Skip to content

fix(privilege): enforce CIS privileged access controls #18439

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Christopher Co (christopherco) merged 1 commit into from
Aug 15, 2026
Merged

fix(privilege): enforce CIS privileged access controls #18439

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 18 additions & 1 deletion base/comps/azurelinux-release/azurelinux-release.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ Summary: Azure Linux release files
Name: azurelinux-release
Version: 4.0
# TODO(azl): Review whether we can move back to autorelease (with conditional -p)
Release: 24%{?dist}
Release: 25%{?dist}
License: MIT
URL: https://aka.ms/azurelinux

Expand All @@ -56,6 +56,10 @@ Source22: 70-azurelinux-hardening.conf
Source23: 50-client-alive-interval.conf
Source24: 50-permit-root-login.conf
Source25: 10-azure-kvp.cfg
Source26: azurelinux-sudoers.conf
Source27: azurelinux-sudo.conf
Source28: azurelinux-sudo.logrotate
Source29: azurelinux-sugroup.conf

BuildArch: noarch

Expand Down Expand Up @@ -414,6 +418,12 @@ install -Dm0644 %{SOURCE16} -t %{buildroot}%{_prefix}/share/dnf5/libdnf.conf.d/
install -Dm0644 %{SOURCE22} -t %{buildroot}%{_sysctldir}/



# Install CIS privileged-command policy and audit-log lifecycle files.
install -Dm0440 %{SOURCE26} %{buildroot}%{_sysconfdir}/sudoers.d/10-azurelinux-cis
install -Dm0644 %{SOURCE27} %{buildroot}%{_prefix}/lib/tmpfiles.d/azurelinux-sudo.conf
install -Dm0644 %{SOURCE28} %{buildroot}%{_sysconfdir}/logrotate.d/azurelinux-sudo
install -Dm0644 %{SOURCE29} %{buildroot}%{_prefix}/lib/sysusers.d/azurelinux-sugroup.conf
%files common
%license licenses/LICENSE
%{_prefix}/lib/azurelinux-release
Expand All @@ -440,6 +450,10 @@ install -Dm0644 %{SOURCE22} -t %{buildroot}%{_sysctldir}/
%{_sysconfdir}/swid/swidtags.d
%{_prefix}/share/dnf5/libdnf.conf.d/20-azurelinux-defaults.conf
%{_sysctldir}/70-azurelinux-hardening.conf
%attr(0440,root,root) %config(noreplace) %{_sysconfdir}/sudoers.d/10-azurelinux-cis
%attr(0644,root,root) %{_prefix}/lib/tmpfiles.d/azurelinux-sudo.conf
%config(noreplace) %{_sysconfdir}/logrotate.d/azurelinux-sudo
%attr(0644,root,root) %{_prefix}/lib/sysusers.d/azurelinux-sugroup.conf
%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config.d/50-permit-root-login.conf


Expand Down Expand Up @@ -482,6 +496,9 @@ install -Dm0644 %{SOURCE22} -t %{buildroot}%{_sysctldir}/


%changelog
* Thu Aug 13 2026 Lynsey Rydberg <lyrydber@microsoft.com> - 4.0-25
- Configure CIS privileged-command defaults

* Thu Aug 13 2026 Tobias Brick <tobiasb@microsoft.com> - 4.0-24
- Persist CIS kernel sysctl defaults (dmesg_restrict, yama.ptrace_scope, randomize_va_space)

Expand Down
2 changes: 2 additions & 0 deletions base/comps/azurelinux-release/azurelinux-sudo.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# Create the dedicated sudo audit log before privileged commands run.
f /var/log/sudo.log 0600 root root -
6 changes: 6 additions & 0 deletions base/comps/azurelinux-release/azurelinux-sudo.logrotate
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
# Retention follows the image-wide defaults in /etc/logrotate.conf.
/var/log/sudo.log {
missingok
notifempty
create 0600 root root
}
4 changes: 4 additions & 0 deletions base/comps/azurelinux-release/azurelinux-sudoers.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
# Azure Linux CIS privileged-command defaults.
# Local administrator policy may add more restrictive sudoers drop-ins.
Defaults use_pty
Defaults logfile="/var/log/sudo.log"
1 change: 1 addition & 0 deletions base/comps/azurelinux-release/azurelinux-sugroup.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
g sugroup -
1 change: 0 additions & 1 deletion base/comps/components.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6796,7 +6796,6 @@ overlay-files = ["overlays/*.overlay.toml"]
[components.utf8cpp]
[components.utf8proc]
[components.uthash]
[components.util-linux]
[components.uuid]
[components.vala]
[components.valgrind]
Expand Down
11 changes: 11 additions & 0 deletions base/comps/util-linux/overlays/0001-restrict-su-command.overlay.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
[metadata]
category = "azl-security-compliance"
upstream-status = "inapplicable"
bugs = [{ url = "https://dev.azure.com/mariner-org/mariner/_workitems/edit/22915" }]

[[overlays]]
description = "Restrict su to the empty CIS sugroup"
type = "file-search-replace"
file = "util-linux-su.pamd"
regex = '(?m)^#auth\s+required\s+pam_wheel\.so use_uid$'
replacement = "auth\t\trequired\tpam_wheel.so use_uid group=sugroup"
Comment thread
corvus-callidus marked this conversation as resolved.
1 change: 1 addition & 0 deletions base/comps/util-linux/util-linux.comp.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
[components.util-linux]
2 changes: 1 addition & 1 deletion locks/azurelinux-release.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
# Managed by azldev component update. Do not edit manually.
version = 1
input-fingerprint = 'sha256:b3c0486c855a4d81ee902b70d2e1422f9f8961a9a8a619ce2abaa5daaf74203f'
input-fingerprint = 'sha256:846c596d72152f2f76e02d283d0eec84425ebc1a94b3e45261b60e8bdb98e91f'
2 changes: 1 addition & 1 deletion locks/util-linux.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,5 +2,5 @@
version = 1
import-commit = '87d3c9659eaefe4bdf07486680da92826dbf9ef0'
upstream-commit = '87d3c9659eaefe4bdf07486680da92826dbf9ef0'
input-fingerprint = 'sha256:b74a178cca92b38ea6e7594dcf4fa627abcf479af1bdd80951d4d6889268adba'
input-fingerprint = 'sha256:76e5ada4b55a0c8a9a30bcb6d07aed3ec257f45227e19a678c26c2a19a8bd307'
resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'
19 changes: 18 additions & 1 deletion specs/a/azurelinux-release/azurelinux-release.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ Summary: Azure Linux release files
Name: azurelinux-release
Version: 4.0
# TODO(azl): Review whether we can move back to autorelease (with conditional -p)
Release: 24%{?dist}
Release: 25%{?dist}
License: MIT
URL: https://aka.ms/azurelinux

Expand All @@ -59,6 +59,10 @@ Source22: 70-azurelinux-hardening.conf
Source23: 50-client-alive-interval.conf
Source24: 50-permit-root-login.conf
Source25: 10-azure-kvp.cfg
Source26: azurelinux-sudoers.conf
Source27: azurelinux-sudo.conf
Source28: azurelinux-sudo.logrotate
Source29: azurelinux-sugroup.conf

BuildArch: noarch

Expand Down Expand Up @@ -417,6 +421,12 @@ install -Dm0644 %{SOURCE16} -t %{buildroot}%{_prefix}/share/dnf5/libdnf.conf.d/
install -Dm0644 %{SOURCE22} -t %{buildroot}%{_sysctldir}/



# Install CIS privileged-command policy and audit-log lifecycle files.
install -Dm0440 %{SOURCE26} %{buildroot}%{_sysconfdir}/sudoers.d/10-azurelinux-cis
install -Dm0644 %{SOURCE27} %{buildroot}%{_prefix}/lib/tmpfiles.d/azurelinux-sudo.conf
install -Dm0644 %{SOURCE28} %{buildroot}%{_sysconfdir}/logrotate.d/azurelinux-sudo
install -Dm0644 %{SOURCE29} %{buildroot}%{_prefix}/lib/sysusers.d/azurelinux-sugroup.conf
%files common
%license licenses/LICENSE
%{_prefix}/lib/azurelinux-release
Expand All @@ -443,6 +453,10 @@ install -Dm0644 %{SOURCE22} -t %{buildroot}%{_sysctldir}/
%{_sysconfdir}/swid/swidtags.d
%{_prefix}/share/dnf5/libdnf.conf.d/20-azurelinux-defaults.conf
%{_sysctldir}/70-azurelinux-hardening.conf
%attr(0440,root,root) %config(noreplace) %{_sysconfdir}/sudoers.d/10-azurelinux-cis
%attr(0644,root,root) %{_prefix}/lib/tmpfiles.d/azurelinux-sudo.conf
%config(noreplace) %{_sysconfdir}/logrotate.d/azurelinux-sudo
%attr(0644,root,root) %{_prefix}/lib/sysusers.d/azurelinux-sugroup.conf
%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config.d/50-permit-root-login.conf


Expand Down Expand Up @@ -485,6 +499,9 @@ install -Dm0644 %{SOURCE22} -t %{buildroot}%{_sysctldir}/


%changelog
* Thu Aug 13 2026 Lynsey Rydberg <lyrydber@microsoft.com> - 4.0-25
- Configure CIS privileged-command defaults

* Thu Aug 13 2026 Tobias Brick <tobiasb@microsoft.com> - 4.0-24
- Persist CIS kernel sysctl defaults (dmesg_restrict, yama.ptrace_scope, randomize_va_space)

Expand Down
2 changes: 2 additions & 0 deletions specs/a/azurelinux-release/azurelinux-sudo.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
# Create the dedicated sudo audit log before privileged commands run.
f /var/log/sudo.log 0600 root root -
6 changes: 6 additions & 0 deletions specs/a/azurelinux-release/azurelinux-sudo.logrotate
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
# Retention follows the image-wide defaults in /etc/logrotate.conf.
/var/log/sudo.log {
missingok
notifempty
create 0600 root root
}
4 changes: 4 additions & 0 deletions specs/a/azurelinux-release/azurelinux-sudoers.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
# Azure Linux CIS privileged-command defaults.
# Local administrator policy may add more restrictive sudoers drop-ins.
Defaults use_pty
Defaults logfile="/var/log/sudo.log"
1 change: 1 addition & 0 deletions specs/a/azurelinux-release/azurelinux-sugroup.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
g sugroup -
2 changes: 1 addition & 1 deletion specs/u/util-linux/util-linux-su.pamd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ auth sufficient pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth sufficient pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth required pam_wheel.so use_uid
auth required pam_wheel.so use_uid group=sugroup
auth substack system-auth
auth include postlogin
account sufficient pam_succeed_if.so uid = 0 use_uid quiet
Expand Down
5 changes: 4 additions & 1 deletion specs/u/util-linux/util-linux.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
## (rpmautospec version 0.8.3)
## RPMAUTOSPEC: autorelease, autochangelog
%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
release_number = 4;
release_number = 5;
base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
print(release_number + base_release_number - 1);
}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
Expand Down Expand Up @@ -1068,6 +1068,9 @@ fi

%changelog
## START: Generated by rpmautospec
* Tue Aug 11 2026 Lynsey Rydberg <lyrydber@microsoft.com> - 2.41.3-11
- fix(privilege): enforce CIS privileged access controls

* Thu Apr 30 2026 Daniel McIlvaney <damcilva@microsoft.com> - 2.41.3-10
- feat: introduce deterministic commit resolution via Azure Linux lock file

Expand Down
Loading