documentation_complete: true

title: 'Only the VDSM User Can Use sudo NOPASSWD'

description: 
    The sudo <tt>NOPASSWD</tt> tag, when specified, allows a user to execute commands using
    sudo without having to authenticate. Only the <tt>vdsm</tt> user should have this
    capability in any sudo configuration snippets in <tt>/etc/sudoers.d/</tt>.

rationale: |-
    Without re-authentication, users may access resources or perform tasks for which they
    do not have authorization.
    <br /><br />
    When operating systems provide the capability to escalate a functional capability, it
    is critical that the user re-authenticate.

severity: medium

identifiers:
    cce@rhel8: CCE-82365-8
    cce@rhel9: CCE-83528-0

ocil_clause: 'nopasswd is set for any users beyond vdsm'

ocil: |-
    To determine if <tt>NOPASSWD</tt> has been configured for the vdsm user for sudo,
    run the following command:
    <pre>$ sudo grep -ri nopasswd /etc/sudoers.d/</pre>
    The command should return output only for the vdsm user.
