Harden mountpoints (#531)

* first testing with tasks and variables Signed-off-by: Ludwig Bayerlein <[email protected]> * update variables for dir options Signed-off-by: Ludwig Bayerlein <[email protected]> * updated permissions and defaults Signed-off-by: Ludwig Bayerlein <[email protected]> * fix home dir permissions Signed-off-by: Ludwig Bayerlein <[email protected]> * updated tasks with useful variables Signed-off-by: Ludwig Bayerlein <[email protected]> * reorder tasks. first remount, then manage fstab and fix permissions on directories. Renaming task names with mountpoints (slashes) Signed-off-by: Ludwig Bayerlein <[email protected]> * shorten tasks with list items Signed-off-by: Ludwig Bayerlein <[email protected]> * change defaults for /boot directory, because its a bad behaviour, if ansible changes boot entries with a default value Signed-off-by: Ludwig Bayerlein <[email protected]> * Update documentation for new parameters to manage mountpoints Signed-off-by: Ludwig Bayerlein <[email protected]> * Update roles/os_hardening/tasks/minimize_access.yml Co-authored-by: Sebastian Gumprich <[email protected]> Signed-off-by: Ludwig Bayerlein <[email protected]> * Update roles/os_hardening/tasks/minimize_access.yml Co-authored-by: Sebastian Gumprich <[email protected]> Signed-off-by: Ludwig Bayerlein <[email protected]> * Fix state on every new task Signed-off-by: Ludwig Bayerlein <[email protected]> * loop instead of list Signed-off-by: Ludwig Bayerlein <[email protected]> * testing remount with register Signed-off-by: Ludwig Bayerlein <[email protected]> * add remounts with loop over all changed folders Signed-off-by: Ludwig Bayerlein <[email protected]> * testing and solving trouble with variable names Signed-off-by: Ludwig Bayerlein <[email protected]> * optimize default permissions for var-log-audit Signed-off-by: Ludwig Bayerlein <[email protected]> * optimize default permissions for var-log-audit Signed-off-by: Ludwig Bayerlein <[email protected]> * change to new optimizied permissions of var-log-audit Signed-off-by: Ludwig Bayerlein <[email protected]> * fix some defaults in fstab to configure as mounted Signed-off-by: Ludwig Bayerlein <[email protected]> * add stat and check, if boot folder exists Signed-off-by: Ludwig Bayerlein <[email protected]> Co-authored-by: Ludwig Bayerlein <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]>
2022-07-07 09:02:25 +02:00
1 parent 0251172cd1
commit 488ff6a7c3
@@ -385,3 +385,57 @@ os_selinux_enabled: true
 # The values must be inside the 1000-999999999 range.
 os_sha_crypt_min_rounds: "640000"
 os_sha_crypt_max_rounds: "640000"
+
+os_mnt_boot_dir_mode: '0700'
+os_mnt_boot_enabled: false
+os_mnt_boot_src: ""
+os_mnt_boot_options: 'rw,nosuid,nodev,noexec'
+os_mnt_boot_filesystem: 'ext4'
+
+os_mnt_dev_dir_mode: '0755'
+os_mnt_dev_enabled: true
+os_mnt_dev_src: "devtmpfs"
+os_mnt_dev_options: 'rw,nosuid,noexec'
+os_mnt_dev_filesystem: "devtmpfs"
+
+os_mnt_dev_shm_dir_mode: '1777'
+os_mnt_dev_shm_enabled: true
+os_mnt_dev_shm_src: "tmpfs"
+os_mnt_dev_shm_options: 'rw,nosuid,nodev,noexec'
+os_mnt_dev_shm_filesystem: "tmpfs"
+
+os_mnt_home_dir_mode: '0755'
+os_mnt_home_enabled: false
+os_mnt_home_src: ""
+os_mnt_home_options: 'rw,nosuid,nodev'
+os_mnt_home_filesystem: "ext4"
+
+os_mnt_run_dir_mode: '0755'
+os_mnt_run_enabled: true
+os_mnt_run_src: "tmpfs"
+os_mnt_run_options: 'rw,nosuid,nodev'
+os_mnt_run_filesystem: "tmpfs"
+
+os_mnt_var_dir_mode: '0755'
+os_mnt_var_enabled: false
+os_mnt_var_src: ""
+os_mnt_var_options: 'rw,nosuid,nodev'
+os_mnt_var_filesystem: "ext4"
+
+os_mnt_var_log_dir_mode: '0755'
+os_mnt_var_log_enabled: false
+os_mnt_var_log_src: ""
+os_mnt_var_log_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_log_filesystem: "ext4"
+
+os_mnt_var_log_audit_dir_mode: '0640'
+os_mnt_var_log_audit_enabled: false
+os_mnt_var_log_audit_src: ""
+os_mnt_var_log_audit_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_log_audit_filesystem: "ext4"
+
+os_mnt_var_tmp_dir_mode: '1777'
+os_mnt_var_tmp_enabled: false
+os_mnt_var_tmp_src: ""
+os_mnt_var_tmp_options: 'rw,nosuid,nodev,noexec'
+os_mnt_var_tmp_filesystem: "ext4"