-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add new rule file_permissions_sudo #11584
Conversation
/packit retest-failed |
/packit retest-failed |
@Mab879 Testing farm fail is legit, it fail in the rule file_permissions_sudo in the ANSSI profile. The actual permissions are of |
/packit retest-failed |
So I misread the permissions in ANSSI, they are looking for 4110, but that might not be possible. |
name: "file_permissions" | ||
vars: | ||
filepath: "/usr/bin/sudo" | ||
filemode: '4110' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
CI still fails so we will probably need to change it to 4111.
The HTML report from the testing farm https://artifacts.dev.testing-farm.io/ae6aeb0b-5999-4a1d-ad23-2291c000eb50/work-ansible-anssivlxuhmw6/tests/fmf-plans/ansible-anssi/execute/data/guest/default-0/Sanity/ansible-machine-hardening/anssi_bp28_high-1/data/anssi_bp28_high.html indicates that 4111 .
On my machine:
jcerny@fedora:~$ stat -c %a /usr/bin/sudo
4111
But I haven't investigated it further.
title: 'Ensure That the sudo Binary Has the Correct Permissions' | ||
|
||
description: |- | ||
{{{ describe_file_permissions("/usr/bin/sudo", "4750") | indent(4) }}} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
the value of the permissions will have to be the same as in the template section
Moving to 4111 as 4110 doesn't seem possible. |
Code Climate has analyzed commit 257bf01 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.3% (0.0% change). View more on Code Climate. |
/packit retest-failed |
2 similar comments
/packit retest-failed |
/packit retest-failed |
/packit retest- failed |
/packit retest-failed |
5 similar comments
/packit retest-failed |
/packit retest-failed |
/packit retest-failed |
/packit retest-failed |
/packit retest-failed |
Description:
Add new rule file_permissions_sudo
Rationale:
To cover ANSSI R38