Add bash and ansible remediation for sudo_remove_nopasswd and sudo_remove_no_authenticate

[ggbecker]

Description:

The first question is, does it make sense to have remediation for this rule even though the file /etc/sudoers is supposed to be read-only? and to be changed only through visudo utility

• Add ansible remediation for sudo_remove_nopasswd.
• Add test scenarios for sudo_remove_nopasswd.

Rationale:

• Reference: https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linux_7_security_technical_implementation_guide/V-71947?version=V1R4&compareto=v2r7

[openshift-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[redhatrises]

Description:

The first question is, does it make sense to have remediation for this rule even though the file /etc/sudoers is supposed to be read-only? and to be changed only through visudo utility

• Add ansible remediation for sudo_remove_nopasswd.
• Add test scenarios for sudo_remove_nopasswd.

Rationale:

• Reference: https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linux_7_security_technical_implementation_guide/V-71947?version=V1R4&compareto=v2r7

Visudo is for manually editing sudoers files. Most scripts modify the sudoers file, so yes, it makes sense.

[ggbecker]

Description:

The first question is, does it make sense to have remediation for this rule even though the file /etc/sudoers is supposed to be read-only? and to be changed only through visudo utility

• Add ansible remediation for sudo_remove_nopasswd.
• Add test scenarios for sudo_remove_nopasswd.

Rationale:

• Reference: https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linux_7_security_technical_implementation_guide/V-71947?version=V1R4&compareto=v2r7

Visudo is for manually editing sudoers files. Most scripts modify the sudoers file, so yes, it makes sense.

Ok, turning PR ready for review.

[redhatrises]

Suggested change

	{{{ ansible_sudo_remove_config("not authenticate", "!authenticate") }}}
	{{{ ansible_sudo_remove_config("!authenticate", "!authenticate") }}}

I'd make all instances of "not authenticate" as "!authenticate". The use of quotes in the name tasks should make "!" a string vs something executable by shell.

[mildas]

Changes identified:
Rule sudo_remove_no_authenticate:
 Templatization usage changed.
 Ansible remediation newly added.
 Bash remediation is newly added.
Rule sudo_remove_nopasswd:
 Templatization usage changed.
 Ansible remediation newly added.
 Bash remediation is newly added.
Rule sudo_require_authentication:
 Templatization usage changed.
 Ansible remediation newly added.
 Bash remediation is newly added.
Macro ansible_sudo_remove_config:
 In Ansible remediation for sudo_remove_nopasswd.
 In Ansible remediation for sudo_require_authentication.
 In Ansible remediation for sudo_remove_no_authenticate.
Macro bash_sudo_remove_config:
 In Bash remediation for sudo_remove_nopasswd.
 In Bash remediation for sudo_require_authentication.
 In Bash remediation for sudo_remove_no_authenticate.

Recommended tests to execute:
 build_product ol8
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-ol8-ds.xml sudo_remove_no_authenticate
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using bash --datastream build/ssg-ol8-ds.xml sudo_remove_no_authenticate
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-ol8-ds.xml sudo_remove_nopasswd
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using bash --datastream build/ssg-ol8-ds.xml sudo_remove_nopasswd
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-ol8-ds.xml sudo_require_authentication
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using bash --datastream build/ssg-ol8-ds.xml sudo_require_authentication

[openshift-ci-robot]

@ggbecker: The following test failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-rhcos4-e8	e6ebab4	link	/test e2e-aws-rhcos4-e8

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[redhatrises]

/lgtm