Merge pull request #11315 from Mab879/fix_tests_for_sudo_require_auth…

…entication Fix tests for sudo_require_authentication
ComplianceAsCode · Dec 1, 2023 · 6494d8f · 6494d8f
2 parents 3c3b708 + 722e6d6
commit 6494d8f
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/linux_os/guide/system/software/sudo/sudo_require_authentication/tests/wrong_value.fail.sh b/linux_os/guide/system/software/sudo/sudo_require_authentication/tests/wrong_value.fail.sh
@@ -5,6 +5,6 @@ echo "Defaults !authenticate" >> /etc/sudoers
 chmod 440 /etc/sudoers
 
 mkdir -p /etc/sudoers.d
-echo "%wheel        ALL=(ALL)       !authenticate ALL" >> /etc/sudoers.d/sudoers
+echo "%wheel        ALL=(ALL)       NOPASSWD: ALL" >> /etc/sudoers.d/sudoers
 echo "Defaults !authenticate" >> /etc/sudoers.d/sudoers
 chmod 440 /etc/sudoers.d/sudoers
diff --git a/shared/macros/10-ansible.jinja b/shared/macros/10-ansible.jinja
@@ -721,17 +721,25 @@ The following macro remediates Audit syscall rule in :code:`/etc/audit/audit.rul
     mode: 0644
 {{%- endmacro %}}
 
+{{#
+    This macro comments out a given line of the sudoers and then validates it before saving.
+
+:param parameter: The parameter to remove
+:type parameter: str
+:param pattern: The pattern to remove
+:type pattern: str
 
+#}}
 {{%- macro ansible_sudo_remove_config(parameter, pattern) -%}}
 
 - name: Find /etc/sudoers.d/ files
-  find:
+  ansible.builtin.find:
     paths:
       - /etc/sudoers.d/
   register: sudoers
 
 - name: "Remove lines containing {{{ parameter }}} from sudoers files"
-  replace:
+  ansible.builtin.replace:
     regexp: '(^(?!#).*[\s]+{{{ pattern }}}.*$)'
     replace: '# \g<1>'
     path: "{{ item.path }}"