templates: file_permissions: Improve handling of directories in ansible remediation

[dodys]

Description:

• When we use the ansible file module to apply permissions only to directories and subdirectories, this ends up applying to the files. By using the find module we can prevent that and have a simple remediation that works both for directories and file_regex.
• This fixes recursive file mode setting breaks sudo #10687.

Rationale:

• This probably affects all distros

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

[dodys]

@marcusburghardt @Mab879 can you check the testing-farm fail? The file_permissions_audit_configuration is a rule only rhel has and after taking a look I think the rule itself is not working as intended as the file_permissions template doesn't loop through the regexes. I also found it odd that this rule was created when we already had file_permissions_etc_audit_rulesd and file_permissions_etc_audit_auditd.

[codeclimate]

Code Climate has analyzed commit 8fcbb59 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 53.2% (0.0% change).

View more on Code Climate.

[marcusburghardt]

@marcusburghardt @Mab879 can you check the testing-farm fail? The file_permissions_audit_configuration is a rule only rhel has and after taking a look I think the rule itself is not working as intended as the file_permissions template doesn't loop through the regexes. I also found it odd that this rule was created when we already had file_permissions_etc_audit_rulesd and file_permissions_etc_audit_auditd.

It works as expected. I just checked the resulting bash remediation and it includes these two lines:

find -H /etc/audit/ -maxdepth 1 -perm /u+xs,g+xws,o+xwrt  -type f -regex '.*audit\(\.rules\|d\.conf\)$' -exec chmod u-xs,g-xws,o-xwrt {} \;
find -H /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xws,o+xwrt  -type f -regex '.*\.rules$' -exec chmod u-xs,g-xws,o-xwrt {} \;

Ansible follows the same approach.

[marcusburghardt]

LGTM