Repository navigation
SLE16 sudo rules transactional related patches - #15131
Open
teacup-on-rockingchair wants to merge 3 commits into
Open
teacup-on-rockingchair wants to merge 3 commits into
teacup-on-rockingchair wants to merge 3 commits into
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
teacup-on-rockingchair
force-pushed
the
suse16_sudo_rules
branch
from
September 20, 2026 14:12
7b73cc5 to
b801d5f
Compare
teacup-on-rockingchair
added
Ansible
teacup-on-rockingchair
marked this pull request as ready for review
September 20, 2026 16:02
teacup-on-rockingchair
requested review from
Mab879,
jan-cerny,
matusmarhefka and
vojtapolasek
as code owners
September 20, 2026 16:02
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Critical OVAL coverage gaps and moderate test-platform issues remain unresolved.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 4
Open (6)
What changed in this PR
Adapts sudo rules for transactional SLE16/SLMicro platforms using distro-default configuration across OVAL, Bash, Ansible, and tests.
Changes:
- Adds transactional remediation and validation handling.
- Expands sudo tests, package metadata, drop-in coverage, and openSUSE scenarios.
| File | Final review status |
|---|---|
linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw.fail.sh |
Moderate (1 vote): SLE16 is missing from the platform marker. |
linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw.fail.sh |
Moderate (1 vote): SLE16 is missing from the platform marker. |
linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.pass.sh |
Moderate (2 votes): SLE16 is missing from the platform marker. |
linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.fail.sh |
Moderate (3 votes): opensuse-16 is not a product value. Moderate (1 vote): SLE16 is missing from the platform marker. |
linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_multiple_files.pass.sh |
Moderate (1 vote): SLE16 is missing from the platform marker. |
linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_duplicates.pass.sh |
Moderate (1 vote): SLE16 is missing from the platform marker. |
linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_duplicates.fail.sh |
Moderate (1 vote): SLE16 is missing from the platform marker. |
linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd_conflicting_values.fail.sh |
Moderate (1 vote): SLE16 is missing from the platform marker. |
linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_d_duplicate.pass.sh |
No final comment. |
linux_os/guide/system/software/sudo/sudoers_validate_passwd/oval/shared.xml |
Critical (1 vote): Active /usr/etc/sudoers.d drop-ins can be missed. |
linux_os/guide/system/software/sudo/sudoers_validate_passwd/bash/shared.sh |
Moderate (1 vote): The openSUSE transactional guard is missing. |
linux_os/guide/system/software/sudo/sudoers_validate_passwd/ansible/shared.yml |
No final comment. |
linux_os/guide/system/software/sudo/sudo_restrict_privilege_elevation_to_authorized/oval/shared.xml |
Critical (2 votes): /usr/etc/sudoers.d is not scanned. |
linux_os/guide/system/software/sudo/sudo_require_authentication/tests/wrong_value.fail.sh |
No final comment. |
linux_os/guide/system/software/sudo/sudo_require_authentication/tests/correct_value.pass.sh |
No final comment. |
linux_os/guide/system/software/sudo/sudo_remove_nopasswd/tests/wrong_value.fail.sh |
No final comment. |
linux_os/guide/system/software/sudo/sudo_remove_nopasswd/tests/wrong_value_specific_commands.fail.sh |
No final comment. |
linux_os/guide/system/software/sudo/sudo_remove_nopasswd/tests/wrong_value_include_dir.fail.sh |
No final comment. |
linux_os/guide/system/software/sudo/sudo_remove_nopasswd/tests/correct_value.pass.sh |
No final comment. |
linux_os/guide/system/software/sudo/sudo_remove_nopasswd/oval/shared.xml |
Critical (1 vote): Active /usr/etc/sudoers.d drop-ins can be missed. |
linux_os/guide/system/software/sudo/sudo_remove_nopasswd/bash/shared.sh |
No final comment. |
linux_os/guide/system/software/sudo/sudo_remove_nopasswd/ansible/shared.yml |
No final comment. |
linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/tests/wrong_value.fail.sh |
No final comment. |
linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/tests/wrong_value_include_dir.fail.sh |
No final comment. |
linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/tests/correct_value.pass.sh |
No final comment. |
linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/oval/shared.xml |
Critical (1 vote): Active /usr/etc/sudoers.d drop-ins can be missed. |
linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/bash/shared.sh |
No final comment. |
linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/ansible/shared.yml |
No final comment. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…ro platforms Make sure distro default config is used as basis for configuration and oval, bash and ansible take this into account
teacup-on-rockingchair
force-pushed
the
suse16_sudo_rules
branch
from
September 20, 2026 16:38
0216597 to
f843406
Compare
teacup-on-rockingchair
added
the
SLES
macko1
self-requested a review
September 21, 2026 15:47
Collaborator
|
Hi @teacup-on-rockingchair, thanks for the submission. Please submit the test scenarios (e.g. automatus), the test results, and verbose documentation for the remediations before marking this as ready. It will help with the review a lot. (Use the PR template) Thanks! 🙏 |
macko1
reviewed
Oct 2, 2026
| @@ -1,4 +1,5 @@ | |||
| #!/bin/bash | |||
| # packages = sudo | |||
Collaborator
There was a problem hiding this comment.
What was the reason for this change?
Contributor
Author
There was a problem hiding this comment.
The motivation is that the /etc/sudoers file is owned and therefore depends on sudo package
macko1
reviewed
Oct 2, 2026
| @@ -1,8 +1,3 @@ | |||
| #!/bin/bash | |||
|
|
|||
| # packages = sudo | |||
Collaborator
There was a problem hiding this comment.
What was the reason for this change?
Contributor
Author
There was a problem hiding this comment.
The motivation is that the /etc/sudoers file is owned and therefore depends on sudo package
Collaborator
|
@svet-se Please take a look at the suse side of the PR, thank you |
svet-se
approved these changes
Oct 6, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Rationale:
take this into account