Support os umask #152

hdep · 2018-08-22T09:22:45Z

As discussed in #147 here is a PR which do the following :

create system_umask variable,
if unset then ensure that /etc/profile.d/umask.sh is removed
if set to a value like 027 deploy /etc/profile.d/umask.sh and set the value

I test it on Debian 9 and works as expected so far.

Let me know if I need to change something.

add a comment to indicate that the file is managed by puppet

Add 'MANAGED BY PUPPET' header

Fix missing Requirements

timstoop

It's good practise to base a PR on the current master, so you do not get changes in there that have not yet been merged or should be part of another PR.

timstoop · 2018-08-23T18:25:39Z

manifests/init.pp

@@ -214,5 +216,8 @@
    password_hash         => $grub_password_hash,
    boot_without_password => $boot_without_password,
  }
+  class { 'os_hardening::umask':


I kind of feel like this should not be a separate module but part of login_defs.

login_defs class is clearly made for managing /etc/login.defs, I don't see why it should manage umask, unless I set umask value in login.defs file which is not the case

timstoop · 2018-08-23T18:26:01Z

README.md

@@ -12,6 +12,7 @@ This Puppet module provides secure configuration of your base OS with hardening.

 * Puppet OpenSource or Enterprise
 * [Module stdlib](https://forge.puppet.com/puppetlabs/stdlib)
+* [Module sysctl](https://forge.puppet.com/thias/sysctl)


This should not be part of this PR.

yes, please rebase

Yes of course, sorry i'm new with git stuff, will try to fix this out.

timstoop · 2018-08-23T18:26:15Z

files/limits.conf

@@ -1,2 +1,3 @@
+# MANAGED BY PUPPET


This should also not be part of this PR.

timstoop · 2018-08-23T18:26:27Z

files/profile.conf

@@ -1,2 +1,3 @@
+# MANAGED BY PUPPET


Nor should this be part of this PR.

Create license file

…s_umask

hdep · 2018-08-24T11:55:14Z

Is the rebase correct at this stage ?

timstoop · 2018-08-24T15:09:52Z

manifests/umask.pp

+
+  }
+
+


Please remove a few of these empty lines.

mcgege

Please run a pdk validate on your code, there are some code style errors ...

LICENSE

mcgege · 2018-08-26T13:10:43Z

templates/umask.sh.erb

@@ -0,0 +1,2 @@
+# MANAGED BY PUPPET
+umask <%= @system_umask %> 


Missing newline?

mcgege · 2018-08-26T13:24:06Z

manifests/umask.pp

+class os_hardening::umask (
+    $system_umask = undef,
+
+){


Please add a whitespace between these brackets

mcgege · 2018-08-27T12:30:02Z

Will look into this again when I'm back from my holiday (2 weeks) ...

…s_umask # Conflicts: # manifests/umask.pp

changing file return lines

This reverts commit d314337

mcgege · 2018-09-07T09:23:09Z

@hdep I have now tested this PR against my distributions (CentOS 7.5, OpenSUSE 15.0, Ubuntu 16.04.5), and on all systems I get this error message on login (and the umask is not changed):

: octal number out of range

I have set the parameter like this: system_umask => '027' (also tried it with '0027'), and the file /etc/profile.d/umask.sh is created correctly.

I'm at loss here ... can you test this also on another distribution?

hdep · 2018-09-07T14:44:30Z

I had an issue with my text editor which switch end of line from LF to CR/LF.
Last commit should correct this.

mcgege · 2018-09-07T14:54:18Z

Ha, right, I didn't see this ... and now it works on all distros!
Just two more things:

Also correct the eof in the two other files
Please add the parameter to the README.md

hdep · 2018-09-07T15:29:59Z

The EOL for umask.p and init.pp is set to LF on my side there is nothing to change.

hdep and others added 12 commits August 21, 2018 16:22

Fix missing Requirements

2164466

Add 'MANAGED BY PUPPET' header

b03ebcd

add a comment to indicate that the file is managed by puppet

Merge pull request #1 from hdep/add_header

fc87d47

Add 'MANAGED BY PUPPET' header

Merge pull request #2 from hdep/modify_readme

b30f384

Fix missing Requirements

Add support for setting umask for all users

7ba2da4

Change system_umask variable to String

88b8931

Add os_hardening::umask class definition

757ea75

fixing umask script

d424e45

Remove umask script if variable is undef

dbd849e

Fixing indentation

90288f0

$system_umask is Optional parameter

6718da4

Create license file

d314337

timstoop suggested changes Aug 23, 2018

View reviewed changes

timstoop and others added 9 commits August 24, 2018 11:50

Merge pull request dev-sec#153 from mcgege/license

e93bcf9

Create license file

Add support for setting umask for all users

140cb99

Change system_umask variable to String

a4c90fb

Add os_hardening::umask class definition

42138a1

fixing umask script

240c60b

Remove umask script if variable is undef

46ae050

Fixing indentation

61773b6

$system_umask is Optional parameter

786a207

Merge remote-tracking branch 'origin/support_os_umask' into support_o…

7311363

…s_umask

timstoop suggested changes Aug 24, 2018

View reviewed changes

manifests/umask.pp Outdated

}

Copy link

Contributor

timstoop Aug 24, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove a few of these empty lines.

hdep added 2 commits August 24, 2018 20:05

removing unecessary empty lines

e15851e

removing unecessary empty lines

c0da5be

timstoop approved these changes Aug 25, 2018

View reviewed changes

mcgege requested changes Aug 26, 2018

View reviewed changes

mcgege reviewed Aug 26, 2018

View reviewed changes

manifests/umask.pp Outdated

class os_hardening::umask (

$system_umask = undef,

){

Copy link

Member

mcgege Aug 26, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add a whitespace between these brackets

mcgege mentioned this pull request Aug 26, 2018

Do not allow 'other' access to home dirs #144

Closed

mcgege added this to the 2.2.0 milestone Aug 27, 2018

mcgege self-assigned this Aug 27, 2018

mcgege added the enhancement label Aug 27, 2018

hdep and others added 8 commits August 29, 2018 18:07

Fixing pdk validate error

de46082

Fixing pdk validate error

979b320

Merge remote-tracking branch 'origin/support_os_umask' into support_o…

8064b61

…s_umask # Conflicts: # manifests/umask.pp

fixing pdk validate error

05fcd32

trying to fix git errors

5bddbc9

trying to fix git errors

8fb21bf

changing file return lines

Adding an empty line at the end of the script

412c431

Revert "Create license file"

c9ba2d7

This reverts commit d314337

change line encoding to LF

6d29018

Add system_umask description

9bcb2a7

mcgege merged commit 29a9280 into dev-sec:master Sep 7, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support os umask #152

Support os umask #152

hdep commented Aug 22, 2018

timstoop left a comment

timstoop Aug 23, 2018

hdep Aug 24, 2018

timstoop Aug 23, 2018

mcgege Aug 24, 2018

hdep Aug 24, 2018

timstoop Aug 23, 2018

timstoop Aug 23, 2018

hdep commented Aug 24, 2018

timstoop Aug 24, 2018

mcgege left a comment

mcgege Aug 26, 2018

mcgege Aug 26, 2018

mcgege commented Aug 27, 2018

mcgege commented Sep 7, 2018

hdep commented Sep 7, 2018

mcgege commented Sep 7, 2018

hdep commented Sep 7, 2018

		@@ -0,0 +1,2 @@
		# MANAGED BY PUPPET
		umask <%= @system_umask %>

Support os umask #152

Support os umask #152

Conversation

hdep commented Aug 22, 2018

timstoop left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hdep commented Aug 24, 2018

Choose a reason for hiding this comment

mcgege left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mcgege commented Aug 27, 2018

mcgege commented Sep 7, 2018

hdep commented Sep 7, 2018

mcgege commented Sep 7, 2018

hdep commented Sep 7, 2018