CME-708

Least Privilege sudo Configuration

Isolate OS/Kernel Unquantified evidence Preventive

Description

Configures sudo to allow specific commands only, rather than unrestricted root access. Uses command allowlists, NOPASSWD only for specific safe commands, and requiretty.

CVSS Vector Impacts

Metric	Transition	Rationale
Privileges Required (PR)	L → H	Compromised user account has limited elevation paths

CWE Relationships

CWE-269 CWE-250

Verification

Audit sudoers for overly permissive rules

$ grep -r 'ALL=(ALL)' /etc/sudoers /etc/sudoers.d/ 2>/dev/null | grep -v NOPASSWD
# Expected: Minimal matches

Platform: linux

Remediation

linux sudoers.d drop-in with command allowlists and hardening defaults


printf 'Defaults requiretty\nDefaults use_pty\nDefaults logfile=/var/log/sudo.log\nDefaults timestamp_timeout=5\n' > /etc/sudoers.d/00-cme-708-defaults && visudo -cf /etc/sudoers.d/00-cme-708-defaults
printf '%%<admin_group> ALL=(root) /usr/bin/systemctl restart *, /usr/bin/journalctl, /usr/sbin/reboot, /usr/bin/dnf update\n' > /etc/sudoers.d/10-cme-708-admins && visudo -cf /etc/sudoers.d/10-cme-708-admins
cp /etc/sudoers /etc/sudoers.bak.cme-708 && sed -i 's/^\(%[a-z].*ALL=(ALL)\s*ALL\)/#\1  # disabled by CME-708/' /etc/sudoers && visudo -cf /etc/sudoers