Skip to content
ATO Pathways
  Log In

Ensure sudo Ignores Commands In Current Dir - sudo ignore_dot

An XCCDF Rule

Description

The sudo ignore_dot tag, when specified, will ignore the current directory in the PATH environment variable. On Red Hat Enterprise Linux 8, env_reset is enabled by default This should be enabled by making sure that the ignore_dot tag exists in /etc/sudoers configuration file or any sudo configuration snippets in /etc/sudoers.d/.

Rationale

Ignoring the commands in the user's current directory prevents an attacker from executing commands downloaded locally.

ID
xccdf_org.ssgproject.content_rule_sudo_add_ignore_dot
Severity
Medium
References
Updated



Remediation - Ansible

- name: Ensure ignore_dot is enabled in /etc/sudoers
  lineinfile:
    path: /etc/sudoers
    regexp: ^[\s]*Defaults.*\bignore_dot\b.*$
    line: Defaults ignore_dot
    validate: /usr/sbin/visudo -cf %s

Remediation - Shell Script


if /usr/sbin/visudo -qcf /etc/sudoers; then
    cp /etc/sudoers /etc/sudoers.bak
    if ! grep -P '^[\s]*Defaults[\s]*\bignore_dot\b.*$' /etc/sudoers; then
        # sudoers file doesn't define Option ignore_dot
        echo "Defaults ignore_dot" >> /etc/sudoers