Ubuntu 24.04: Implement rule 5.3.3.4.2 Ensure pam_unix does not include remember #12780
Conversation
|
Hi @alanmcanonical. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Start a new ephemeral environment with changes proposed in this pull request: ubuntu2404 (from CTF) Environment (using Fedora as testing environment) Fedora Testing Environment Oracle Linux 8 Environment |
dodys
added
Ubuntu
| } | ||
| }' "$config_file" | ||
|
|
||
| {{{ bash_remove_pam_module_option('/etc/pam.d/common-auth', 'auth', '', 'pam_unix.so', 'remember') }}} |
There was a problem hiding this comment.
Why are these files being modified directly?
There was a problem hiding this comment.
Removed manual modification
| </ind:textfilecontent54_test> | ||
| <ind:textfilecontent54_object id="object_pam_unix_no_remember" version="1"> | ||
| <ind:filepath operation="pattern match">^/etc/pam.d/common-(password|auth|account|session|session-noninteractive)$</ind:filepath> | ||
| <ind:pattern operation="pattern match">^[^#]*\bremember=\d+\b.*$</ind:pattern> |
There was a problem hiding this comment.
I think only the pam_unix.so lines should be checked for matches, or?
There was a problem hiding this comment.
Done, nice catch
|
Code Climate has analyzed commit 5c14e87 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 61.6% (0.0% change). View more on Code Climate. |
alanmcanonical
force-pushed
the
ubt24_53342
branch
from
5c14e87 to
869381f
Compare
Description:
Rationale: