Skip to content

SLE16 sudo rules transactional related patches #15131

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
teacup-on-rockingchair wants to merge 2 commits into
base: master
Choose a base branch
from
Open

SLE16 sudo rules transactional related patches #15131

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fdb4362
Make sudo related rules compatible with transactional based sle/slmic…
teacup-on-rockingchair Sep 20, 2026
f843406
Fix packages field syntax
teacup-on-rockingchair Sep 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/ansible/shared.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,17 @@
# complexity = low
# disruption = low

{{% if product in [ 'sle16', 'slmicro6' ] %}}
{{{ ansible_copy_distro_defaults('/usr/etc/sudoers', '/etc/sudoers', rule_title=rule_title) }}}
{{{
ansible_lineinfile(
rule_title + " - Remove /usr/etc/sudoers.d include directive from /etc/sudoers",
path="/etc/sudoers",
regex='^\s*@includedir\s+/usr/etc/sudoers.d',
state="absent",
when="not ansible_check_mode"
)
}}}
{{% endif %}}

{{{ ansible_sudo_remove_config("!authenticate", "\!authenticate") }}}
4 changes: 4 additions & 0 deletions linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/bash/shared.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,8 @@
# complexity = low
# disruption = low

{{% if product in [ 'sle16', 'slmicro6' ] %}}
{{{ bash_copy_distro_defaults("/usr/etc/sudoers", "/etc/sudoers") }}}
{{{ lineinfile_absent("/etc/sudoers", "^\s*@includedir\s*/usr/etc/sudoers\.d", sed_path_separator="#", rule_id=rule_id) }}}
{{% endif %}}
{{{ bash_sudo_remove_config("!authenticate", "\!authenticate") }}}
9 changes: 9 additions & 0 deletions linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,18 @@
<criteria operator="AND">
<criterion comment="!authenticate does not exist in /etc/sudoers" test_ref="test_no_authenticate_etc_sudoers" />
<criterion comment="!authenticate does not exist in /etc/sudoers.d" test_ref="test_no_authenticate_etc_sudoers_d" />
{{% if product in [ 'sle16', 'slmicro6' ] %}}
<criterion
comment="test if configuration file /etc/sudoers exists for {{{ rule_id }}}"
test_ref="test_{{{ rule_id }}}_config_file_exists"/>
Comment thread
teacup-on-rockingchair marked this conversation as resolved.
{{% endif %}}
</criteria>
</definition>

{{% if product in [ 'sle16', 'slmicro6' ] %}}
{{{ oval_config_file_exists_test('/etc/sudoers', rule_id=rule_id) }}}
{{{ oval_config_file_exists_object('/etc/sudoers', rule_id=rule_id) }}}
{{% endif %}}
<ind:textfilecontent54_test check="all" check_existence="none_exist" comment="!authenticate does not exist in /etc/sudoers" id="test_no_authenticate_etc_sudoers" version="1">
<ind:object object_ref="object_no_authenticate_etc_sudoers" />
</ind:textfilecontent54_test>
Expand Down
1 change: 1 addition & 0 deletions linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/tests/correct_value.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
#!/bin/bash
# packages = sudo

rm -f /etc/sudoers
echo "Defaults authenticate" > /etc/sudoers
Expand Down
7 changes: 1 addition & 6 deletions linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/tests/wrong_value.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,3 @@
#!/bin/bash

# packages = sudo
echo "Defaults !authenticate" >> /etc/sudoers
chmod 440 /etc/sudoers

mkdir -p /etc/sudoers.d
echo "Defaults !authenticate" >> /etc/sudoers.d/sudoers
chmod 440 /etc/sudoers.d/sudoers
6 changes: 6 additions & 0 deletions ...de/system/software/sudo/sudo_remove_no_authenticate/tests/wrong_value_include_dir.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
#!/bin/bash
# packages = sudo
echo "Defaults authenticate" > /etc/sudoers

mkdir -p /etc/sudoers.d
echo "Defaults !authenticate" >> /etc/sudoers.d/sudoers
13 changes: 13 additions & 0 deletions linux_os/guide/system/software/sudo/sudo_remove_nopasswd/ansible/shared.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,17 @@
# complexity = low
# disruption = low

{{% if product in [ 'sle16', 'slmicro6' ] %}}
{{{ ansible_copy_distro_defaults('/usr/etc/sudoers', '/etc/sudoers', rule_title=rule_title) }}}
{{{
ansible_lineinfile(
rule_title + " - Remove /usr/etc/sudoers.d include directive from /etc/sudoers",
path="/etc/sudoers",
regex='^\s*@includedir\s+/usr/etc/sudoers.d',
state="absent",
when="not ansible_check_mode"
)
}}}
{{% endif %}}

{{{ ansible_sudo_remove_config("NOPASSWD", "NOPASSWD[\s]*\:") }}}
4 changes: 4 additions & 0 deletions linux_os/guide/system/software/sudo/sudo_remove_nopasswd/bash/shared.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,8 @@
# complexity = low
# disruption = low

{{% if product in [ 'sle16', 'slmicro6' ] %}}
{{{ bash_copy_distro_defaults("/usr/etc/sudoers", "/etc/sudoers") }}}
{{{ lineinfile_absent("/etc/sudoers", "^\s*@includedir\s*/usr/etc/sudoers\.d", sed_path_separator="#", rule_id=rule_id) }}}
{{% endif %}}
{{{ bash_sudo_remove_config("NOPASSWD", "NOPASSWD[\s]*\:") }}}
10 changes: 10 additions & 0 deletions linux_os/guide/system/software/sudo/sudo_remove_nopasswd/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,19 @@
<criteria operator="AND">
<criterion comment="NOPASSWD is not configured in /etc/sudoers" test_ref="test_nopasswd_etc_sudoers" />
<criterion comment="NOPASSWD is not configured in /etc/sudoers.d" test_ref="test_nopasswd_etc_sudoers_d" />
{{% if product in [ 'sle16', 'slmicro6' ] %}}
<criterion
comment="test if configuration file /etc/sudoers exists for {{{ rule_id }}}"
test_ref="test_{{{ rule_id }}}_config_file_exists"/>
Comment thread
teacup-on-rockingchair marked this conversation as resolved.
{{% endif %}}
</criteria>
</definition>

{{% if product in [ 'sle16', 'slmicro6' ] %}}
{{{ oval_config_file_exists_test('/etc/sudoers', rule_id=rule_id) }}}
{{{ oval_config_file_exists_object('/etc/sudoers', rule_id=rule_id) }}}
{{% endif %}}

<ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NOPASSWD does not exist /etc/sudoers" id="test_nopasswd_etc_sudoers" version="1">
<ind:object object_ref="object_nopasswd_etc_sudoers" />
</ind:textfilecontent54_test>
Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/system/software/sudo/sudo_remove_nopasswd/tests/correct_value.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/bin/bash

# packages = sudo
rm -f /etc/sudoers
echo "%wheel ALL=(ALL) ALL" > /etc/sudoers
chmod 440 /etc/sudoers
6 changes: 1 addition & 5 deletions linux_os/guide/system/software/sudo/sudo_remove_nopasswd/tests/wrong_value.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,4 @@
#!/bin/bash

# packages = sudo
echo "%wheel ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
chmod 440 /etc/sudoers

mkdir -p /etc/sudoers.d
echo "%wheel ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers.d/sudoers
chmod 440 /etc/sudoers.d/sudoers
8 changes: 8 additions & 0 deletions ..._os/guide/system/software/sudo/sudo_remove_nopasswd/tests/wrong_value_include_dir.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
#!/bin/bash
# packages = sudo
echo "%wheel ALL=(ALL) ALL" > /etc/sudoers
chmod 440 /etc/sudoers

mkdir -p /etc/sudoers.d
echo "%wheel ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers.d/sudoers
chmod 440 /etc/sudoers.d/sudoers
2 changes: 1 addition & 1 deletion ...ide/system/software/sudo/sudo_remove_nopasswd/tests/wrong_value_specific_commands.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/bin/bash

# packages = sudo
echo "%wheel ALL=(ALL) NOPASSWD: /bin/systemctl, /bin/lsof, /bin/date" >> /etc/sudoers
chmod 440 /etc/sudoers

Expand Down
1 change: 1 addition & 0 deletions linux_os/guide/system/software/sudo/sudo_require_authentication/tests/correct_value.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
#!/bin/bash
# packages = sudo

rm -f /etc/sudoers
echo "%wheel ALL=(ALL) ALL" > /etc/sudoers
Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/system/software/sudo/sudo_require_authentication/tests/wrong_value.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/bin/bash

# packages = sudo
echo "%wheel ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
echo "Defaults !authenticate" >> /etc/sudoers
chmod 440 /etc/sudoers
Expand Down
12 changes: 10 additions & 2 deletions ...uide/system/software/sudo/sudo_restrict_privilege_elevation_to_authorized/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,16 +12,24 @@
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
{{% endmacro %}}

<definition class="compliance" id="{{{ rule_id }}}" version="1">
{{{ oval_metadata("Check that sudoers doesn't allow all users to run commands via sudo", rule_title=rule_title) }}}
<criteria operator="AND">
<criterion comment="Make sure that sudoers has restrictions on which users can run sudo for any target user" test_ref="test_not_all_users_can_sudo_to_users" />
<criterion comment="Make sure that sudoers has restrictions on which users can run sudo for any target group" test_ref="test_not_all_users_can_sudo_to_group" />
{{% if product in [ 'sle16', 'slmicro6' ] %}}
<criterion
comment="test if configuration file /etc/sudoers exists for {{{ rule_id }}}"
test_ref="test_{{{ rule_id }}}_config_file_exists"/>
Comment thread
teacup-on-rockingchair marked this conversation as resolved.
{{% endif %}}
</criteria>
</definition>

{{{ check_sudoers(scope='users',pattern='^\s*ALL\s+ALL\=\(ALL\)\s+ALL\s*$') }}}
{{{ check_sudoers(scope='group',pattern='^\s*ALL\s+ALL\=\(ALL\:ALL\)\s+ALL\s*') }}}

{{% if product in [ 'sle16', 'slmicro6' ] %}}
{{{ oval_config_file_exists_test('/etc/sudoers', rule_id=rule_id) }}}
{{{ oval_config_file_exists_object('/etc/sudoers', rule_id=rule_id) }}}
{{% endif %}}
</def-group>
13 changes: 13 additions & 0 deletions linux_os/guide/system/software/sudo/sudoers_validate_passwd/ansible/shared.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,19 @@
register: sudoers_file_defaults
{{%- endmacro %}}

{{% if product in [ 'sle16', 'slmicro6' ] %}}
{{{ ansible_copy_distro_defaults('/usr/etc/sudoers', '/etc/sudoers', rule_title=rule_title) }}}
{{{
ansible_lineinfile(
rule_title + " - Remove /usr/etc/sudoers.d include directive from /etc/sudoers",
path="/etc/sudoers",
regex='^\s*@includedir\s+/usr/etc/sudoers.d',
state="absent",
when="not ansible_check_mode"
)
}}}
{{% endif %}}

{{{- delete_line_in_sudoers_d("Defaults targetpw") }}}
{{{- delete_line_in_sudoers_d("Defaults rootpw") }}}
{{{- delete_line_in_sudoers_d("Defaults runaspw") }}}
Expand Down
5 changes: 5 additions & 0 deletions linux_os/guide/system/software/sudo/sudoers_validate_passwd/bash/shared.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,11 @@ if grep -x '^{{{line}}}$' /etc/sudoers.d/*; then
fi
{{%- endmacro %}}

{{% if product in [ 'sle16', 'slmicro6'] %}}
{{{ bash_copy_distro_defaults("/usr/etc/sudoers", "/etc/sudoers") }}}
{{{ lineinfile_absent("/etc/sudoers", "^\s*@includedir\s*/usr/etc/sudoers\.d", sed_path_separator="#", rule_id=rule_id) }}}
{{% endif %}}

{{{- delete_line_in_sudoers_d("Defaults targetpw") }}}
{{{- delete_line_in_sudoers_d("Defaults rootpw") }}}
{{{- delete_line_in_sudoers_d("Defaults runaspw") }}}
Expand Down
10 changes: 10 additions & 0 deletions linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,19 @@
<criterion comment="Check Defaults targetpw is not defined in /etc/sudoers file" test_ref="test_sudoers_targetpw_not_defined" />
<criterion comment="Check Defaults rootpw is not defined in /etc/sudoers file" test_ref="test_sudoers_rootpw_not_defined" />
<criterion comment="Check Defaults runaspw is not defined in /etc/sudoers file" test_ref="test_sudoers_runaspw_not_defined" />
{{% if product in [ 'sle16', 'slmicro6' ] %}}
<criterion
comment="test if configuration file /etc/sudoers exists for {{{ rule_id }}}"
test_ref="test_{{{ rule_id }}}_config_file_exists"/>
Comment thread
teacup-on-rockingchair marked this conversation as resolved.
{{% endif %}}
</criteria>
</definition>

{{% if product in [ 'sle16', 'slmicro6' ] %}}
{{{ oval_config_file_exists_test('/etc/sudoers', rule_id=rule_id) }}}
{{{ oval_config_file_exists_object('/etc/sudoers', rule_id=rule_id) }}}
{{% endif %}}

<ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure invoking user's password for privilege escalation when using sudo"
id="test_sudoers_targetpw_config" version="1">
<ind:object object_ref="object_test_sudoers_targetpw_config" />
Expand Down
2 changes: 1 addition & 1 deletion ...x_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_d_duplicate.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/bin/bash
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15,multi_platform_slmicro,multi_platform_almalinux
# platform = SUSE Linux Enterprise 15,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_slmicro
# packages = sudo

echo 'Defaults !targetpw' >> /etc/sudoers
Expand Down
2 changes: 1 addition & 1 deletion ...are/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_conflicting_values.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/bin/bash
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15,multi_platform_slmicro,multi_platform_almalinux
# platform = SUSE Linux Enterprise 15,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_slmicro
# packages = sudo

echo 'Defaults !targetpw' >> /etc/sudoers
Expand Down
2 changes: 1 addition & 1 deletion ...em/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_duplicates.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/bin/bash
# platform = SUSE Linux Enterprise 15,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_slmicro,multi_platform_almalinux
# platform = SUSE Linux Enterprise 15,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_slmicro,multi_platform_almalinux
# packages = sudo

echo 'Defaults !targetpw' >> /etc/sudoers
Expand Down
2 changes: 1 addition & 1 deletion ...em/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_duplicates.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/bin/bash
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15,multi_platform_slmicro,multi_platform_almalinux
# platform = SUSE Linux Enterprise 15,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_slmicro
# packages = sudo

echo 'Defaults !targetpw' >> /etc/sudoers
Expand Down
2 changes: 1 addition & 1 deletion ...oftware/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_multiple_files.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/bin/bash
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15,multi_platform_slmicro,multi_platform_almalinux
# platform = SUSE Linux Enterprise 15,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_slmicro
# packages = sudo

echo 'Defaults !targetpw' >> /etc/sudoers
Expand Down
2 changes: 1 addition & 1 deletion ...guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/bin/bash
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15,multi_platform_slmicro,multi_platform_almalinux
# platform = SUSE Linux Enterprise 15,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_slmicro
# packages = sudo

touch /etc/sudoers.d/empty
Expand Down
2 changes: 1 addition & 1 deletion ...uide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#!/bin/bash
# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15,multi_platform_slmicro,multi_platform_almalinux
# platform = SUSE Linux Enterprise 15,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_opensuse,multi_platform_rhel,multi_platform_slmicro
# packages = sudo

touch /etc/sudoers.d/empty
Expand Down
Loading