Skip to content

Commit

Permalink
MODULES-10548: make files readonly
Browse files Browse the repository at this point in the history 
Files created by the apt module are mode writable by the
owner. Because those files are managed by Puppet, they should really
not be writable by anyone, even root. While root can bypass those
warnings, having files readonly does provide an immediate and reliable
indication that a file should not be edited on site, on top of the
usual top of file warnings.

This also fixes a problem with sources.list.d being non-executable,
which Puppet seems to ignore, but seems better to keep consistent.
  • Loading branch information
@anarcat
anarcat committed Feb 17, 2020
1 parent dcb7116 commit ab2e06b
Show file tree
Hide file tree
Showing 5 changed files with 16 additions and 16 deletions.
10 changes: 5 additions & 5 deletions manifests/init.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -230,7 +230,7 @@
path => $::apt::sources_list,
owner => root,
group => root,
mode => '0644',
mode => '0444',
notify => Class['apt::update'],
}

Expand All @@ -239,7 +239,7 @@
path => $::apt::sources_list_d,
owner => root,
group => root,
mode => '0644',
mode => '0555',
purge => $_purge['sources.list.d'],
recurse => $_purge['sources.list.d'],
notify => Class['apt::update'],
Expand All @@ -250,7 +250,7 @@
path => $::apt::preferences,
owner => root,
group => root,
mode => '0644',
mode => '0444',
notify => Class['apt::update'],
}

Expand All @@ -259,7 +259,7 @@
path => $::apt::preferences_d,
owner => root,
group => root,
mode => '0644',
mode => '0555',
purge => $_purge['preferences.d'],
recurse => $_purge['preferences.d'],
notify => Class['apt::update'],
Expand Down Expand Up @@ -308,7 +308,7 @@
ensure => $auth_conf_ensure,
owner => $auth_conf_owner,
group => 'root',
mode => '0600',
mode => '0400',
content => "${confheadertmp}${auth_conf_tmp}",
notify => Class['apt::update'],
}
Expand Down
2 changes: 1 addition & 1 deletion manifests/setting.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@
ensure => $ensure,
owner => 'root',
group => 'root',
mode => '0644',
mode => '0444',
content => $content,
source => $source,
notify => $_notify,
Expand Down
12 changes: 6 additions & 6 deletions spec/classes/apt_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,14 @@
path: '/etc/apt/sources.list',
owner: 'root',
group: 'root',
mode: '0644',
mode: '0444',
notify: 'Class[Apt::Update]' }

sources_list_d = { ensure: 'directory',
path: '/etc/apt/sources.list.d',
owner: 'root',
group: 'root',
mode: '0644',
mode: '0555',
purge: false,
recurse: false,
notify: 'Class[Apt::Update]' }
Expand All @@ -20,14 +20,14 @@
path: '/etc/apt/preferences',
owner: 'root',
group: 'root',
mode: '0644',
mode: '0444',
notify: 'Class[Apt::Update]' }

preferences_d = { ensure: 'directory',
path: '/etc/apt/preferences.d',
owner: 'root',
group: 'root',
mode: '0644',
mode: '0555',
purge: false,
recurse: false,
notify: 'Class[Apt::Update]' }
Expand Down Expand Up @@ -76,7 +76,7 @@

it 'lays down /etc/apt/apt.conf.d/15update-stamp' do
is_expected.to contain_file('/etc/apt/apt.conf.d/15update-stamp').with(group: 'root',
mode: '0644',
mode: '0444',
owner: 'root').with_content(
%r{APT::Update::Post-Invoke-Success {"touch /var/lib/apt/periodic/update-success-stamp 2>/dev/null || true";};},
)
Expand Down Expand Up @@ -301,7 +301,7 @@
is_expected.to contain_file('/etc/apt/auth.conf').with(ensure: 'present',
owner: auth_conf_owner,
group: 'root',
mode: '0600',
mode: '0400',
notify: 'Class[Apt::Update]',
content: auth_conf_content)
}
Expand Down
4 changes: 2 additions & 2 deletions spec/defines/conf_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
'content' => %r{Apt::Install-Recommends 0;\nApt::AutoRemove::InstallRecommends 1;},
'owner' => 'root',
'group' => 'root',
'mode' => '0644')
'mode' => '0444')
}

context 'with notify_update = true (default)' do
Expand Down Expand Up @@ -83,7 +83,7 @@
is_expected.to contain_file(filename).with('ensure' => 'absent',
'owner' => 'root',
'group' => 'root',
'mode' => '0644')
'mode' => '0444')
}
end
end
4 changes: 2 additions & 2 deletions spec/defines/setting_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@
is_expected.to contain_file('/etc/apt/apt.conf.d/50teddybear').that_notifies('Class[Apt::Update]').with(ensure: 'file',
owner: 'root',
group: 'root',
mode: '0644',
mode: '0444',
source: params[:source].to_s)
}
end
Expand All @@ -62,7 +62,7 @@
is_expected.to contain_file('/etc/apt/apt.conf.d/50teddybear').that_notifies('Class[Apt::Update]').with(ensure: 'file',
owner: 'root',
group: 'root',
mode: '0644',
mode: '0444',
content: params[:content].to_s)
}
end
Expand Down

0 comments on commit ab2e06b

Please sign in to comment.