mirror of
https://github.com/usnistgov/macos_security.git
synced 2026-02-03 05:53:24 +00:00
os_sudo_timeout_configure adjust check for possible spaces #258
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @gsprague on GitHub.
Summary
os_sudo_timeout_configure.yaml is giving a zero “0” result if there are spaces in the setting, i.e. Defaults timestamp_timeout = 5
Steps to reproduce
Add:
Defaults timestamp_timeout = 5
To:
/etc/sudoers.d/your-file
Run command:
/usr/bin/find /etc/sudoers* -type f -exec /usr/bin/grep -E "^Defaults\s+timestamp_timeout=0" '{}' \; | /usr/bin/wc -l | /usr/bin/xargscommand result = 0
Test:
open new terminal window
run a sudo command
run another sudo command, it will not prompt for pass until timeout is met
Operating System version
macOS v12.2.1
What is the current bug behavior?
The result is 0, it should be 1
What is the expected correct behavior?
The result should be 1 because the timeout is set greater than zero.
Relevant logs and/or screenshots
(Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.)
Output of checks
/usr/bin/find /etc/sudoers* -type f -exec /usr/bin/grep -E "^Defaults\s+timestamp_timeout=0" '{}' \; | /usr/bin/wc -l | /usr/bin/xargsResult = 0
Possible fixes
Replace the regex \s+ after "Defaults" with \s*
Add \s* before and after the "="
/usr/bin/find /etc/sudoers* -type f -exec /usr/bin/grep -E "^Defaults\s*timestamp_timeout\s*=\s*0" '{}' \; | /usr/bin/wc -l | /usr/bin/xargsPlease also check other scripts with similar configuration like this:
os_sudoers_timestamp_type_configure.yaml
/usr/bin/find /etc/sudoers* -type f -exec /usr/bin/grep -E '(^Defaults\s+timestamp_type=global|^Defaults\s+timestamp_type=ppid)' '{}' \; | /usr/bin/wc -l | /usr/bin/xargs@gsprague commented on GitHub:
This also doesn't work when the timeout is set in a list or array like so:
Defaults env_reset,timestamp_timeout=2
@robertgendler commented on GitHub:
This should all be fixed and changed in the OS branches with the new sudo checks. Please check it out and make sure.