Check for missing HBAC rules for sudo services when sudorules are defined

[abbra]

can we do a healthcheck for a case when people have sudo rules but no corresponding hbac rule allowing sudo access? Or this would be too much of a data crunching?

[rcritten]

It would involve a couple of searches, or one jumbo one. It depends on the indexing. I can run a test with a lot of sudo and hbac rules to see what the etimes are.

I think what we're looking for is:

• one or more sudo rules
• HBAC rules with sudo or sudo-l as a service OR servicecat=all

[abbra]

right. One complicating thing is the case where sudo rules are targeting hosts that HBAC rules with sudo or sudo-l are not targeting.