mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 13:37:30 +00:00
2e631491c2
When importing CIS benchmark content for multiple OS versions into a single Fleet team via GitOps, users encounter several hard validation failures because Fleet enforces uniqueness on script basenames, mobileconfig PayloadDisplayName / PayloadIdentifier, and policy name fields. Changes (all confined to docs/solutions/cis/): - Fix #!/usr/bin/env bash shebang in CIS_2.6.7.sh (macOS 13/14/15) -> #!/bin/bash - Prefix script filenames with OS slug (macos13-, macos14-, macos15-, win10-, win11-, win11-intune-) to prevent basename collisions - Prefix mobileconfig PayloadDisplayName with OS tag ([macOS 13] etc.), which is the field Fleet uses for identity - Prefix mobileconfig PayloadIdentifier with an OS slug so identifiers stay unique across versions - Prefix every policy name: field with the OS tag; preserve original YAML formatting (plain, single-quoted with '' escapes, and folded block scalars) - Rename Windows XML profiles with win10-, win11-, and win11-intune- prefixes None of these changes affect the security logic or coverage of the benchmarks. They only make the content importable without manual intervention. Co-authored-by: Claude <noreply@anthropic.com>
17 lines
553 B
Bash
17 lines
553 B
Bash
#!/bin/bash
|
|
|
|
# CIS - Ensure a Separate Timestamp Is Not Used for Each User-tty Combo
|
|
# Sets sudo timeout to 0 (require password every time).
|
|
|
|
SUDOERS_FILE="/etc/sudoers.d/CIS_54_sudoconfiguration"
|
|
|
|
echo 'Defaults timestamp_timeout=0' | sudo tee "$SUDOERS_FILE" > /dev/null
|
|
sudo /bin/chmod 0440 "$SUDOERS_FILE"
|
|
sudo /usr/sbin/chown root:wheel "$SUDOERS_FILE"
|
|
|
|
# Validate syntax
|
|
if ! sudo /usr/sbin/visudo -cf "$SUDOERS_FILE"; then
|
|
echo "ERROR: sudoers syntax check failed. Removing invalid configuration."
|
|
sudo /bin/rm -f "$SUDOERS_FILE"
|
|
exit 1
|
|
fi
|