fix(privilege): enforce CIS privileged access controls

[Lynsey Rydberg (corvus-callidus)]

Summary

Configure Azure Linux defaults to require a PTY for sudo, maintain a dedicated sudo audit log, and restrict direct su access through an empty system group.

The sudo policy, log lifecycle, and group declaration are delivered by azurelinux-release-common; the su PAM policy is delivered through the util-linux component overlay.

CIS rules

• 5.2.2 — Ensure sudo commands use pty — AB#22756
• 5.2.3 — Ensure sudo log file exists — AB#22756
• 5.2.7 — Ensure access to the su command is restricted — AB#22756

Validation

• Local and koji builds of azurelinux-release and util-linux.
• Validated package installation, sudoers syntax, logrotate syntax, tmpfiles permissions, sysusers group creation, and RPM verification in a scrubbed stage2 mock environment.
• Built a fresh vm-base-dev image from the local RPM repository, ran CIS-CAT Level 1 Server on its first boot and confirmed that all three targeted CIS rules pass.

[Copilot]

Pull request overview

Enforces CIS privileged-access defaults through release packaging and a util-linux overlay.

Changes:

• Requires sudo PTYs and dedicated audit logging with rotation.
• Restricts su access to the empty sugroup.
• Refreshes component locks and rendered specifications.

Reviewed changes

Copilot reviewed 15 out of 17 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
base/comps/components.toml	Moves util-linux to dedicated configuration.
base/comps/util-linux/util-linux.comp.toml	Configures util-linux overlays.
base/comps/util-linux/overlays/0001-restrict-su-command.overlay.toml	Applies the su PAM restriction.
base/comps/azurelinux-release/azurelinux-release.spec	Packages privileged-access policy files.
base/comps/azurelinux-release/azurelinux-sugroup.conf	Declares the restricted group.
base/comps/azurelinux-release/azurelinux-sudoers.conf	Enables PTY use and audit logging.
base/comps/azurelinux-release/azurelinux-sudo.logrotate	Configures sudo log rotation.
base/comps/azurelinux-release/azurelinux-sudo.conf	Creates the sudo audit log.
locks/azurelinux-release.lock	Refreshes the release component fingerprint.
locks/util-linux.lock	Refreshes the util-linux fingerprint.
specs/a/azurelinux-release/azurelinux-release.spec	Renders updated release packaging.
specs/a/azurelinux-release/azurelinux-sugroup.conf	Renders the group declaration.
specs/a/azurelinux-release/azurelinux-sudoers.conf	Renders sudo defaults.
specs/a/azurelinux-release/azurelinux-sudo.logrotate	Renders log rotation policy.
specs/a/azurelinux-release/azurelinux-sudo.conf	Renders tmpfiles configuration.
specs/u/util-linux/util-linux.spec	Updates rendered release metadata.
specs/u/util-linux/util-linux-su.pamd	Renders restricted su authentication.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 17 changed files in this pull request and generated no new comments.

Suppressed comments (1)

base/comps/azurelinux-release/azurelinux-release.spec:424

• Installing this tmpfiles entry does not apply it on an in-place azurelinux-release-common install or upgrade, so /var/log/sudo.log can remain absent until the next boot, a manual tmpfiles run, or the first sudo invocation. That leaves CIS 5.2.3 failing immediately after an update. Add a %post common invocation of systemd-tmpfiles --create %{_tmpfilesdir}/azurelinux-sudo.conf together with an ordered runtime dependency on (systemd-standalone-tmpfiles or systemd); specs/s/samba/samba.spec:531,1713-1715 demonstrates this pattern.

install -Dm0644 %{SOURCE27} %{buildroot}%{_prefix}/lib/tmpfiles.d/azurelinux-sudo.conf

[Copilot]

Pull request overview

Copilot reviewed 15 out of 17 changed files in this pull request and generated no new comments.

[Tobias Brick (tobiasb-ms)]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.