Verify Permissions On /etc/sudoers File
Ensures /etc/sudoers is not writable, executable or readable beyond the root owner, so the sudo privilege policy cannot be tampered with or disclosed.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Setting correct permissions on the /etc/sudoers file is important because this file defines which users can run commands as root via sudo. If the file is writable by a non-privileged user, that user could grant themselves unrestricted sudo access and obtain full root privileges. If it is world-readable beyond what is required, the privilege map of the system is exposed, helping an attacker target accounts. Restricting permissions to owner read/write only (no write or execute for group/other, no read for other) ensures exclusive control of the sudo policy.
What Pavois checks
Pavois inspects the effective metadata of /etc/sudoers and asserts that the group and other classes have no write/execute bits, no read bit for other, and that no setuid/setgid/sticky bits are set. The control is guarded by only_if { file('/etc/sudoers').exist? } so it is skipped where the file is absent. Reading the live inode (mode, ownership) reflects the state the kernel actually enforces at sudo invocation, including any drift introduced after install.
only_if { file('/etc/sudoers').exist? }
describe file('/etc/sudoers') do
it { should_not be_executable.by('owner') }
it { should_not be_writable.by('owner') }
it { should_not be_setuid }
it { should_not be_executable.by('group') }
it { should_not be_writable.by('group') }
it { should_not be_setgid }
it { should_not be_executable.by('other') }
it { should_not be_writable.by('other') }
it { should_not be_readable.by('other') }
it { should_not be_sticky }
endHow to verify it is applied
Run stat -c '%a %U %G' /etc/sudoers. The expected output is 440 root root (or a more restrictive mode such as 400/640); no write bit for group or other, no read bit for other. You can also run visudo -c to confirm the file is syntactically valid.
Inspect & investigate
Use the filesystem state and audit trail: stat /etc/sudoers shows the current mode. If the audit subsystem watches it, changes appear in /var/log/audit/audit.log (grep for name="/etc/sudoers"). Every privileged command run through sudo is logged to /var/log/auth.log (Debian/Ubuntu) or journalctl -t sudo (RHEL family).
Remediation
No automated harden plan is defined for this rule yet, so it must be applied manually: run chown root:root /etc/sudoers then chmod 0440 /etc/sudoers. Validate the result with visudo -c before relying on it.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| mode | 0440 |
|---|---|
| path | /etc/sudoers |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If /etc/sudoers is writable or executable by group/other, any local user able to edit it can escalate to root, fully compromising the host; an overly readable file leaks the privilege map. Precautions: do not edit /etc/sudoers with a plain editor, always use visudo, which validates syntax and prevents you from saving a broken file that would lock everyone out of sudo. Tightening to 0440 root:root is safe and matches the package default; the only real risk is a malformed edit, mitigated by visudo -c.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.