[PATCH configure] BZ 798440 - /etc/aeolus-configure/nodes/* should be not be world readable

John Eckersberg jeckersb at redhat.com
Thu Mar 1 00:32:20 UTC 2012


On Wed, 29 Feb 2012 11:55:48 -0800, Richard Su <rwsu at redhat.com> wrote:
> https://bugzilla.redhat.com/show_bug.cgi?id=798440
> 
> Also changed permissions of /etc/imagefactory/imagefactory.conf to 0600.
> ---
>  contrib/aeolus-configure.spec.in          |    1 +
>  recipes/aeolus/manifests/image-factory.pp |    3 +++
>  2 files changed, 4 insertions(+), 0 deletions(-)
> 
> diff --git a/contrib/aeolus-configure.spec.in b/contrib/aeolus-configure.spec.in
> index 60aa246..9fae261 100644
> --- a/contrib/aeolus-configure.spec.in
> +++ b/contrib/aeolus-configure.spec.in
> @@ -58,6 +58,7 @@ Aeolus Configure Puppet Recipe
>  %attr(0755, root, root) %{_sbindir}/aeolus-configure
>  %attr(0755, root, root) %{_sbindir}/aeolus-cleanup
>  %config(noreplace) %{_sysconfdir}/aeolus-configure/*
> +%attr(0600, root, root) %{_sysconfdir}/aeolus-configure/nodes/*
>  %attr(0755, root, root) %{_bindir}/aeolus-check-services
>  %attr(0755, root, root) %{_sbindir}/aeolus-restart-services
>  %{aeolushome}
> diff --git a/recipes/aeolus/manifests/image-factory.pp b/recipes/aeolus/manifests/image-factory.pp
> index 744f9c2..7c2838b 100644
> --- a/recipes/aeolus/manifests/image-factory.pp
> +++ b/recipes/aeolus/manifests/image-factory.pp
> @@ -57,6 +57,9 @@ class aeolus::image-factory inherits aeolus {
>                 hasstatus => true,
>                 require => Package['libvirt']}
>  
> +    file { "/etc/imagefactory/imagefactory.conf":
> +      mode => 0600 }
> +
>      augeas { 'imagefactory.conf':
>        incl => '/etc/imagefactory/imagefactory.conf',
>        lens => 'Json.lns',
> -- 
> 1.7.7.6
> 

ACK, although I'm including another patch for imagefactory which sets
the correct permissions for imagefactory.conf there as well.  Whether
or not we still need to set that to 0600 in configure as well is up
for debate.  I'd say go ahead and leave it; that will fix any existing
installations that already have the wrong permissions.  Otherwise
since it's %config(noreplace) it wouldn't modify existing installs.




More information about the aeolus-devel mailing list