Ubuntu 24.04 2.4.2.1 Ensure at is restricted to authorized users

components/cronie.yml

@@ -6,6 +6,7 @@ packages:
 - cronie
 rules:
 - disable_anacron
+- file_at_allow_exists
 - file_at_deny_not_exist
 - file_cron_allow_exists
 - file_cron_deny_not_exist

controls/cis_ubuntu2404.yml

@@ -1090,14 +1090,14 @@ controls:
     levels:
       - l1_server
       - l1_workstation
-    related_rules:
-      - file_at_deny_not_exist
+    rules:
+      - file_at_allow_exists
       - file_groupowner_at_allow
       - file_owner_at_allow
       - file_permissions_at_allow
-    status: planned
-    notes: TODO. Partial/incorrect implementation exists.See related rules. Analogous to ubuntu2204/5.1.9.
-
+      - file_at_deny_not_exist
+    status: automated
+    
   - id: 3.1.1
     title: Ensure IPv6 status is identified (Manual)
     levels:

linux_os/guide/services/cron_and_at/restrict_at_cron_users/file_at_allow_exists/rule.yml

@@ -0,0 +1,34 @@
+documentation_complete: true
+
+
+title: Ensure that /etc/at.allow exists
+
+description: |-
+    The file <tt>/etc/at.allow</tt> should exist and should be used instead
+    of <tt>/etc/at.deny</tt>.
+
+rationale: |-
+    On many systems, only the system administrator is authorized to schedule at jobs.
+    Using the at.allow file to control who can run at jobs enforces this policy. It is easier
+    to manage an allow list than a deny list. In a deny list, you could potentially add a user
+    ID to the system and forget to add it to the deny files.
+
+severity: medium
+
+ocil_clause: 'the file /etc/at.allow does not exist'
+
+ocil: |-
+    The file <tt>/etc/at.allow</tt> should exist.
+    This can be checked by running the following command:
+    <pre>
+    stat /etc/at.allow
+    </pre>
+    and the output should list the file.
+
+template:
+    name: file_existence
+    vars:
+        filepath: /etc/at.allow
+        exists: true
+        fileuid: "0"
+        filemode: "0640"

linux_os/guide/services/cron_and_at/restrict_at_cron_users/file_at_allow_exists/tests/dne.fail.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+rm -rf /etc/at.allow

linux_os/guide/services/cron_and_at/restrict_at_cron_users/file_at_allow_exists/tests/exists.pass.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+touch /etc/at.allow