From ea471b38b77d79b3df655624bb9a952bbdf00711 Mon Sep 17 00:00:00 2001 From: Sylvain Prat Date: Tue, 15 Dec 2020 21:31:51 +0100 Subject: [PATCH] Fix #344: make the os_env_umask variable usable again Signed-off-by: Sylvain Prat --- molecule/os_hardening/molecule.yml | 1 - roles/os_hardening/README.md | 4 ++-- roles/os_hardening/defaults/main.yml | 3 +++ roles/os_hardening/templates/etc/login.defs.j2 | 2 +- roles/os_hardening/vars/Archlinux.yml | 2 +- roles/os_hardening/vars/Debian.yml | 2 +- roles/os_hardening/vars/Fedora.yml | 2 +- roles/os_hardening/vars/Oracle Linux.yml | 2 +- roles/os_hardening/vars/RedHat.yml | 2 +- roles/os_hardening/vars/Suse.yml | 2 +- 10 files changed, 12 insertions(+), 10 deletions(-) diff --git a/molecule/os_hardening/molecule.yml b/molecule/os_hardening/molecule.yml index 422ce8e6..e2a82ccf 100644 --- a/molecule/os_hardening/molecule.yml +++ b/molecule/os_hardening/molecule.yml @@ -63,4 +63,3 @@ scenario: - idempotence - verify - destroy - diff --git a/roles/os_hardening/README.md b/roles/os_hardening/README.md index 0698ca1a..9cf759cd 100644 --- a/roles/os_hardening/README.md +++ b/roles/os_hardening/README.md @@ -86,8 +86,8 @@ We know that this is the case on Raspberry Pi. - Default: `[]` - Description: add additional paths to the user's `PATH` variable (default is empty). - `os_env_umask` - - Default: `027` - - Description: set default permissions for new files to `750` + - Default: `027` or `077` depending on the platform. + - Description: set default permissions for new files to `750` or `700`. - `os_auth_pw_max_age` - Default: `60` - Description: maximum password age (set to `99999` to effectively disable it) diff --git a/roles/os_hardening/defaults/main.yml b/roles/os_hardening/defaults/main.yml index 28617b57..6cb3a361 100644 --- a/roles/os_hardening/defaults/main.yml +++ b/roles/os_hardening/defaults/main.yml @@ -271,6 +271,9 @@ os_filesystem_whitelist: [] # the Ansible role dependency mechanism. os_hardening_enabled: true +# Set the umask you want to apply, or leave empty to use the defaults. +os_env_umask: '' + # Set to false to disable installing and configuring auditd. os_auditd_enabled: true os_auditd_max_log_file_action: keep_logs diff --git a/roles/os_hardening/templates/etc/login.defs.j2 b/roles/os_hardening/templates/etc/login.defs.j2 index cc4c275e..a6d5e216 100644 --- a/roles/os_hardening/templates/etc/login.defs.j2 +++ b/roles/os_hardening/templates/etc/login.defs.j2 @@ -92,7 +92,7 @@ KILLCHAR 025 # Prefix these values with `0` to get octal, `0x` to get hexadecimal. # `022` is the "historical" value in Debian for UMASK # `027`, or even `077`, could be considered better for privacy. -UMASK {{ os_env_umask }} +UMASK {{ os_env_umask | default(os_env_umask_default, true) }} # Enable setting of the umask group bits to be the same as owner bits (examples: `022` -> `002`, `077` -> `007`) for non-root users, if the uid is the same as gid, and username is the same as the primary group name. # If set to yes, userdel will remove the user´s group if it contains no more members, and useradd will create by default a group with the name of the user. diff --git a/roles/os_hardening/vars/Archlinux.yml b/roles/os_hardening/vars/Archlinux.yml index 99f05d1b..1bf8c2a7 100644 --- a/roles/os_hardening/vars/Archlinux.yml +++ b/roles/os_hardening/vars/Archlinux.yml @@ -12,7 +12,7 @@ os_passwd_perms: group: root mode: '0644' -os_env_umask: '027' +os_env_umask_default: '027' os_auth_uid_min: 1000 os_auth_gid_min: 1000 diff --git a/roles/os_hardening/vars/Debian.yml b/roles/os_hardening/vars/Debian.yml index 7d4e2a06..cc3d5a9a 100644 --- a/roles/os_hardening/vars/Debian.yml +++ b/roles/os_hardening/vars/Debian.yml @@ -18,7 +18,7 @@ os_passwd_perms: group: root mode: '0644' -os_env_umask: '027' +os_env_umask_default: '027' os_auth_uid_min: 1000 os_auth_gid_min: 1000 diff --git a/roles/os_hardening/vars/Fedora.yml b/roles/os_hardening/vars/Fedora.yml index bce43288..de446ae7 100644 --- a/roles/os_hardening/vars/Fedora.yml +++ b/roles/os_hardening/vars/Fedora.yml @@ -18,7 +18,7 @@ os_passwd_perms: group: root mode: '0644' -os_env_umask: '027' +os_env_umask_default: '027' os_auth_uid_min: 1000 os_auth_gid_min: 1000 diff --git a/roles/os_hardening/vars/Oracle Linux.yml b/roles/os_hardening/vars/Oracle Linux.yml index 994e1b99..2678b138 100644 --- a/roles/os_hardening/vars/Oracle Linux.yml +++ b/roles/os_hardening/vars/Oracle Linux.yml @@ -18,7 +18,7 @@ os_passwd_perms: group: root mode: '0644' -os_env_umask: '077' +os_env_umask_default: '077' os_auth_uid_min: 1000 os_auth_gid_min: 1000 diff --git a/roles/os_hardening/vars/RedHat.yml b/roles/os_hardening/vars/RedHat.yml index dc20124d..2a48c1b2 100644 --- a/roles/os_hardening/vars/RedHat.yml +++ b/roles/os_hardening/vars/RedHat.yml @@ -18,7 +18,7 @@ os_passwd_perms: group: root mode: '0644' -os_env_umask: '077' +os_env_umask_default: '077' os_auth_uid_min: 1000 os_auth_gid_min: 1000 diff --git a/roles/os_hardening/vars/Suse.yml b/roles/os_hardening/vars/Suse.yml index 152af1fe..8f46c982 100644 --- a/roles/os_hardening/vars/Suse.yml +++ b/roles/os_hardening/vars/Suse.yml @@ -18,7 +18,7 @@ os_passwd_perms: group: root mode: '0644' -os_env_umask: '027' +os_env_umask_default: '027' os_auth_uid_min: 1000 os_auth_gid_min: 1000