Description of problem:

One of our customer observed that as part of stig scan , the scap rule - xccdf_org.ssgproject.content_rule_sudo_require_reauthentication which is used to check if value of "Default timestamp_timeout" is set or not , fails when there is a space character in between the value

For example the rules fails when there is a space around the "timestamp_timeout=value"

Fails:       Defaults timestamp_timeout = 1
Fails:       Defaults timestamp_timeout= 1
Passes:      Defaults timestamp_timeout=1

I tested and found that visudo is able to parse this in all three scenarios and also verified that all three scenarios the sudo does work with the configured value.

Due to this, the rule should be able to Pass in in all three scenarios.


Version-Release number of selected component (if applicable):
scap-security-guide-0.1.63-4.el8.noarch

How reproducible:
Everytime

Steps to Reproduce:

1. Edit /etc/sudoers files and add a line "Defaults timestamp_timeout = 1" i.e. space around the "=" sign and run the oscap scan and it will fail.

~~~
# oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig --rule xccdf_org.ssgproject.content_rule_sudo_require_reauthentication /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml
WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2 file which is referenced from XCCDF content
--- Starting Evaluation ---

Title   The operating system must require Re-Authentication when using the sudo command. Ensure sudo timestamp_timeout is appropriate - sudo timestamp_timeout
Rule    xccdf_org.ssgproject.content_rule_sudo_require_reauthentication
Ident   CCE-87838-9
Result  fail
~~~

2. Now change the visudo file so there is no spaces around "=" i.e. "timestamp_timeout=1" and run the oscap scan for this rule and it will pass.
~~~
# oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig --rule xccdf_org.ssgproject.content_rule_sudo_require_reauthentication /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml
WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2' points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2'. Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2' file which is referenced from datastream
WARNING: Skipping ./security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2 file which is referenced from XCCDF content
--- Starting Evaluation ---

Title   The operating system must require Re-Authentication when using the sudo command. Ensure sudo timestamp_timeout is appropriate - sudo timestamp_timeout
Rule    xccdf_org.ssgproject.content_rule_sudo_require_reauthentication
Ident   CCE-87838-9
Result  pass
~~~


Actual results:
The scan fails when there is space between key/value pair for timestamp_timeout

Expected results:
The scan should pass even when there is space around the timestamp_timeout as visudo parses it correctly and sudo also behaves correctly in this cases.


Additional info: