudo
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'sudo' 2>/dev/null | grep -q installed; then
chmod 4110 /usr/bin/sudo
else