From 7e564ab00c07d31012bb2cede57b0c7f3cd28c76 Mon Sep 17 00:00:00 2001
From: yarunachalam <yarunachalam@suse.com>
Date: Thu, 22 Apr 2021 18:58:28 +0000
Subject: [PATCH 1/6] Add Rule,Test for SLES-15-020103

Rule has no remediation.
---
 .../sudoers_validate_passwd/oval/shared.xml   | 44 ++++++++++++++++++
 .../sudo/sudoers_validate_passwd/rule.yml     | 45 +++++++++++++++++++
 .../tests/sudoers_validate_passwd_fail.sh     |  7 +++
 .../tests/sudoers_validate_passwd_pass.sh     |  6 +++
 .../tests/sudoers_validate_rootpw_fail.sh     |  7 +++
 .../tests/sudoers_validate_runaspw_fail.sh    |  7 +++
 .../tests/sudoers_validate_targetpw_fail.sh   |  7 +++
 8 files changed, 125 insertions(+)
 create mode 100644 linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
 create mode 100644 linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
 create mode 100644 linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_fail.sh
 create mode 100644 linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_pass.sh
 create mode 100644 linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw_fail.sh
 create mode 100644 linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw_fail.sh
 create mode 100644 linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw_fail.sh

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
new file mode 100644
index 00000000000..3f33b82b520
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
@@ -0,0 +1,44 @@
+<def-group>
+  <definition class="compliance" id="sudoers_validate_passwd" version="1">
+   {{{ oval_metadata("Ensure invoking user's password for privilege escalation when using sudo") }}}
+      <criteria operator="AND">
+      <criterion comment="Check Defaults !targetpw exists in /etc/sudoers file" test_ref="test_sudoers_targetpw_config" />
+      <criterion comment="Check Defaults !rootpw exists in /etc/sudoers file" test_ref="test_sudoers_rootpw_config" />
+      <criterion comment="Check Defaults !runaspw exists in /etc/sudoers file" test_ref="test_sudoers_runaspw_config" />
+      </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure invoking user's password for privilege escalation when using sudo"
+  id="test_sudoers_targetpw_config" version="1">
+    <ind:object object_ref="object_test_sudoers_targetpw_config" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure invoking user's password for privilege escalation when using sudo"
+  id="test_sudoers_rootpw_config" version="1">
+    <ind:object object_ref="object_test_sudoers_rootpw_config" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure invoking user's password for privilege escalation when using sudo"
+  id="test_sudoers_runaspw_config" version="1">
+    <ind:object object_ref="object_test_sudoers_runaspw_config" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_test_sudoers_targetpw_config" version="1">
+    <ind:filepath>/etc/sudoers</ind:filepath>
+    <ind:pattern operation="pattern match">^Defaults !targetpw$\r?\n</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_object id="object_test_sudoers_rootpw_config" version="1">
+    <ind:filepath>/etc/sudoers</ind:filepath>
+    <ind:pattern operation="pattern match">^Defaults !rootpw$\r?\n</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_object id="object_test_sudoers_runaspw_config" version="1">
+    <ind:filepath>/etc/sudoers</ind:filepath>
+    <ind:pattern operation="pattern match">^Defaults !runaspw$\r?\n</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
new file mode 100644
index 00000000000..cf564c6b533
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
@@ -0,0 +1,45 @@
+documentation_complete: true
+
+title: 'Ensure invoking users password for privilege escalation when using sudo'
+
+prodtype: sle15
+
+description: |-
+    The sudoers security policy requires that users authenticate themselves before they can use sudo.
+    When sudoers requires authentication, it validates the invoking user's credentials.
+severity: medium
+
+rationale: |-
+    If the rootpw, targetpw, or runaspw flags are defined and not disabled, by default the operating system will prompt
+    the invoking user for the "root" user password.
+
+identifiers:
+    cce@sle15: CCE-85747-4
+
+references:
+    disa@sle15: CCI-000366
+    nist@sle15: CM-6(b),CM-6.1(iv)
+    srg: SRG-OS-000480-GPOS-00227
+    stigid@sle15: SLES-15-020103
+
+ocil_clause: 'invoke user passwd when using sudo'
+
+ocil: |-
+    To Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation.
+
+    <pre> sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'</pre>
+
+    <pre> /etc/sudoers:Defaults !targetpw
+          /etc/sudoers:Defaults !rootpw
+          /etc/sudoers:Defaults !runaspw </pre>
+
+    If no results are returned, this is a finding
+    If "Defaults !targetpw" is not defined, this is a finding.
+    If "Defaults !rootpw" is not defined, this is a finding.
+    If "Defaults !runaspw" is not defined, this is a finding.
+
+    Fix Text: Define the following in the Defaults section of the /etc/sudoers file or a configuration file in the /etc/sudoers.d/ directory:
+
+    Defaults !targetpw
+    Defaults !rootpw
+    Defaults !runaspw
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_fail.sh
new file mode 100644
index 00000000000..d8b33a0ac52
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_fail.sh
@@ -0,0 +1,7 @@
+# platform = SUSE Linux Enterprise 15
+# packages = sudo
+
+if [ $(sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' | wc -l) -ne 0 ]
+then
+     sed -i '/Defaults !targetpw/{:a;N;/Defaults !runaspw/!ba};/Defaults !rootpw/d' /etc/sudoers
+fi
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_pass.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_pass.sh
new file mode 100644
index 00000000000..f2461085f99
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_pass.sh
@@ -0,0 +1,6 @@
+# platform = SUSE Linux Enterprise 15
+# packages = sudo
+
+echo 'Defaults !targetpw' >> /etc/sudoers
+echo 'Defaults !rootpw' >> /etc/sudoers
+echo 'Defaults !runaspw' >> /etc/sudoers
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw_fail.sh
new file mode 100644
index 00000000000..9a8f51450cd
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw_fail.sh
@@ -0,0 +1,7 @@
+# platform = SUSE Linux Enterprise 15
+# packages = sudo
+
+if [ $(sudo egrep -i '(!rootpw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' | wc -l) -ne 0 ]
+then
+     sed -i '/Defaults !rootpw/d' /etc/sudoers
+fi
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw_fail.sh
new file mode 100644
index 00000000000..a455aa14968
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw_fail.sh
@@ -0,0 +1,7 @@
+# platform = SUSE Linux Enterprise 15
+# packages = sudo
+
+if [ $(sudo egrep -i '(!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' | wc -l) -ne 0 ]
+then
+     sed -i '/Defaults !runaspw/d' /etc/sudoers
+fi
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw_fail.sh
new file mode 100644
index 00000000000..1b18a8f3dc5
--- /dev/null
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw_fail.sh
@@ -0,0 +1,7 @@
+# platform = SUSE Linux Enterprise 15
+# packages = sudo
+
+if [ $(sudo egrep -i '(!targetpw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' | wc -l) -ne 0 ]
+then
+     sed -i '/Defaults !targetpw/d' /etc/sudoers
+fi


From d691e2d0183c0254e0d2a095853db373247691ef Mon Sep 17 00:00:00 2001
From: yarunachalam <40246855+yarunachalam@users.noreply.github.com>
Date: Fri, 23 Apr 2021 17:09:38 +0000
Subject: [PATCH 2/6] Update
 linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml

Co-authored-by: vojtapolasek <krecoun@gmail.com>
---
 .../guide/system/software/sudo/sudoers_validate_passwd/rule.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
index cf564c6b533..2ac2153d546 100644
--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
@@ -25,7 +25,7 @@ references:
 ocil_clause: 'invoke user passwd when using sudo'
 
 ocil: |-
-    To Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation.
+    Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalatiob:
 
     <pre> sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'</pre>
 

From eb314afa0554ae9badd47bc218f79e6f276fdc79 Mon Sep 17 00:00:00 2001
From: yarunachalam <40246855+yarunachalam@users.noreply.github.com>
Date: Fri, 23 Apr 2021 17:20:57 +0000
Subject: [PATCH 3/6] Apply suggestions from code review

Co-authored-by: vojtapolasek <krecoun@gmail.com>
---
 .../software/sudo/sudoers_validate_passwd/oval/shared.xml     | 4 ++--
 .../system/software/sudo/sudoers_validate_passwd/rule.yml     | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
index 3f33b82b520..1c3a83523c6 100644
--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
@@ -30,13 +30,13 @@
   </ind:textfilecontent54_object>
 
   <ind:textfilecontent54_object id="object_test_sudoers_rootpw_config" version="1">
-    <ind:filepath>/etc/sudoers</ind:filepath>
+    <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
     <ind:pattern operation="pattern match">^Defaults !rootpw$\r?\n</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
   <ind:textfilecontent54_object id="object_test_sudoers_runaspw_config" version="1">
-    <ind:filepath>/etc/sudoers</ind:filepath>
+    <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
     <ind:pattern operation="pattern match">^Defaults !runaspw$\r?\n</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
index 2ac2153d546..e420e5aa151 100644
--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
@@ -28,7 +28,7 @@ ocil: |-
     Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalatiob:
 
     <pre> sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'</pre>
-
+The expected output is:
     <pre> /etc/sudoers:Defaults !targetpw
           /etc/sudoers:Defaults !rootpw
           /etc/sudoers:Defaults !runaspw </pre>

From 8b4ae0c13a4992db2e908e1380b81b4d6cbacee1 Mon Sep 17 00:00:00 2001
From: yarunachalam <yarunachalam@suse.com>
Date: Fri, 23 Apr 2021 18:27:03 +0000
Subject: [PATCH 4/6] Updated review comments:

- Fixed disa record and removed blank line.
- Renamed test case file name according the to the format
- Removed susefirewall2_only_required_services stig from sle15 profile
---
 .../software/sudo/sudoers_validate_passwd/rule.yml | 14 ++++++--------
 ...swd_fail.sh => sudoers_validate_passwd.fail.sh} |  0
 ...swd_pass.sh => sudoers_validate_passwd.pass.sh} |  0
 ...tpw_fail.sh => sudoers_validate_rootpw.fail.sh} |  0
 ...pw_fail.sh => sudoers_validate_runaspw.fail.sh} |  0
 ...w_fail.sh => sudoers_validate_targetpw.fail.sh} |  0
 7 files changed, 6 insertions(+), 9 deletions(-)
 rename linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/{sudoers_validate_passwd_fail.sh => sudoers_validate_passwd.fail.sh} (100%)
 rename linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/{sudoers_validate_passwd_pass.sh => sudoers_validate_passwd.pass.sh} (100%)
 rename linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/{sudoers_validate_rootpw_fail.sh => sudoers_validate_rootpw.fail.sh} (100%)
 rename linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/{sudoers_validate_runaspw_fail.sh => sudoers_validate_runaspw.fail.sh} (100%)
 rename linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/{sudoers_validate_targetpw_fail.sh => sudoers_validate_targetpw.fail.sh} (100%)

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
index e420e5aa151..db636bc59a2 100644
--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
@@ -7,6 +7,11 @@ prodtype: sle15
 description: |-
     The sudoers security policy requires that users authenticate themselves before they can use sudo.
     When sudoers requires authentication, it validates the invoking user's credentials.
+    Fix Text: Define the following in the Defaults section of the /etc/sudoers file or a configuration file in the /etc/sudoers.d/ directory:
+    Defaults !targetpw
+    Defaults !rootpw
+    Defaults !runaspw
+
 severity: medium
 
 rationale: |-
@@ -17,7 +22,7 @@ identifiers:
     cce@sle15: CCE-85747-4
 
 references:
-    disa@sle15: CCI-000366
+    disa: CCI-000366
     nist@sle15: CM-6(b),CM-6.1(iv)
     srg: SRG-OS-000480-GPOS-00227
     stigid@sle15: SLES-15-020103
@@ -26,7 +31,6 @@ ocil_clause: 'invoke user passwd when using sudo'
 
 ocil: |-
     Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalatiob:
-
     <pre> sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'</pre>
 The expected output is:
     <pre> /etc/sudoers:Defaults !targetpw
@@ -37,9 +41,3 @@ The expected output is:
     If "Defaults !targetpw" is not defined, this is a finding.
     If "Defaults !rootpw" is not defined, this is a finding.
     If "Defaults !runaspw" is not defined, this is a finding.
-
-    Fix Text: Define the following in the Defaults section of the /etc/sudoers file or a configuration file in the /etc/sudoers.d/ directory:
-
-    Defaults !targetpw
-    Defaults !rootpw
-    Defaults !runaspw
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.fail.sh
similarity index 100%
rename from linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_fail.sh
rename to linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.fail.sh
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_pass.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.pass.sh
similarity index 100%
rename from linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_pass.sh
rename to linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.pass.sh
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw.fail.sh
similarity index 100%
rename from linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw_fail.sh
rename to linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw.fail.sh
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw.fail.sh
similarity index 100%
rename from linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw_fail.sh
rename to linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw.fail.sh
diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw_fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw.fail.sh
similarity index 100%
rename from linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw_fail.sh
rename to linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw.fail.sh


From dfd5d60cb3ef52692e175efe52076495471db994 Mon Sep 17 00:00:00 2001
From: yarunachalam <40246855+yarunachalam@users.noreply.github.com>
Date: Fri, 23 Apr 2021 18:32:31 +0000
Subject: [PATCH 5/6] Apply suggestions from code review

Co-authored-by: vojtapolasek <krecoun@gmail.com>
---
 .../software/sudo/sudoers_validate_passwd/oval/shared.xml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
index 1c3a83523c6..646e6bfb7c0 100644
--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml
@@ -24,7 +24,7 @@
   </ind:textfilecontent54_test>
 
   <ind:textfilecontent54_object id="object_test_sudoers_targetpw_config" version="1">
-    <ind:filepath>/etc/sudoers</ind:filepath>
+    <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
     <ind:pattern operation="pattern match">^Defaults !targetpw$\r?\n</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>

From 244471e24f9e90dd5ef54530f517b1759c87a01f Mon Sep 17 00:00:00 2001
From: yarunachalam <yarunachalam@suse.com>
Date: Fri, 23 Apr 2021 19:18:20 +0000
Subject: [PATCH 6/6] Fixed ocil record

---
 .../sudo/sudoers_validate_passwd/rule.yml        | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
index db636bc59a2..d0a90a3723a 100644
--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
+++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml
@@ -7,10 +7,11 @@ prodtype: sle15
 description: |-
     The sudoers security policy requires that users authenticate themselves before they can use sudo.
     When sudoers requires authentication, it validates the invoking user's credentials.
-    Fix Text: Define the following in the Defaults section of the /etc/sudoers file or a configuration file in the /etc/sudoers.d/ directory:
-    Defaults !targetpw
-    Defaults !rootpw
-    Defaults !runaspw
+    The expected output for:
+    <pre>sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'</pre>
+    <pre> /etc/sudoers:Defaults !targetpw
+          /etc/sudoers:Defaults !rootpw
+          /etc/sudoers:Defaults !runaspw </pre>
 
 severity: medium
 
@@ -30,13 +31,8 @@ references:
 ocil_clause: 'invoke user passwd when using sudo'
 
 ocil: |-
-    Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalatiob:
+    Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation:
     <pre> sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'</pre>
-The expected output is:
-    <pre> /etc/sudoers:Defaults !targetpw
-          /etc/sudoers:Defaults !rootpw
-          /etc/sudoers:Defaults !runaspw </pre>
-
     If no results are returned, this is a finding
     If "Defaults !targetpw" is not defined, this is a finding.
     If "Defaults !rootpw" is not defined, this is a finding.