Verify User Who Owns /etc/sudoers File
Ensures the sudo policy file /etc/sudoers is owned by root (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/sudoers file defines which users may run commands as root via sudo. If a non-root account owns it, that user could grant themselves unrestricted sudo rights, an immediate, total privilege escalation. Setting root (UID 0) as the owner ensures exclusive privileged control of the sudo policy. (sudo itself also refuses to run if sudoers is not owned by root.)
What Pavois checks
Pavois inspects the live filesystem with the InSpec file('/etc/sudoers') resource and asserts uid == 0, guarded by only_if. Reading the real inode owner reflects the effective on-disk state, catching a chown that would let a user rewrite the sudo policy. (Note: rules under /etc/sudoers.d/ matter too and are covered by their own controls.)
only_if { file('/etc/sudoers').exist? }
describe file('/etc/sudoers') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u %n' /etc/sudoers. Expected output: root 0 /etc/sudoers. The numeric 0 confirms root ownership.
Inspect & investigate
Distributions usually ship an audit rule on this file (keys actions/privileged); inspect /var/log/audit/audit.log with grep 'key="actions"'. If absent, add auditctl -w /etc/sudoers -p wa -k actions. Every sudo invocation is logged in /var/log/auth.log / journalctl (and /var/log/secure on RHEL).
Remediation
No automated remediation is shipped for this rule. Apply it manually with chown root /etc/sudoers (run as root or via sudo); the file must remain group root and mode 0440. Always edit sudoers with visudo, which validates syntax before saving.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/sudoers |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner of /etc/sudoers is a total privilege-escalation vector. Risk of applying: very low, root ownership is mandatory for sudo to function, so restoring it can only help. Precaution: if sudo is your only path to root and the file is currently broken, recover via a root shell or single-user mode; keep mode 0440 and validate with visudo -c afterward.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.