Ensure That the sudo Binary Has the Correct Permissions

An XCCDF Rule

Description

To properly set the permissions of /usr/bin/sudo, run the command:

$ sudo chmod 4111 /usr/bin/sudo

Rationale

The sudoers program should only be usable by people who have the correct permissions.

ID: xccdf_org.ssgproject.content_rule_file_permissions_sudo
Severity: Medium
References: R38

CCE-86950-3
Updated: 5 days ago

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-86950-3
  - configure_strategy  - file_permissions_sudo
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Test for existence /usr/bin/sudo
  stat:
    path: /usr/bin/sudo
  register: file_exists
  when: '"sudo" in ansible_facts.packages'
  tags:
  - CCE-86950-3
  - configure_strategy
  - file_permissions_sudo
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission 4110 on /usr/bin/sudo
  file:
    path: /usr/bin/sudo
    mode: '4110'
  when:
  - '"sudo" in ansible_facts.packages'
  - file_exists.stat is defined and file_exists.stat.exists
  tags:
  - CCE-86950-3
  - configure_strategy
  - file_permissions_sudo
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

# Remediation is applicable only in certain platforms
if rpm --quiet -q sudo; then

chmod 4110 /usr/bin/sudo

else    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ensure That the sudo Binary Has the Correct Permissions

Description

Rationale

Remediation - Ansible

Remediation - Shell Script