[cristianchiriac]

Description:

• In controls/cis_al2023.yml, control 4.3.4 "Ensure re-authentication for privilege escalation is not disabled globally" now selects sudo_remove_no_authenticate instead of sudo_require_reauthentication.

Rationale:

• 4.3.4 is about !authenticate in sudoers. sudo_require_reauthentication checks Defaults timestamp_timeout= and never looks at !authenticate; it already implements 4.3.5 "Ensure sudo authentication timeout is configured correctly", so it was selected twice.

• The CIS controls for RHEL 8/9/10, Fedora, Ubuntu 22.04/24.04 and Debian 12/13 map the same control to sudo_remove_no_authenticate (see Align some sudo rules with RHEL 10 CIS Benchmark #14067 for RHEL 10).

• Fixes Amazon Linux 2023 CIS 4.3.4 (re-authentication not disabled globally) is mapped to sudo_require_reauthentication instead of sudo_remove_no_authenticate #15152

Review Hints:

• sudo_remove_no_authenticate has no prodtype restriction, and its bash and Ansible remediations are multi_platform_all.
• I checked that controls/cis_al2023.yml loads with ssg.controls.Policy. It now resolves 4.3.4 to sudo_remove_no_authenticate and 4.3.5 to sudo_require_reauthentication.
• I didn't build the al2023 data stream locally.

[openshift-ci]

Hi @cristianchiriac. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.