documentation_complete: true

title: 'Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC'

description: |-
    The sudo <tt>NOEXEC</tt> tag, when specified, prevents user executed
    commands from executing other commands, like a shell for example.
    This should be enabled by making sure that the <tt>NOEXEC</tt> tag exists in
    <tt>/etc/sudoers</tt> configuration file or any sudo configuration snippets
    in <tt>/etc/sudoers.d/</tt>.

rationale: |-
    Restricting the capability of sudo allowed commands to execute sub-commands
    prevents users from running programs with privileges they wouldn't have otherwise.

severity: high

identifiers:
    cce@rhel8: CCE-83747-6
    cce@rhel9: CCE-83537-1
    cce@rhel10: CCE-89119-2
    cce@sle12: CCE-91494-5
    cce@sle15: CCE-91186-7

ocil_clause: 'noexec is not enabled in sudo'

ocil: |-
    To determine if <tt>NOEXEC</tt> has been configured for sudo, run the following command:
    <pre>$ sudo grep -ri "^[\s]*Defaults.*\bnoexec\b.*" /etc/sudoers /etc/sudoers.d/</pre>
    The command should return a matching output.

template:
    name: sudo_defaults_option
    vars:
        option: noexec
