mediumaccess-controlverified ✓rollback-safe
Ensure sudoers specifies the default includedir
sudo-include-directory · RHEL ≥ 8 · 1 impl
Description
The /etc/sudoers file must use the @includedir or #includedir directive to include /etc/sudoers.d/ for modular sudo configuration.
Rationale
Centralizing sudoers configuration through an include directory ensures consistent and auditable privilege management.
Check → Remediate
Checkcommand
grep -rE '^(@includedir|#includedir|#include)\s+/etc/sudoers\.d' /etc/sudoers
- expected_exit:
- 0
Remediateconfig_append
- path:
- /etc/sudoers
- line:
- @includedir /etc/sudoers.d
Framework references
STIG
V-251711
NIST 800-53
CM-6AC-6
Live verification
rhel8:check
#sudo#configuration#access-control