Handle Ubuntu 26.04 sudo-rs logging

Author: realstuffie

components/sudo.yml

@@ -19,6 +19,7 @@ rules:
 - sudo_add_umask
 - sudo_add_use_pty
 - sudo_custom_logfile
+- sudo_logging_ubuntu2604
 - sudo_dedicated_group
 - sudo_remove_no_authenticate
 - sudo_remove_nopasswd

linux_os/guide/system/software/sudo/sudo_logging_ubuntu2604/ansible/shared.yml

@@ -0,0 +1,16 @@
+# platform = Ubuntu 26.04
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+- name: Install rsyslog for sudo event logging
+  ansible.builtin.package:
+    name: rsyslog
+    state: present
+
+- name: Enable rsyslog for sudo event logging
+  ansible.builtin.systemd_service:
+    name: rsyslog.service
+    enabled: true
+    state: started

linux_os/guide/system/software/sudo/sudo_logging_ubuntu2604/bash/shared.sh

@@ -0,0 +1,9 @@
+# platform = Ubuntu 26.04
+# reboot = false
+# strategy = restrict
+# complexity = low
+# disruption = low
+
+{{{ bash_package_install("rsyslog") }}}
+
+systemctl enable --now rsyslog.service

linux_os/guide/system/software/sudo/sudo_logging_ubuntu2604/rule.yml

@@ -0,0 +1,23 @@
+documentation_complete: true
+
+title: 'Ensure Sudo Events Are Logged'
+
+description: |-
+    Sudo events must be captured in a durable log. <tt>sudo-rs</tt> sends
+    events to the <tt>authpriv</tt> syslog facility and does not support the
+    classic sudo <tt>Defaults logfile=</tt> option.
+
+rationale: |-
+    A durable record of privilege escalation supports auditing and incident
+    investigation.
+
+severity: low
+
+platform: package[sudo]
+
+ocil_clause: 'sudo events are not present in the journal or a persistent log'
+
+ocil: |-
+    Run <tt>journalctl -t sudo -t sudo-rs</tt> and inspect
+    <tt>/var/log/auth.log</tt>. At least one location must contain sudo events.
+    Classic sudo may instead use a valid <tt>Defaults logfile=</tt> setting.

linux_os/guide/system/software/sudo/sudo_logging_ubuntu2604/sce/shared.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# platform = Ubuntu 26.04
+# check-import = stdout
+
+if journalctl -q -t sudo -t sudo-rs --since=-5min --no-pager 2>/dev/null |
+    grep -q '[^[:space:]]'; then
+    exit "$XCCDF_RESULT_PASS"
+fi
+
+if grep -Eq '\b(sudo|sudo-rs)\[[0-9]+\]:' /var/log/auth.log 2>/dev/null; then
+    exit "$XCCDF_RESULT_PASS"
+fi
+
+if ! dpkg-query --show --showformat='${db:Status-Status}' sudo-rs 2>/dev/null |
+    grep -qx installed; then
+    if grep -rPsiq \
+        '^\h*Defaults\h+([^#]+,\h*)?logfile\h*=\h*("|'"'"')?\H+("|'"'"')?(,\h*\H+\h*)*\h*(#.*)?$' \
+        /etc/sudoers /etc/sudoers.d 2>/dev/null; then
+        exit "$XCCDF_RESULT_PASS"
+    fi
+fi
+
+echo 'No sudo event was found in the journal or /var/log/auth.log.'
+exit "$XCCDF_RESULT_FAIL"

products/ubuntu2604/controls/cis_ubuntu2604.yml

@@ -1598,7 +1598,7 @@ controls:
           - l1_server
           - l1_workstation
       rules:
-          - sudo_custom_logfile
+          - sudo_logging_ubuntu2604
       status: automated
     - id: 5.2.5
       title: Ensure users must provide a password for privilege escalation (Automated)