diff --git a/base/comps/azurelinux-release/azurelinux-release.spec b/base/comps/azurelinux-release/azurelinux-release.spec index 8f649de8077..afc866237d1 100644 --- a/base/comps/azurelinux-release/azurelinux-release.spec +++ b/base/comps/azurelinux-release/azurelinux-release.spec @@ -36,7 +36,7 @@ Summary: Azure Linux release files Name: azurelinux-release Version: 4.0 # TODO(azl): Review whether we can move back to autorelease (with conditional -p) -Release: 24%{?dist} +Release: 25%{?dist} License: MIT URL: https://aka.ms/azurelinux @@ -56,6 +56,10 @@ Source22: 70-azurelinux-hardening.conf Source23: 50-client-alive-interval.conf Source24: 50-permit-root-login.conf Source25: 10-azure-kvp.cfg +Source26: azurelinux-sudoers.conf +Source27: azurelinux-sudo.conf +Source28: azurelinux-sudo.logrotate +Source29: azurelinux-sugroup.conf BuildArch: noarch @@ -414,6 +418,12 @@ install -Dm0644 %{SOURCE16} -t %{buildroot}%{_prefix}/share/dnf5/libdnf.conf.d/ install -Dm0644 %{SOURCE22} -t %{buildroot}%{_sysctldir}/ + +# Install CIS privileged-command policy and audit-log lifecycle files. +install -Dm0440 %{SOURCE26} %{buildroot}%{_sysconfdir}/sudoers.d/10-azurelinux-cis +install -Dm0644 %{SOURCE27} %{buildroot}%{_prefix}/lib/tmpfiles.d/azurelinux-sudo.conf +install -Dm0644 %{SOURCE28} %{buildroot}%{_sysconfdir}/logrotate.d/azurelinux-sudo +install -Dm0644 %{SOURCE29} %{buildroot}%{_prefix}/lib/sysusers.d/azurelinux-sugroup.conf %files common %license licenses/LICENSE %{_prefix}/lib/azurelinux-release @@ -440,6 +450,10 @@ install -Dm0644 %{SOURCE22} -t %{buildroot}%{_sysctldir}/ %{_sysconfdir}/swid/swidtags.d %{_prefix}/share/dnf5/libdnf.conf.d/20-azurelinux-defaults.conf %{_sysctldir}/70-azurelinux-hardening.conf +%attr(0440,root,root) %config(noreplace) %{_sysconfdir}/sudoers.d/10-azurelinux-cis +%attr(0644,root,root) %{_prefix}/lib/tmpfiles.d/azurelinux-sudo.conf +%config(noreplace) %{_sysconfdir}/logrotate.d/azurelinux-sudo +%attr(0644,root,root) %{_prefix}/lib/sysusers.d/azurelinux-sugroup.conf %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config.d/50-permit-root-login.conf @@ -482,6 +496,9 @@ install -Dm0644 %{SOURCE22} -t %{buildroot}%{_sysctldir}/ %changelog +* Thu Aug 13 2026 Lynsey Rydberg - 4.0-25 +- Configure CIS privileged-command defaults + * Thu Aug 13 2026 Tobias Brick - 4.0-24 - Persist CIS kernel sysctl defaults (dmesg_restrict, yama.ptrace_scope, randomize_va_space) diff --git a/base/comps/azurelinux-release/azurelinux-sudo.conf b/base/comps/azurelinux-release/azurelinux-sudo.conf new file mode 100644 index 00000000000..869932274e7 --- /dev/null +++ b/base/comps/azurelinux-release/azurelinux-sudo.conf @@ -0,0 +1,2 @@ +# Create the dedicated sudo audit log before privileged commands run. +f /var/log/sudo.log 0600 root root - diff --git a/base/comps/azurelinux-release/azurelinux-sudo.logrotate b/base/comps/azurelinux-release/azurelinux-sudo.logrotate new file mode 100644 index 00000000000..8bbddaf8291 --- /dev/null +++ b/base/comps/azurelinux-release/azurelinux-sudo.logrotate @@ -0,0 +1,6 @@ +# Retention follows the image-wide defaults in /etc/logrotate.conf. +/var/log/sudo.log { + missingok + notifempty + create 0600 root root +} diff --git a/base/comps/azurelinux-release/azurelinux-sudoers.conf b/base/comps/azurelinux-release/azurelinux-sudoers.conf new file mode 100644 index 00000000000..d2e7ca3fa8a --- /dev/null +++ b/base/comps/azurelinux-release/azurelinux-sudoers.conf @@ -0,0 +1,4 @@ +# Azure Linux CIS privileged-command defaults. +# Local administrator policy may add more restrictive sudoers drop-ins. +Defaults use_pty +Defaults logfile="/var/log/sudo.log" diff --git a/base/comps/azurelinux-release/azurelinux-sugroup.conf b/base/comps/azurelinux-release/azurelinux-sugroup.conf new file mode 100644 index 00000000000..138bd43aa47 --- /dev/null +++ b/base/comps/azurelinux-release/azurelinux-sugroup.conf @@ -0,0 +1 @@ +g sugroup - diff --git a/base/comps/components.toml b/base/comps/components.toml index 78269f27e3a..362abc551f3 100644 --- a/base/comps/components.toml +++ b/base/comps/components.toml @@ -6796,7 +6796,6 @@ overlay-files = ["overlays/*.overlay.toml"] [components.utf8cpp] [components.utf8proc] [components.uthash] -[components.util-linux] [components.uuid] [components.vala] [components.valgrind] diff --git a/base/comps/util-linux/overlays/0001-restrict-su-command.overlay.toml b/base/comps/util-linux/overlays/0001-restrict-su-command.overlay.toml new file mode 100644 index 00000000000..09a5044b1ef --- /dev/null +++ b/base/comps/util-linux/overlays/0001-restrict-su-command.overlay.toml @@ -0,0 +1,11 @@ +[metadata] +category = "azl-security-compliance" +upstream-status = "inapplicable" +bugs = [{ url = "https://dev.azure.com/mariner-org/mariner/_workitems/edit/22915" }] + +[[overlays]] +description = "Restrict su to the empty CIS sugroup" +type = "file-search-replace" +file = "util-linux-su.pamd" +regex = '(?m)^#auth\s+required\s+pam_wheel\.so use_uid$' +replacement = "auth\t\trequired\tpam_wheel.so use_uid group=sugroup" diff --git a/base/comps/util-linux/util-linux.comp.toml b/base/comps/util-linux/util-linux.comp.toml new file mode 100644 index 00000000000..659e8a15e05 --- /dev/null +++ b/base/comps/util-linux/util-linux.comp.toml @@ -0,0 +1 @@ +[components.util-linux] diff --git a/locks/azurelinux-release.lock b/locks/azurelinux-release.lock index 5b2c9dee04d..8bf604865fa 100644 --- a/locks/azurelinux-release.lock +++ b/locks/azurelinux-release.lock @@ -1,3 +1,3 @@ # Managed by azldev component update. Do not edit manually. version = 1 -input-fingerprint = 'sha256:b3c0486c855a4d81ee902b70d2e1422f9f8961a9a8a619ce2abaa5daaf74203f' +input-fingerprint = 'sha256:846c596d72152f2f76e02d283d0eec84425ebc1a94b3e45261b60e8bdb98e91f' diff --git a/locks/util-linux.lock b/locks/util-linux.lock index 9e90011e44a..9957b8cee59 100644 --- a/locks/util-linux.lock +++ b/locks/util-linux.lock @@ -2,5 +2,5 @@ version = 1 import-commit = '87d3c9659eaefe4bdf07486680da92826dbf9ef0' upstream-commit = '87d3c9659eaefe4bdf07486680da92826dbf9ef0' -input-fingerprint = 'sha256:b74a178cca92b38ea6e7594dcf4fa627abcf479af1bdd80951d4d6889268adba' +input-fingerprint = 'sha256:76e5ada4b55a0c8a9a30bcb6d07aed3ec257f45227e19a678c26c2a19a8bd307' resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e' diff --git a/specs/a/azurelinux-release/azurelinux-release.spec b/specs/a/azurelinux-release/azurelinux-release.spec index 0a0ccb843f2..eb43d1b81d5 100644 --- a/specs/a/azurelinux-release/azurelinux-release.spec +++ b/specs/a/azurelinux-release/azurelinux-release.spec @@ -39,7 +39,7 @@ Summary: Azure Linux release files Name: azurelinux-release Version: 4.0 # TODO(azl): Review whether we can move back to autorelease (with conditional -p) -Release: 24%{?dist} +Release: 25%{?dist} License: MIT URL: https://aka.ms/azurelinux @@ -59,6 +59,10 @@ Source22: 70-azurelinux-hardening.conf Source23: 50-client-alive-interval.conf Source24: 50-permit-root-login.conf Source25: 10-azure-kvp.cfg +Source26: azurelinux-sudoers.conf +Source27: azurelinux-sudo.conf +Source28: azurelinux-sudo.logrotate +Source29: azurelinux-sugroup.conf BuildArch: noarch @@ -417,6 +421,12 @@ install -Dm0644 %{SOURCE16} -t %{buildroot}%{_prefix}/share/dnf5/libdnf.conf.d/ install -Dm0644 %{SOURCE22} -t %{buildroot}%{_sysctldir}/ + +# Install CIS privileged-command policy and audit-log lifecycle files. +install -Dm0440 %{SOURCE26} %{buildroot}%{_sysconfdir}/sudoers.d/10-azurelinux-cis +install -Dm0644 %{SOURCE27} %{buildroot}%{_prefix}/lib/tmpfiles.d/azurelinux-sudo.conf +install -Dm0644 %{SOURCE28} %{buildroot}%{_sysconfdir}/logrotate.d/azurelinux-sudo +install -Dm0644 %{SOURCE29} %{buildroot}%{_prefix}/lib/sysusers.d/azurelinux-sugroup.conf %files common %license licenses/LICENSE %{_prefix}/lib/azurelinux-release @@ -443,6 +453,10 @@ install -Dm0644 %{SOURCE22} -t %{buildroot}%{_sysctldir}/ %{_sysconfdir}/swid/swidtags.d %{_prefix}/share/dnf5/libdnf.conf.d/20-azurelinux-defaults.conf %{_sysctldir}/70-azurelinux-hardening.conf +%attr(0440,root,root) %config(noreplace) %{_sysconfdir}/sudoers.d/10-azurelinux-cis +%attr(0644,root,root) %{_prefix}/lib/tmpfiles.d/azurelinux-sudo.conf +%config(noreplace) %{_sysconfdir}/logrotate.d/azurelinux-sudo +%attr(0644,root,root) %{_prefix}/lib/sysusers.d/azurelinux-sugroup.conf %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config.d/50-permit-root-login.conf @@ -485,6 +499,9 @@ install -Dm0644 %{SOURCE22} -t %{buildroot}%{_sysctldir}/ %changelog +* Thu Aug 13 2026 Lynsey Rydberg - 4.0-25 +- Configure CIS privileged-command defaults + * Thu Aug 13 2026 Tobias Brick - 4.0-24 - Persist CIS kernel sysctl defaults (dmesg_restrict, yama.ptrace_scope, randomize_va_space) diff --git a/specs/a/azurelinux-release/azurelinux-sudo.conf b/specs/a/azurelinux-release/azurelinux-sudo.conf new file mode 100644 index 00000000000..869932274e7 --- /dev/null +++ b/specs/a/azurelinux-release/azurelinux-sudo.conf @@ -0,0 +1,2 @@ +# Create the dedicated sudo audit log before privileged commands run. +f /var/log/sudo.log 0600 root root - diff --git a/specs/a/azurelinux-release/azurelinux-sudo.logrotate b/specs/a/azurelinux-release/azurelinux-sudo.logrotate new file mode 100644 index 00000000000..8bbddaf8291 --- /dev/null +++ b/specs/a/azurelinux-release/azurelinux-sudo.logrotate @@ -0,0 +1,6 @@ +# Retention follows the image-wide defaults in /etc/logrotate.conf. +/var/log/sudo.log { + missingok + notifempty + create 0600 root root +} diff --git a/specs/a/azurelinux-release/azurelinux-sudoers.conf b/specs/a/azurelinux-release/azurelinux-sudoers.conf new file mode 100644 index 00000000000..d2e7ca3fa8a --- /dev/null +++ b/specs/a/azurelinux-release/azurelinux-sudoers.conf @@ -0,0 +1,4 @@ +# Azure Linux CIS privileged-command defaults. +# Local administrator policy may add more restrictive sudoers drop-ins. +Defaults use_pty +Defaults logfile="/var/log/sudo.log" diff --git a/specs/a/azurelinux-release/azurelinux-sugroup.conf b/specs/a/azurelinux-release/azurelinux-sugroup.conf new file mode 100644 index 00000000000..138bd43aa47 --- /dev/null +++ b/specs/a/azurelinux-release/azurelinux-sugroup.conf @@ -0,0 +1 @@ +g sugroup - diff --git a/specs/u/util-linux/util-linux-su.pamd b/specs/u/util-linux/util-linux-su.pamd index 030657feb99..0e271f16790 100644 --- a/specs/u/util-linux/util-linux-su.pamd +++ b/specs/u/util-linux/util-linux-su.pamd @@ -3,7 +3,7 @@ auth sufficient pam_rootok.so # Uncomment the following line to implicitly trust users in the "wheel" group. #auth sufficient pam_wheel.so trust use_uid # Uncomment the following line to require a user to be in the "wheel" group. -#auth required pam_wheel.so use_uid +auth required pam_wheel.so use_uid group=sugroup auth substack system-auth auth include postlogin account sufficient pam_succeed_if.so uid = 0 use_uid quiet diff --git a/specs/u/util-linux/util-linux.spec b/specs/u/util-linux/util-linux.spec index 459b618ac45..e1707a0669c 100644 --- a/specs/u/util-linux/util-linux.spec +++ b/specs/u/util-linux/util-linux.spec @@ -2,7 +2,7 @@ ## (rpmautospec version 0.8.3) ## RPMAUTOSPEC: autorelease, autochangelog %define autorelease(e:s:pb:n) %{?-p:0.}%{lua: - release_number = 4; + release_number = 5; base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); print(release_number + base_release_number - 1); }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} @@ -1068,6 +1068,9 @@ fi %changelog ## START: Generated by rpmautospec +* Tue Aug 11 2026 Lynsey Rydberg - 2.41.3-11 +- fix(privilege): enforce CIS privileged access controls + * Thu Apr 30 2026 Daniel McIlvaney - 2.41.3-10 - feat: introduce deterministic commit resolution via Azure Linux lock file