Ensure sudo Ignores Commands In Current Dir - sudo ignore_dot
Enable the Defaults ignore_dot option so sudo ignores any . (current directory) entry in PATH when resolving the command to run.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
If . is part of PATH, an attacker who can write to a directory a user operates in could drop a malicious binary named like a common command. When the user runs it via sudo, the planted binary executes with root privileges. ignore_dot removes the current directory from the search path, preventing this trivially exploitable privilege-escalation path.
What Pavois checks
Pavois greps the active sudoers tree, /etc/sudoers and every file under /etc/sudoers.d/, for an uncommented Defaults ... ignore_dot. Since sudo merges its policy from the main file plus all drop-ins, scanning the whole tree reflects the effective policy rather than a single file that a later drop-in could override.
describe command('grep -rqE \'^[^#]*Defaults[^#]*\bignore_dot\b\' /etc/sudoers /etc/sudoers.d/ 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run sudo grep -rE '^[^#]*Defaults.*ignore_dot' /etc/sudoers /etc/sudoers.d/. A matching, uncommented line confirms the option is active (and not negated by !ignore_dot).
Inspect & investigate
sudo invocations are logged to /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL), and via journalctl -t sudo. The logged absolute command path lets you confirm sudo resolved the intended system binary rather than one from the current directory.
Remediation
Pavois's harden plan writes a file resource at /etc/sudoers.d/99-Pavois-ignore_dot containing Defaults ignore_dot, owned root:root with mode 0440, and validates it with visudo -cf before it takes effect. Apply it with pavois harden apply. The dedicated drop-in keeps the change isolated and reversible.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| content | Defaults ignore_dot |
|---|---|
| group | root |
| mode | 0440 |
| owner | root |
| path | /etc/sudoers.d/99-pavois-ignore_dot |
| resource | file |
| verify | visudo -cf %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
ignore_dot rarely breaks anything, because relying on . in PATH for sudo is itself bad practice. The only affected workflows are ones that deliberately run a binary from the current directory via sudo, those should call it by absolute path (sudo ./tool) instead. The drop-in is validated by visudo before activation, so a syntax error cannot corrupt sudoers or lock you out.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R39 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.