Detections
Analytics

5.2.3 Ensure access on the /etc/sudoers.d directory is configured

Information

/etc/sudoers.d/ is the drop-in directory sudo includes via the #includedir directive in /etc/sudoers. Files placed there become part of the effective sudo policy.

If /etc/sudoers.d/ is writable by a user other than root, that user could add a drop-in file granting unauthorized privilege escalation; if it is world-accessible, the presence and names of its policy files are exposed. Restricting the directory to mode 0750 or more restrictive, owned by root and group root, ensures only root can add, remove, or list drop-in policy files.

Solution

Set the owner, group, and permissions on the directory so that only root can add, remove, or list drop-in policy files:

# chown root:root /etc/sudoers.d
# chmod g-w,o-rwx /etc/sudoers.d

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: ed6cf8fecd17f5daf4a6684360ae53b8e6dec22d93463e672aa96111a2530409