rewrite user home dir hardening (#584)

* rewrite user home dir hardening

* delete duplicate var that was missed in a merge conflict

Signed-off-by: Sebastian Gumprich <[email protected]>

* linting

Signed-off-by: Sebastian Gumprich <[email protected]>

* add tests for home rewrites

Signed-off-by: Sebastian Gumprich <[email protected]>

* Apply suggestions from code review

Co-authored-by: schurzi <[email protected]>

---------

Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: donestefan <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
Co-authored-by: schurzi <[email protected]>

roles/os_hardening/defaults/main.yml

@@ -14,14 +14,15 @@ os_auth_pam_pwquality_options: try_first_pass retry=3 authtok_type= # Used in RH
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
 os_chfn_restrict: ""
 
-# Set to false to disable chmod userhome folders to 700
+# Set to `false` to disable "chmod 700" of home folders for regular users
 os_chmod_rootuser_home_folder: true
 os_chmod_home_folders: true
+# Specify user accounts, whose home folders shouldn't be chmodded to 700 when "os_chmod_home_folders" is enabled.
+os_ignore_home_folder_users: []
 
 # May contain: change_user
 os_security_users_allow: []
-# Specify user home folders in /home that shouldn't be chmodded to 700
-os_ignore_home_folder_users: [lost+found]
+
 # Set to false to disable password age enforcement on existing users
 os_rootuser_pw_ageing: false