rewrite user home dir hardening (#584)

* rewrite user home dir hardening * delete duplicate var that was missed in a merge conflict Signed-off-by: Sebastian Gumprich <[email protected]> * linting Signed-off-by: Sebastian Gumprich <[email protected]> * add tests for home rewrites Signed-off-by: Sebastian Gumprich <[email protected]> * Apply suggestions from code review Co-authored-by: schurzi <[email protected]> --------- Signed-off-by: Sebastian Gumprich <[email protected]> Co-authored-by: donestefan <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]> Co-authored-by: schurzi <[email protected]>
2023-01-28 21:59:19 +01:00
1 parent a75b339526
commit 16e00b02db
@@ -31,6 +31,7 @@
    os_users_without_password_ageing: ['pw_no_ageing']
    os_netrc_enabled: false
    os_ignore_users: ["shell_sys_acc"]
+    os_ignore_home_folder_users: ["user_with_777_home"]
    sysctl_config:
      net.ipv4.ip_forward: 0
      net.ipv6.conf.all.forwarding: 0
@@ -59,11 +59,11 @@
      include_tasks: prepare_tasks/yum.yml
      when: ansible_facts.os_family == 'RedHat'

-    - name: include netrc prepare tasks
-      include_tasks: prepare_tasks/netrc.yml
-
-    - name: include password ageing prepare tasks
-      include_tasks: prepare_tasks/pw_ageing.yml
-
-    - name: include system account shell prepare tasks
-      include_tasks: prepare_tasks/sys_account_shell.yml
+    - name: include preparation tasks
+      ansible.builtin.include_tasks:
+        file: "{{ item }}"
+      loop:
+        - prepare_tasks/netrc.yml
+        - prepare_tasks/pw_ageing.yml
+        - prepare_tasks/sys_account_shell.yml
+        - prepare_tasks/ignore_home_folders.yml
@@ -0,0 +1,9 @@
+---
+- name: Create user whose home-folder should not be touched
+  ansible.builtin.user:
+    name: "user_with_777_home"
+
+- name: Change mode of home-folder for user to 777
+  ansible.builtin.file:
+    path: /home/user_with_777_home
+    mode: "0777"
@@ -37,14 +37,14 @@
        name: procps
      when: ansible_facts.os_family == 'Debian'

-    - name: include system account shell tests
-      include_tasks: verify_tasks/sys_account_shell.yml
-
-    - name: include password ageing tests
-      include_tasks: verify_tasks/pw_ageing.yml
-
-    - name: include netrc tests
-      include_tasks: verify_tasks/netrc.yml
+    - name: include verification tasks
+      ansible.builtin.include_tasks:
+        file: "{{ item }}"
+      loop: 
+        - verify_tasks/sys_account_shell.yml
+        - verify_tasks/pw_ageing.yml
+        - verify_tasks/netrc.yml
+        - verify_tasks/ignore_home_folders.yml

    - name: include PAM tests
      include_tasks: verify_tasks/pam.yml
@@ -0,0 +1,10 @@
+---
+- name: Get properties of user user_with_777_home's home-folder
+  ansible.builtin.stat:
+    path: /home/user_with_777_home
+  register: stats
+
+- name: Check that the home-folder has mode 777
+  ansible.builtin.assert:
+    that:
+      - stats.stat.mode == "0777"