Minimize access user paths should be fully configurable

[S0obi]

Description

Hello everyone,

I would like to propose a small change in OS Hardening minimize_access.yml file. In some situations, specific software may install many files in the hard coded user paths (like /usr/local/bin), the execution of the playbook will then take forever (more than an hour with thousand of files). It will be nice if the list of folder is configurable so users can configure it according to their needs.

Solution

https://github.com/dev-sec/ansible-collection-hardening/issues#L7-L19

  - name: Find files with write-permissions for group # noqa command-instead-of-shell
    ansible.builtin.shell: find -L {{ item }} -perm /go+w -type f
    with_community.general.flattened:
      - /usr/local/sbin
      - /usr/local/bin
      - /usr/sbin
      - /usr/bin
      - /sbin
      - /bin
      - "{{ os_env_extra_user_paths }}"
    register: minimize_access_directories
    ignore_errors: true
    changed_when: false

Replace the hard-coded list of directories with a variable, for example os_env_user_paths

Alternatives

No response

Additional information

...

[rndmh3ro]

Sounds reasonable.

We should probably have two variables, os_env_user_paths (as a default-variable) and os_env_extra_user_paths and use these in this task.

Do you want to create a PR?

[S0obi]

Sounds reasonable.

We should probably have two variables, os_env_user_paths (as a default-variable) and os_env_extra_user_paths and use these in this task.

Do you want to create a PR?

I issued #692 for your review, thanks!