Which version of Privilege Secure do you have?
Privilege Secure AM
What is a one sentence summary of your feature request?
Request to add sudo tags in sudoers rules
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
We are facing problem while configuring Linux sudoers rules that require specific sudo tags, such as LOG_OUTPUT, LOG_INPUT and similar attributes.
more sudo tags examples:
LOG_INPUT: — log keystrokes/input for the command
alice ALL=(root) LOG_INPUT: /bin/bash
LOG_OUTPUT: — log command output
alice ALL=(root) LOG_OUTPUT: /usr/bin/tail /var/log/secure
NOLOG_INPUT: — disable input logging for that rule/command
alice ALL=(root) NOLOG_INPUT: /usr/bin/less /var/log/messages
NOLOG_OUTPUT: — disable output logging for that rule/command
alice ALL=(root) NOLOG_OUTPUT: /usr/bin/journalctl -u nginx
USE_PTY: — force running the command in a pseudo-terminal
alice ALL=(root) USE_PTY: /usr/bin/docker ps
NOEXEC: — prevent the command from executing further programs (mitigates shell escapes in some tools)
alice ALL=(root) NOEXEC: /usr/bin/less /var/log/syslog
SETENV: — allow the user to set environment variables for the command (sudo -E / VAR=… sudo …)
alice ALL=(root) SETENV: /usr/bin/systemctl show ‘*’
How do you currently solve the challenges you have by not having this feature?
Exception process for affected hosts/roles/systems where compliance requires tagged rules, we treat them as exceptions and exclude them from NPS-managed sudo policy, keeping them on a separate, audited configuration path.
Upload any supporting images that you think should be considered in this idea.
