Add new rule file_permissions_sudo #11584
Conversation
Mab879
added
New Rule
|
Start a new ephemeral environment with changes proposed in this pull request: rhel8 (from CTF) Environment (using Fedora as testing environment) Fedora Testing Environment Oracle Linux 8 Environment |
|
/packit retest-failed |
|
/packit retest-failed |
|
@Mab879 Testing farm fail is legit, it fail in the rule file_permissions_sudo in the ANSSI profile. The actual permissions are of |
|
/packit retest-failed |
So I misread the permissions in ANSSI, they are looking for 4110, but that might not be possible. |
| name: "file_permissions" | ||
| vars: | ||
| filepath: "/usr/bin/sudo" | ||
| filemode: '4110' |
There was a problem hiding this comment.
CI still fails so we will probably need to change it to 4111.
The HTML report from the testing farm https://artifacts.dev.testing-farm.io/ae6aeb0b-5999-4a1d-ad23-2291c000eb50/work-ansible-anssivlxuhmw6/tests/fmf-plans/ansible-anssi/execute/data/guest/default-0/Sanity/ansible-machine-hardening/anssi_bp28_high-1/data/anssi_bp28_high.html indicates that 4111 .
On my machine:
jcerny@fedora:~$ stat -c %a /usr/bin/sudo
4111
But I haven't investigated it further.
| title: 'Ensure That the sudo Binary Has the Correct Permissions' | ||
|
|
||
| description: |- | ||
| {{{ describe_file_permissions("/usr/bin/sudo", "4750") | indent(4) }}} |
There was a problem hiding this comment.
the value of the permissions will have to be the same as in the template section
|
Moving to 4111 as 4110 doesn't seem possible. |
|
Code Climate has analyzed commit 257bf01 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.3% (0.0% change). View more on Code Climate. |
|
/packit retest-failed |
2 similar comments
|
/packit retest-failed |
|
/packit retest-failed |
|
/packit retest- failed |
|
/packit retest-failed |
5 similar comments
|
/packit retest-failed |
|
/packit retest-failed |
|
/packit retest-failed |
|
/packit retest-failed |
|
/packit retest-failed |
Description:
Add new rule file_permissions_sudo
Rationale:
To cover ANSSI R38