Amazon Linux 2023 CIS 4.3.4 (re-authentication not disabled globally) is mapped to sudo_require_reauthentication instead of sudo_remove_no_authenticate #15152

Description of problem:

Found while comparing CIS results on Amazon Linux 2023 images.

• Product: al2023
• Profiles: cis_server_l1, cis; control 4.3.4 "Ensure re-authentication for privilege escalation is not disabled globally"
• Selected rule: sudo_require_reauthentication; expected: sudo_remove_no_authenticate

controls/cis_al2023.yml selects sudo_require_reauthentication for both 4.3.4 and 4.3.5 "Ensure sudo authentication timeout is configured correctly" (L1280-L1294 at v0.1.82, same on master). That rule checks timestamp_timeout: exactly one non-negative Defaults timestamp_timeout= in /etc/sudoers or /etc/sudoers.d/, and no negative one (oval/shared.xml L16-L35). It does not look at !authenticate, which is what 4.3.4 is about.

Of the other CIS control files with a control of this title, eight select sudo_remove_no_authenticate (lines at v0.1.82):
rhel8 L1937,
rhel9 L1758,
rhel10 L1863,
fedora L1925,
ubuntu2204 L1746,
ubuntu2404 L1824,
debian12 L1799,
debian13 L1927.
#14067 moved RHEL 10's 5.2.5 to this rule, on the grounds that the requirement is only about removing !authenticate.

The one exception is controls/cis_almalinux9.yml, which has the same mapping as al2023 for 5.2.5 (L1732-L1739, same on master); I did not test AlmaLinux. (products/hummingbird/controls/cis_hummingbird.yml marks the control not applicable.)

Because no al2023 profile selects sudo_remove_no_authenticate, the build leaves it out of the al2023 data stream (rules no profile selects are dropped, ssg/build_yaml.py L608-L620). ssg-al2023-ds.xml 0.1.82 contains neither sudo_remove_no_authenticate nor sudo_require_authentication, so Defaults !authenticate is not checked by the al2023 CIS profiles at all.

The effect on 4.3.4:

• Defaults !authenticate in a sudoers file passes 4.3.4, as long as timestamp_timeout is set.
• A system without timestamp_timeout fails 4.3.4 even though re-authentication is not disabled; 4.3.4 only repeats 4.3.5.

SCAP Security Guide Version:

0.1.82 (release data stream ssg-al2023-ds.xml from scap-security-guide-0.1.82.zip). The control entries and both rules are unchanged on master at f956856.

Operating System Version:

Amazon Linux 2023: amazonlinux:2023@sha256:74c545e3e04db388b00bd31d7cc5640d4e9c12058a6d72af938d113da3c82893 (linux/amd64), system-release 2023.12.20260831-0.amzn2023. OpenSCAP 1.4.4, oscap-chroot.

Steps to Reproduce:

The image's root filesystem (docker export of a container that was never started) is evaluated offline. /.dockerenv is removed, and empty noarch packages named kernel and sudo are registered in its rpm database (rpm --root root --dbpath /var/lib/rpm --justdb --nodeps --noscripts --notriggers --install ...), so that the system_with_kernel and package[sudo] platforms apply.

1. Create root/etc/sudoers:

   Defaults timestamp_timeout=15
   root ALL=(ALL) ALL
   %wheel ALL=(ALL) ALL
   @includedir /etc/sudoers.d
   

   and root/etc/sudoers.d/90-noauth:

   Defaults !authenticate
   

2. Evaluate:

   sudo oscap-chroot root xccdf eval \
     --profile xccdf_org.ssgproject.content_profile_cis_server_l1 \
     --rule xccdf_org.ssgproject.content_rule_sudo_require_reauthentication \
     scap-security-guide-0.1.82/ssg-al2023-ds.xml
   

3. Remove the timestamp_timeout line and 90-noauth, and evaluate again.

Actual Results:

Step 2 (re-authentication disabled for everyone):

Rule    xccdf_org.ssgproject.content_rule_sudo_require_reauthentication   Result  pass

Step 3 (re-authentication not disabled, no timestamp_timeout):

Rule    xccdf_org.ssgproject.content_rule_sudo_require_reauthentication   Result  fail

The rule's CIS references in the data stream are 4.3.4 and 4.3.5.

Expected Results:

4.3.4 fails when !authenticate is present in /etc/sudoers or /etc/sudoers.d/ and passes when it is absent, whatever timestamp_timeout is. 4.3.5 stays with sudo_require_reauthentication.

Additional Information/Debugging Steps:

Suggested fix, as #14067 did for RHEL 10:

--- a/controls/cis_al2023.yml
+++ b/controls/cis_al2023.yml
@@ -1283,7 +1283,7 @@
           - l1_server
       status: automated
       rules:
-          - sudo_require_reauthentication
+          - sudo_remove_no_authenticate
 
     - id: 4.3.5
       title: Ensure sudo authentication timeout is configured correctly (Automated)

I built al2023 from master (f956856) with this change (the build also carried unrelated banner changes) and evaluated the same image. sudo_remove_no_authenticate is now in the data stream with the 4.3.4 reference, and sudo_require_reauthentication keeps only 4.3.5. Results with the release data stream and with the patched one:

oscap ds sds-validate accepts the patched data stream.

The same one-line change would apply to controls/cis_almalinux9.yml 5.2.5 (not tested).