Ansible/Bash remediations: add explicit file permissions to all file-creating tasks and commands - #14947
Open
macko1 wants to merge 8 commits into
Open
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
This datastream diff is auto generated by the check Click here to see the trimmed diffansible remediation for rule 'xccdf_org.ssgproject.content_rule_aide_build_database' differs.
--- xccdf_org.ssgproject.content_rule_aide_build_database
+++ xccdf_org.ssgproject.content_rule_aide_build_database
@@ -82,6 +82,7 @@
dest: /var/lib/aide/aide.db.gz
backup: true
remote_src: true
+ mode: 420
when:
- '"kernel-core" in ansible_facts.packages'
- aide_database_init is changed
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_aide_check_audit_tools' differs.
--- xccdf_org.ssgproject.content_rule_aide_check_audit_tools
+++ xccdf_org.ssgproject.content_rule_aide_check_audit_tools
@@ -94,6 +94,7 @@
regexp: ^{{ item }}\s
line: '{{ item }} p+i+n+u+g+s+b+acl+xattrs+sha512'
create: true
+ mode: 420
with_items: '{{ audit_tools }}'
when:
- '"kernel-core" in ansible_facts.packages'
@@ -116,6 +117,7 @@
path: /etc/aide.conf
line: '{{ item }} p+i+n+u+g+s+b+acl+xattrs+sha512'
create: true
+ mode: 420
with_items: '{{ audit_tools }}'
when:
- '"kernel-core" in ansible_facts.packages'
bash remediation for rule 'xccdf_org.ssgproject.content_rule_enable_fips_mode' differs.
--- xccdf_org.ssgproject.content_rule_enable_fips_mode
+++ xccdf_org.ssgproject.content_rule_enable_fips_mode
@@ -5,6 +5,7 @@
cat > /usr/lib/bootc/kargs.d/01-fips.toml << EOF
kargs = ["fips=1"]
EOF
+ chmod 0644 /usr/lib/bootc/kargs.d/01-fips.toml
fi
else
bash remediation for rule 'xccdf_org.ssgproject.content_rule_fips_custom_stig_sub_policy' differs.
--- xccdf_org.ssgproject.content_rule_fips_custom_stig_sub_policy
+++ xccdf_org.ssgproject.content_rule_fips_custom_stig_sub_policy
@@ -5,6 +5,7 @@
cipher@SSH=AES-256-GCM AES-256-CTR AES-128-GCM AES-128-CTR
mac@SSH=HMAC-SHA2-512 HMAC-SHA2-256
EOF
+chmod 0644 /etc/crypto-policies/policies/modules/STIG.pmod
sudo update-crypto-policies --set FIPS:STIG
bash remediation for rule 'xccdf_org.ssgproject.content_rule_configure_custom_crypto_policy_cis' differs.
--- xccdf_org.ssgproject.content_rule_configure_custom_crypto_policy_cis
+++ xccdf_org.ssgproject.content_rule_configure_custom_crypto_policy_cis
@@ -6,21 +6,25 @@
cat << 'EOF' > /etc/crypto-policies/policies/modules/NO-SSHCBC.pmod
cipher@SSH = -*-CBC
EOF
+chmod 0644 /etc/crypto-policies/policies/modules/NO-SSHCBC.pmod
expected_crypto_policy="${expected_crypto_policy}:NO-SSHWEAKCIPHERS"
cat << 'EOF' > /etc/crypto-policies/policies/modules/NO-SSHWEAKCIPHERS.pmod
cipher@SSH = -3DES-CBC -AES-128-CBC -AES-192-CBC -AES-256-CBC -CHACHA20-POLY1305
EOF
+chmod 0644 /etc/crypto-policies/policies/modules/NO-SSHWEAKCIPHERS.pmod
expected_crypto_policy="${expected_crypto_policy}:NO-SSHWEAKMACS"
cat << 'EOF' > /etc/crypto-policies/policies/modules/NO-SSHWEAKMACS.pmod
mac@SSH = -HMAC-MD5* -UMAC-64* -UMAC-128*
EOF
+chmod 0644 /etc/crypto-policies/policies/modules/NO-SSHWEAKMACS.pmod
expected_crypto_policy="${expected_crypto_policy}:NO-WEAKMAC"
cat << 'EOF' > /etc/crypto-policies/policies/modules/NO-WEAKMAC.pmod
mac = -*-128*
EOF
+chmod 0644 /etc/crypto-policies/policies/modules/NO-WEAKMAC.pmod
current_crypto_policy=$(update-crypto-policies --show)
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_configure_gnutls_tls_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_configure_gnutls_tls_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_gnutls_tls_crypto_policy
@@ -34,6 +34,7 @@
regexp: '{{ lineinfile_reg }}'
line: '{{ correct_value }}'
create: true
+ mode: 420
when: not gnutls_file.stat.exists or gnutls_file.stat.size <= correct_value|length
tags:
- CCE-84254-2
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy
@@ -22,6 +22,7 @@
path: /etc/ipsec.conf
line: include /etc/crypto-policies/back-ends/libreswan.config
create: true
+ mode: 420
when: ( "libreswan" in ansible_facts.packages and "kernel-core" in ansible_facts.packages
)
tags:
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
+++ xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy
@@ -75,6 +75,7 @@
insertafter: ^\s*\[\s*crypto_policy\s*]\s*
line: .include /etc/crypto-policies/back-ends/opensslcnf.config
path: /etc/pki/tls/openssl.cnf
+ mode: 420
when:
- '"openssl" in ansible_facts.packages'
- test_crypto_policy_group.matched > 0
@@ -104,6 +105,7 @@
[crypto_policy]
.include /etc/crypto-policies/back-ends/opensslcnf.config
path: /etc/pki/tls/openssl.cnf
+ mode: 420
when:
- '"openssl" in ansible_facts.packages'
- test_crypto_policy_group.matched == 0
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_harden_openssl_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_harden_openssl_crypto_policy
+++ xccdf_org.ssgproject.content_rule_harden_openssl_crypto_policy
@@ -84,6 +84,7 @@
exists in /etc/crypto-policies/local.d/opensslcnf-ospp.config
ansible.builtin.copy:
dest: /etc/crypto-policies/local.d/opensslcnf-ospp.config
+ mode: 420
content: |2
Ciphersuites = TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
bash remediation for rule 'xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_openssh_conf_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_openssh_conf_crypto_policy
+++ xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_openssh_conf_crypto_policy
@@ -6,6 +6,7 @@
LC_ALL=C sed -i "/^.*Ciphers\s\+/d" "/etc/crypto-policies/back-ends/openssh.config"
else
touch "/etc/crypto-policies/back-ends/openssh.config"
+ chmod 0644 "/etc/crypto-policies/back-ends/openssh.config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/crypto-policies/back-ends/openssh.config"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_opensshserver_conf_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_opensshserver_conf_crypto_policy
+++ xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_opensshserver_conf_crypto_policy
@@ -27,9 +27,11 @@
fi
# Write updated line to LOCAL_CONF_FILE
echo -e "\n$last_crypto_policy" > "$LOCAL_CONF_FILE"
+ chmod 0644 "$LOCAL_CONF_FILE"
fi
else
echo -e "\nCRYPTO_POLICY='${correct_value}'" > ${LOCAL_CONF_FILE}
+ chmod 0644 "${LOCAL_CONF_FILE}"
fi
update-crypto-policies --no-reload
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_opensshserver_conf_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_opensshserver_conf_crypto_policy
+++ xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_opensshserver_conf_crypto_policy
@@ -156,6 +156,7 @@
ansible.builtin.file:
path: '{{ local_path | dirname }}'
state: directory
+ mode: 493
when: '"kernel-core" in ansible_facts.packages'
tags:
- CCE-85897-7
@@ -176,6 +177,7 @@
' ~ updated_crypto_policy }}
create: true
insertafter: EOF
+ mode: 420
register: local_config
when:
- '"kernel-core" in ansible_facts.packages'
bash remediation for rule 'xccdf_org.ssgproject.content_rule_harden_sshd_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_harden_sshd_crypto_policy
+++ xccdf_org.ssgproject.content_rule_harden_sshd_crypto_policy
@@ -6,6 +6,7 @@
#blank line at the beginning to ease later readability
echo '' > "$file"
+chmod 0644 "$file"
echo "$cp" >> "$file"
update-crypto-policies
bash remediation for rule 'xccdf_org.ssgproject.content_rule_harden_sshd_macs_openssh_conf_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_harden_sshd_macs_openssh_conf_crypto_policy
+++ xccdf_org.ssgproject.content_rule_harden_sshd_macs_openssh_conf_crypto_policy
@@ -6,6 +6,7 @@
LC_ALL=C sed -i "/^.*MACs\s\+/d" "/etc/crypto-policies/back-ends/openssh.config"
else
touch "/etc/crypto-policies/back-ends/openssh.config"
+ chmod 0644 "/etc/crypto-policies/back-ends/openssh.config"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/crypto-policies/back-ends/openssh.config"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_harden_sshd_macs_opensshserver_conf_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_harden_sshd_macs_opensshserver_conf_crypto_policy
+++ xccdf_org.ssgproject.content_rule_harden_sshd_macs_opensshserver_conf_crypto_policy
@@ -27,9 +27,11 @@
fi
# Write updated line to LOCAL_CONF_FILE
echo -e "\n$last_crypto_policy" > "$LOCAL_CONF_FILE"
+ chmod 0644 "$LOCAL_CONF_FILE"
fi
else
echo -e "\nCRYPTO_POLICY='${correct_value}'" > ${LOCAL_CONF_FILE}
+ chmod 0644 "${LOCAL_CONF_FILE}"
fi
update-crypto-policies --no-reload
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_harden_sshd_macs_opensshserver_conf_crypto_policy' differs.
--- xccdf_org.ssgproject.content_rule_harden_sshd_macs_opensshserver_conf_crypto_policy
+++ xccdf_org.ssgproject.content_rule_harden_sshd_macs_opensshserver_conf_crypto_policy
@@ -156,6 +156,7 @@
ansible.builtin.file:
path: '{{ local_path | dirname }}'
state: directory
+ mode: 493
when: '"kernel-core" in ansible_facts.packages'
tags:
- CCE-85899-3
@@ -176,6 +177,7 @@
' ~ updated_crypto_policy }}
create: true
insertafter: EOF
+ mode: 420
register: local_config
when:
- '"kernel-core" in ansible_facts.packages'
bash remediation for rule 'xccdf_org.ssgproject.content_rule_openssl_use_strong_entropy' differs.
--- xccdf_org.ssgproject.content_rule_openssl_use_strong_entropy
+++ xccdf_org.ssgproject.content_rule_openssl_use_strong_entropy
@@ -29,3 +29,4 @@
exec $openssl_bin "$@"
)
EOM
+chmod 0644 /etc/profile.d/openssl-rand.sh
bash remediation for rule 'xccdf_org.ssgproject.content_rule_xwayland_disabled' differs.
--- xccdf_org.ssgproject.content_rule_xwayland_disabled
+++ xccdf_org.ssgproject.content_rule_xwayland_disabled
@@ -34,6 +34,7 @@
if ! $found ; then
file=$(echo "/etc/gdm/custom.conf" | cut -f1 -d ' ')
mkdir -p "$(dirname "$file")"
+ chmod 0755 "$(dirname "$file")"
echo -e "[daemon]\nWaylandEnable=false" >> "$file"
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_xwayland_disabled' differs.
--- xccdf_org.ssgproject.content_rule_xwayland_disabled
+++ xccdf_org.ssgproject.content_rule_xwayland_disabled
@@ -18,6 +18,7 @@
value: 'false'
create: true
state: present
+ mode: 420
when: '"gdm" in ansible_facts.packages'
tags:
- CCE-86968-5
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/gdm.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/gdm.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown
@@ -21,6 +21,7 @@
value: 'true'
create: true
no_extra_spaces: true
+ mode: 420
register: result_ini
when: '"gdm" in ansible_facts.packages'
tags:
@@ -42,6 +43,7 @@
regexp: ^/org/gnome/login-screen/disable-restart-buttons
line: /org/gnome/login-screen/disable-restart-buttons
create: true
+ mode: 420
register: result_lineinfile
when: '"gdm" in ansible_facts.packages'
tags:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/gdm.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/gdm.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list
@@ -21,6 +21,7 @@
value: 'true'
no_extra_spaces: true
create: true
+ mode: 420
register: result_ini
when: '"gdm" in ansible_facts.packages'
tags:
@@ -41,6 +42,7 @@
regexp: ^/org/gnome/login-screen/disable-user-list$
line: /org/gnome/login-screen/disable-user-list
create: true
+ mode: 420
register: result_lineinfile
when: '"gdm" in ansible_facts.packages'
tags:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/gdm.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/gdm.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth
@@ -23,6 +23,7 @@
value: 'true'
create: true
no_extra_spaces: true
+ mode: 420
register: result_ini
when: '"gdm" in ansible_facts.packages'
tags:
@@ -45,6 +46,7 @@
regexp: ^/org/gnome/login-screen/enable-smartcard-authentication$
line: /org/gnome/login-screen/enable-smartcard-authentication
create: true
+ mode: 420
register: result_lineinfile
when: '"gdm" in ansible_facts.packages'
tags:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal
@@ -34,6 +34,7 @@
option: removal-action
value: '''lock-screen'''
create: true
+ mode: 420
when:
- '"gdm" in ansible_facts.packages'
- dconf_gnome_lock_screen_on_smartcard_removal_config_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_config_files.matched
@@ -56,6 +57,7 @@
option: removal-action
value: '''lock-screen'''
create: true
+ mode: 420
with_items: '{{ dconf_gnome_lock_screen_on_smartcard_removal_config_files.files
}}'
when:
@@ -95,6 +97,7 @@
regexp: ^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$
line: /org/gnome/settings-daemon/peripherals/smartcard/removal-action
create: true
+ mode: 420
when:
- '"gdm" in ansible_facts.packages'
- dconf_gnome_lock_screen_on_smartcard_removal_lock_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_lock_files.matched
@@ -115,6 +118,7 @@
regexp: ^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$
line: /org/gnome/settings-daemon/peripherals/smartcard/removal-action
create: true
+ mode: 420
with_items: '{{ dconf_gnome_lock_screen_on_smartcard_removal_lock_files.files }}'
when:
- '"gdm" in ansible_facts.packages'
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/gdm.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/gdm.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries
@@ -19,6 +19,7 @@
value: '3'
create: true
no_extra_spaces: true
+ mode: 420
register: result_ini
when: '"gdm" in ansible_facts.packages'
tags:
@@ -37,6 +38,7 @@
regexp: ^/org/gnome/login-screen/allowed-failures$
line: /org/gnome/login-screen/allowed-failures
create: true
+ mode: 420
register: result_lineinfile
when: '"gdm" in ansible_facts.packages'
tags:
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login' differs.
--- xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login
+++ xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login
@@ -25,6 +25,7 @@
value: 'false'
no_extra_spaces: true
create: true
+ mode: 420
when: '"gdm" in ansible_facts.packages'
tags:
- CCE-80823-8
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_gnome_gdm_disable_guest_login' differs.
--- xccdf_org.ssgproject.content_rule_gnome_gdm_disable_guest_login
+++ xccdf_org.ssgproject.content_rule_gnome_gdm_disable_guest_login
@@ -25,6 +25,7 @@
value: 'false'
no_extra_spaces: true
create: true
+ mode: 420
when: '"gdm" in ansible_facts.packages'
tags:
- CCE-80824-6
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount
@@ -12,6 +12,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -43,6 +44,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount
@@ -18,6 +18,7 @@
- name: Disable GNOME3 Automounting - automount
community.general.ini_file:
+ mode: 420
dest: /etc/dconf/db/local.d/00-security-settings
section: org/gnome/desktop/media-handling
option: automount
@@ -43,6 +44,7 @@
- name: Prevent user modification of GNOME3 Automounting - automount
ansible.builtin.lineinfile:
+ mode: 420
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
regexp: ^/org/gnome/desktop/media-handling/automount$
line: /org/gnome/desktop/media-handling/automount
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open
@@ -12,6 +12,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -43,6 +44,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open
@@ -18,6 +18,7 @@
- name: Disable GNOME3 Automounting - automount-open
community.general.ini_file:
+ mode: 420
dest: /etc/dconf/db/local.d/00-security-settings
section: org/gnome/desktop/media-handling
option: automount-open
@@ -43,6 +44,7 @@
- name: Prevent user modification of GNOME3 Automounting - automount-open
ansible.builtin.lineinfile:
+ mode: 420
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
regexp: ^/org/gnome/desktop/media-handling/automount-open$
line: /org/gnome/desktop/media-handling/automount-open
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun
@@ -16,6 +16,7 @@
- name: Disable GNOME3 Automounting - autorun-never
community.general.ini_file:
+ mode: 420
dest: /etc/dconf/db/local.d/00-security-settings
section: org/gnome/desktop/media-handling
option: autorun-never
@@ -39,6 +40,7 @@
- name: Prevent user modification of GNOME3 Automounting - autorun-never
ansible.builtin.lineinfile:
+ mode: 420
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
regexp: ^/org/gnome/desktop/media-handling/autorun-never$
line: /org/gnome/desktop/media-handling/autorun-never
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers
@@ -20,6 +20,7 @@
value: 'true'
create: true
no_extra_spaces: true
+ mode: 420
register: result_ini
when: '"gdm" in ansible_facts.packages'
tags:
@@ -39,6 +40,7 @@
regexp: ^/org/gnome/desktop/thumbnailers/disable-all$
line: /org/gnome/desktop/thumbnailers/disable-all
create: true
+ mode: 420
register: result_lineinfile
when: '"gdm" in ansible_facts.packages'
tags:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create
@@ -18,6 +18,7 @@
value: 'true'
create: true
no_extra_spaces: true
+ mode: 420
register: result_ini
when: '"gdm" in ansible_facts.packages'
tags:
@@ -35,6 +36,7 @@
regexp: ^/org/gnome/nm-applet/disable-wifi-create$
line: /org/gnome/nm-applet/disable-wifi-create
create: true
+ mode: 420
register: result_lineinfile
when: '"gdm" in ansible_facts.packages'
tags:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification
@@ -18,6 +18,7 @@
value: 'true'
create: true
no_extra_spaces: true
+ mode: 420
register: result_ini
when: '"gdm" in ansible_facts.packages'
tags:
@@ -35,6 +36,7 @@
regexp: ^/org/gnome/nm-applet/suppress-wireless-networks-available$
line: /org/gnome/nm-applet/suppress-wireless-networks-available
create: true
+ mode: 420
register: result_lineinfile
when: '"gdm" in ansible_facts.packages'
tags:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt
@@ -13,6 +13,7 @@
- name: Require Credential Prompting for Remote Access in GNOME3
community.general.ini_file:
+ mode: 420
dest: /etc/dconf/db/local.d/00-security-settings
section: org/gnome/Vino
option: authentication-methods
@@ -33,6 +34,7 @@
- name: Prevent user modification of GNOME3 Credential Prompting for Remote Access
ansible.builtin.lineinfile:
+ mode: 420
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
regexp: ^/org/gnome/Vino/authentication-methods$
line: /org/gnome/Vino/authentication-methods
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption
@@ -16,6 +16,7 @@
- name: Require Encryption for Remote Access in GNOME3
community.general.ini_file:
+ mode: 420
dest: /etc/dconf/db/local.d/00-security-settings
section: org/gnome/Vino
option: require-encryption
@@ -39,6 +40,7 @@
- name: Prevent user modification of GNOME3 Encryption for Remote Access
ansible.builtin.lineinfile:
+ mode: 420
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
regexp: ^/org/gnome/Vino/require-encryption$
line: /org/gnome/Vino/require-encryption
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled
@@ -19,6 +19,7 @@
- name: Enable GNOME3 Screensaver Idle Activation
community.general.ini_file:
+ mode: 420
dest: /etc/dconf/db/local.d/00-security-settings
section: org/gnome/desktop/screensaver
option: idle-activation-enabled
@@ -45,6 +46,7 @@
- name: Prevent user modification of GNOME idle-activation-enabled
ansible.builtin.lineinfile:
+ mode: 420
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
regexp: ^/org/gnome/desktop/screensaver/idle-activation-enabled$
line: /org/gnome/desktop/screensaver/idle-activation-enabled
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_locked' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_locked
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_locked
@@ -7,6 +7,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_locked' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_locked
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_locked
@@ -20,6 +20,7 @@
regexp: ^/org/gnome/desktop/screensaver/idle-activation-enabled$
line: /org/gnome/desktop/screensaver/idle-activation-enabled
create: true
+ mode: 420
register: result_lineinfile
when: '"gdm" in ansible_facts.packages'
tags:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay
@@ -14,6 +14,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay
@@ -25,6 +25,7 @@
- name: Set GNOME3 Screensaver Inactivity Timeout
community.general.ini_file:
+ mode: 420
dest: /etc/dconf/db/local.d/00-security-settings
section: org/gnome/desktop/session
option: idle-delay
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay
@@ -14,6 +14,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay
@@ -24,6 +24,7 @@
- name: Set GNOME3 Screensaver Lock Delay After Activation Period
community.general.ini_file:
+ mode: 420
dest: /etc/dconf/db/local.d/00-security-settings
section: org/gnome/desktop/screensaver
option: lock-delay
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled
@@ -26,6 +26,7 @@
value: 'true'
create: true
no_extra_spaces: true
+ mode: 420
when:
- '"gdm" in ansible_facts.packages'
- ansible_distribution != 'SLES'
@@ -53,6 +54,7 @@
regexp: ^/org/gnome/desktop/screensaver/lock-enabled$
line: /org/gnome/desktop/screensaver/lock-enabled
create: true
+ mode: 420
when:
- '"gdm" in ansible_facts.packages'
- ansible_distribution != 'SLES'
@@ -82,6 +84,7 @@
value: 'false'
create: true
no_extra_spaces: true
+ mode: 420
when:
- '"gdm" in ansible_facts.packages'
- ansible_distribution == 'SLES'
@@ -109,6 +112,7 @@
regexp: ^/org/gnome/desktop/lockdown/disable-lock-screen$
line: /org/gnome/desktop/lockdown/disable-lock-screen
create: true
+ mode: 420
when:
- '"gdm" in ansible_facts.packages'
- ansible_distribution == 'SLES'
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_locked' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_locked
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_locked
@@ -7,6 +7,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_locked' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_locked
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_locked
@@ -21,6 +21,7 @@
regexp: ^/org/gnome/desktop/screensaver/lock-enabled$
line: /org/gnome/desktop/screensaver/lock-enabled
create: true
+ mode: 420
register: result_lineinfile
when: '"gdm" in ansible_facts.packages'
tags:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank
@@ -20,6 +20,7 @@
- name: Implement Blank Screensaver
community.general.ini_file:
+ mode: 420
dest: /etc/dconf/db/local.d/00-security-settings
section: org/gnome/desktop/screensaver
option: picture-uri
@@ -47,6 +48,7 @@
- name: Prevent user modification of GNOME picture-uri
ansible.builtin.lineinfile:
+ mode: 420
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
regexp: ^/org/gnome/desktop/screensaver/picture-uri$
line: /org/gnome/desktop/screensaver/picture-uri
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info
@@ -18,6 +18,7 @@
value: 'false'
create: true
no_extra_spaces: true
+ mode: 420
register: result_ini
when: '"gdm" in ansible_facts.packages'
tags:
@@ -35,6 +36,7 @@
regexp: ^/org/gnome/desktop/screensaver/show-full-name-in-top-bar$
line: /org/gnome/desktop/screensaver/show-full-name-in-top-bar
create: true
+ mode: 420
register: result_lineinfile
when: '"gdm" in ansible_facts.packages'
tags:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks
@@ -7,6 +7,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks
@@ -15,6 +15,7 @@
- name: Prevent user modification of GNOME lock-delay
ansible.builtin.lineinfile:
+ mode: 420
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
regexp: ^/org/gnome/desktop/screensaver/lock-delay$
line: /org/gnome/desktop/screensaver/lock-delay
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks
@@ -7,6 +7,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks
@@ -18,6 +18,7 @@
- name: Prevent user modification of GNOME Session idle-delay
ansible.builtin.lineinfile:
+ mode: 420
path: /etc/dconf/db/local.d/locks/00-security-settings-lock
regexp: ^/org/gnome/desktop/session/idle-delay$
line: /org/gnome/desktop/session/idle-delay
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot
@@ -23,6 +23,7 @@
value: '['''']'
create: true
no_extra_spaces: true
+ mode: 420
register: result_ini
when: '"gdm" in ansible_facts.packages'
tags:
@@ -45,6 +46,7 @@
regexp: ^/org/gnome/settings-daemon/plugins/media-keys/logout$
line: /org/gnome/settings-daemon/plugins/media-keys/logout
create: true
+ mode: 420
register: result_lineinfile
when: '"gdm" in ansible_facts.packages'
tags:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -44,6 +45,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -75,6 +77,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
@@ -93,6 +96,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation
@@ -17,6 +17,7 @@
value: 'false'
create: true
no_extra_spaces: true
+ mode: 420
register: result_ini1
when: '"gdm" in ansible_facts.packages'
tags:
@@ -34,6 +35,7 @@
option: gelocation
value: 'false'
create: true
+ mode: 420
register: result_ini2
when: '"gdm" in ansible_facts.packages'
tags:
@@ -50,6 +52,7 @@
regexp: ^/org/gnome/system/location/enabled$
line: /org/gnome/system/location/enabled
create: true
+ mode: 420
register: result_lineinfile1
when: '"gdm" in ansible_facts.packages'
tags:
@@ -66,6 +69,7 @@
regexp: ^/org/gnome/clocks/geolocation$
line: /org/gnome/clocks/geolocation
create: true
+ mode: 420
register: result_lineinfile2
when: '"gdm" in ansible_facts.packages'
tags:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/local.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/local.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin
@@ -34,6 +34,7 @@
option: user-administration-disabled
value: 'true'
create: true
+ mode: 420
when:
- '"gdm" in ansible_facts.packages'
- dconf_gnome_disable_user_admin_config_files is defined and dconf_gnome_disable_user_admin_config_files.matched
@@ -56,6 +57,7 @@
option: user-administration-disabled
value: 'true'
create: true
+ mode: 420
with_items: '{{ dconf_gnome_disable_user_admin_config_files.files }}'
when:
- '"gdm" in ansible_facts.packages'
@@ -94,6 +96,7 @@
regexp: ^/org/gnome/desktop/lockdown/user-administration-disabled$
line: /org/gnome/desktop/lockdown/user-administration-disabled
create: true
+ mode: 420
when:
- '"gdm" in ansible_facts.packages'
- dconf_gnome_disable_user_admin_lock_files is defined and dconf_gnome_disable_user_admin_lock_files.matched
@@ -114,6 +117,7 @@
regexp: ^/org/gnome/desktop/lockdown/user-administration-disabled$
line: /org/gnome/desktop/lockdown/user-administration-disabled
create: true
+ mode: 420
with_items: '{{ dconf_gnome_disable_user_admin_lock_files.files }}'
when:
- '"gdm" in ansible_facts.packages'
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sudo_require_reauthentication' differs.
--- xccdf_org.ssgproject.content_rule_sudo_require_reauthentication
+++ xccdf_org.ssgproject.content_rule_sudo_require_reauthentication
@@ -12,6 +12,7 @@
if /usr/sbin/visudo -qcf /etc/sudoers; then
cp /etc/sudoers /etc/sudoers.bak
+ chmod 0440 /etc/sudoers.bak
if ! grep -P '^[\s]*Defaults.*timestamp_timeout[\s]*=[\s]*[-]?\w+.*$' /etc/sudoers; then
# sudoers file doesn't define Option timestamp_timeout
echo "Defaults timestamp_timeout=${var_sudo_timestamp_timeout}" >> /etc/sudoers
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sudoers_validate_passwd' differs.
--- xccdf_org.ssgproject.content_rule_sudoers_validate_passwd
+++ xccdf_org.ssgproject.content_rule_sudoers_validate_passwd
@@ -24,6 +24,7 @@
LC_ALL=C sed -i "/Defaults !targetpw/d" "/etc/sudoers"
else
touch "/etc/sudoers"
+ chmod 0644 "/etc/sudoers"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/sudoers"
@@ -37,6 +38,7 @@
LC_ALL=C sed -i "/Defaults !rootpw/d" "/etc/sudoers"
else
touch "/etc/sudoers"
+ chmod 0644 "/etc/sudoers"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/sudoers"
@@ -50,6 +52,7 @@
LC_ALL=C sed -i "/Defaults !runaspw/d" "/etc/sudoers"
else
touch "/etc/sudoers"
+ chmod 0644 "/etc/sudoers"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/sudoers"
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_clean_components_post_updating' differs.
--- xccdf_org.ssgproject.content_rule_clean_components_post_updating
+++ xccdf_org.ssgproject.content_rule_clean_components_post_updating
@@ -24,6 +24,7 @@
line: clean_requirements_on_remove=1
insertafter: \[main\]
create: true
+ mode: 420
when: ( not ( "kernel-core" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
and "ostree" in ansible_proc_cmdline ) and "yum" in ansible_facts.packages )
bash remediation for rule 'xccdf_org.ssgproject.content_rule_disable_weak_deps' differs.
--- xccdf_org.ssgproject.content_rule_disable_weak_deps
+++ xccdf_org.ssgproject.content_rule_disable_weak_deps
@@ -34,6 +34,7 @@
if ! $found ; then
file=$(echo "/etc/dnf/dnf.conf" | cut -f1 -d ' ')
mkdir -p "$(dirname "$file")"
+ chmod 0755 "$(dirname "$file")"
echo -e "[main]\ninstall_weak_deps=0" >> "$file"
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_disable_weak_deps' differs.
--- xccdf_org.ssgproject.content_rule_disable_weak_deps
+++ xccdf_org.ssgproject.content_rule_disable_weak_deps
@@ -18,6 +18,7 @@
value: 0
create: true
state: present
+ mode: 420
when: '"dnf" in ansible_facts.packages'
tags:
- CCE-88727-3
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates' differs.
--- xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates
+++ xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates
@@ -34,6 +34,7 @@
if ! $found ; then
file=$(echo "/etc/dnf/automatic.conf" | cut -f1 -d ' ')
mkdir -p "$(dirname "$file")"
+ chmod 0755 "$(dirname "$file")"
echo -e "[commands]\napply_updates=yes" >> "$file"
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates' differs.
--- xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates
+++ xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates
@@ -20,6 +20,7 @@
option: apply_updates
value: 'yes'
create: true
+ mode: 420
when: ( not ( "kernel-core" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only' differs.
--- xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only
+++ xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only
@@ -34,6 +34,7 @@
if ! $found ; then
file=$(echo "/etc/dnf/automatic.conf" | cut -f1 -d ' ')
mkdir -p "$(dirname "$file")"
+ chmod 0755 "$(dirname "$file")"
echo -e "[commands]\nupgrade_type=security" >> "$file"
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only' differs.
--- xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only
+++ xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only
@@ -20,6 +20,7 @@
option: upgrade_type
value: security
create: true
+ mode: 420
when: ( not ( "kernel-core" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages
and "bootc" in ansible_facts.packages and not "openshift-kubelet" in ansible_facts.packages
and "ostree" in ansible_proc_cmdline ) and not ( ansible_virtualization_type in
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages' differs.
--- xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages
+++ xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages
@@ -40,6 +40,7 @@
value: 1
no_extra_spaces: true
create: true
+ mode: 420
when: '"yum" in ansible_facts.packages'
tags:
- CCE-80791-7
bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue
@@ -3,6 +3,7 @@
login_banner_contents=$(echo "" | sed 's/\\n/\n/g')
echo "$login_banner_contents" > /etc/issue
+chmod 0644 /etc/issue
else
>&2 echo 'Remediation is not applicable, nothing was done'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue
@@ -22,6 +22,7 @@
- name: Modify the System Login Banner - Ensure Correct Banner
ansible.builtin.copy:
dest: /etc/issue
+ mode: 420
content: |
{{ login_banner_contents | replace('\n', '
') }}
bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue_cis' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue_cis
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue_cis
@@ -4,6 +4,7 @@
cis_banner_text=''
echo "$cis_banner_text" > "/etc/issue"
+chmod 0644 "/etc/issue"
else
>&2 echo 'Remediation is not applicable, nothing was done'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue_cis' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue_cis
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue_cis
@@ -20,6 +20,7 @@
ansible.builtin.copy:
content: '{{ cis_banner_text }}'
dest: /etc/issue
+ mode: 420
when: '"kernel-core" in ansible_facts.packages'
tags:
- CCE-86160-9
bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue_net' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue_net
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue_net
@@ -3,6 +3,7 @@
remote_login_banner_contents=$(echo "" | sed 's/\\n/\n/g')
echo "$remote_login_banner_contents" > /etc/issue.net
+chmod 0644 /etc/issue.net
else
>&2 echo 'Remediation is not applicable, nothing was done'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue_net' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue_net
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue_net
@@ -18,6 +18,7 @@
- name: Modify the System Login Banner for Remote Connections - ensure correct banner
ansible.builtin.copy:
dest: /etc/issue.net
+ mode: 420
content: |
{{ remote_login_banner_contents | replace('\n', '
') }}
bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis
@@ -4,6 +4,7 @@
cis_banner_text=''
echo "$cis_banner_text" > "/etc/issue.net"
+chmod 0644 "/etc/issue.net"
else
>&2 echo 'Remediation is not applicable, nothing was done'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis
+++ xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis
@@ -20,6 +20,7 @@
ansible.builtin.copy:
content: '{{ cis_banner_text }}'
dest: /etc/issue.net
+ mode: 420
when: '"kernel-core" in ansible_facts.packages'
tags:
- CCE-86167-4
bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_motd' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_motd
+++ xccdf_org.ssgproject.content_rule_banner_etc_motd
@@ -3,6 +3,7 @@
motd_banner_contents=$(echo "" | sed 's/\\n/\n/g')
echo "$motd_banner_contents" > /etc/motd
+chmod 0644 /etc/motd
else
>&2 echo 'Remediation is not applicable, nothing was done'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_motd' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_motd
+++ xccdf_org.ssgproject.content_rule_banner_etc_motd
@@ -18,6 +18,7 @@
- name: Modify the System Message of the Day Banner - ensure correct banner
ansible.builtin.copy:
dest: /etc/motd
+ mode: 420
content: |
{{ motd_banner_contents | replace('\n', '
') }}
bash remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_motd_cis' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_motd_cis
+++ xccdf_org.ssgproject.content_rule_banner_etc_motd_cis
@@ -4,6 +4,7 @@
cis_banner_text=''
echo "$cis_banner_text" > "/etc/motd"
+chmod 0644 "/etc/motd"
else
>&2 echo 'Remediation is not applicable, nothing was done'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_banner_etc_motd_cis' differs.
--- xccdf_org.ssgproject.content_rule_banner_etc_motd_cis
+++ xccdf_org.ssgproject.content_rule_banner_etc_motd_cis
@@ -19,6 +19,7 @@
ansible.builtin.copy:
content: '{{ cis_banner_text }}'
dest: /etc/motd
+ mode: 420
when: '"kernel-core" in ansible_facts.packages'
tags:
- CCE-86145-0
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled
@@ -10,6 +10,7 @@
DBDIR="/etc/dconf/db/gdm.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -41,6 +42,7 @@
LOCKSFOLDER="/etc/dconf/db/gdm.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled
@@ -23,6 +23,7 @@
value: 'true'
create: true
no_extra_spaces: true
+ mode: 420
register: result_ini
when: '"gdm" in ansible_facts.packages'
tags:
@@ -45,6 +46,7 @@
regexp: ^/org/gnome/login-screen/banner-message-enable$
line: /org/gnome/login-screen/banner-message-enable
create: true
+ mode: 420
register: result_lineinfile
when: '"gdm" in ansible_facts.packages'
tags:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
@@ -11,6 +11,7 @@
DBDIR="/etc/dconf/db/gdm.d"
mkdir -p "${DBDIR}"
+chmod 0755 "${DBDIR}"
# Comment out the configurations in databases different from the target one
if [ "${#SETTINGSFILES[@]}" -ne 0 ]
@@ -42,6 +43,7 @@
LOCKSFOLDER="/etc/dconf/db/gdm.d/locks"
mkdir -p "${LOCKSFOLDER}"
+chmod 0755 "${LOCKSFOLDER}"
# Comment out the configurations in databases different from the target one
if [[ ! -z "${LOCKFILES}" ]]
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
@@ -75,6 +75,7 @@
value: '''{{ dconf_login_banner_contents }}'''
create: true
no_extra_spaces: true
+ mode: 420
register: result_ini
when: '"gdm" in ansible_facts.packages'
tags:
@@ -97,6 +98,7 @@
line: /org/gnome/login-screen/banner-message-text
create: true
state: present
+ mode: 420
register: result_lineinfile
when: '"gdm" in ansible_facts.packages'
tags:
bash remediation for rule 'xccdf_org.ssgproject.content_rule_account_password_selinux_faillock_dir' differs.
--- xccdf_org.ssgproject.content_rule_account_password_selinux_faillock_dir
+++ xccdf_org.ssgproject.content_rule_account_password_selinux_faillock_dir
@@ -16,6 +16,7 @@
fi
if [ ! -e $dir ]; then
mkdir -p $dir
+ chmod 0755 "$dir"
fi
/usr/sbin/restorecon -R -v $dir
done
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_account_password_selinux_faillock_dir' differs.
--- xccdf_org.ssgproject.content_rule_account_password_selinux_faillock_dir
+++ xccdf_org.ssgproject.content_rule_account_password_selinux_faillock_dir
@@ -60,6 +60,7 @@
ansible.builtin.file:
path: '{{ item }}'
state: directory
+ mode: 493
with_items: '{{ list_faillock_dir }}'
when:
- '"kernel-core" in ansible_facts.packages'
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_enforce_for_root' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_enforce_for_root
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_enforce_for_root
@@ -5,6 +5,7 @@
LC_ALL=C sed -i "/^\s*enforce_for_root/Id" "/etc/security/pwhistory.conf"
else
touch "/etc/security/pwhistory.conf"
+ chmod 0644 "/etc/security/pwhistory.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/security/pwhistory.conf"
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
@@ -121,6 +121,7 @@
fi
mkdir -p "$var_accounts_passwords_pam_faillock_dir"
+chmod 0755 "$var_accounts_passwords_pam_faillock_dir"
# Workaround for https://github.com/OpenSCAP/openscap/issues/2242: Use full
# path to semanage and restorecon commands to avoid the issue with the command
# not being found.
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
@@ -747,6 +747,7 @@
path: '{{ var_accounts_passwords_pam_faillock_dir }}'
state: directory
setype: faillog_t
+ mode: 493
when:
- '"kernel-core" in ansible_facts.packages'
- '"pam" in ansible_facts.packages'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit' differs.
--- xccdf_org.ssgproject.content
... The diff is trimmed here ... |
macko1
added a commit
to macko1/content
that referenced
this pull request
Jul 31, 2026
Address all findings from the code review:
Critical:
- Remove `mode: 0755` from `dir_system_commands_group_root_owned`
and `dir_system_commands_root_owned` — these tasks use
`recurse: yes` over `/usr/bin`, `/usr/sbin`, etc. and adding
`mode:` would strip setuid bits from `sudo`, `passwd`, `su`
High:
- Parameterize `set_config_file` macro in `10-bash.jinja` to accept
a `mode` parameter (default `0644`) so callers can override it
- Pass `mode="0640"` from `bash_auditd_config_set` (for
`/etc/audit/auditd.conf`)
- Pass `mode="0600"` from `bash_sshd_config_set` (for
`/etc/ssh/sshd_config`)
- Add `chmod 0600` for all four `cp` commands in
`audit_rules_for_ospp/bash/shared.sh`
Medium:
- Change `/var/tmp` from `chmod 0755` to `chmod 1777` (sticky bit)
- Quote all unquoted shell variables in `chmod` calls
- Fix tab/space indentation in `ensure_logrotate_activated`
- Move `mode: 0644` after `{{% endif %}}` in
`require_emergency_target_auth` and `require_singleuser_auth`
so the parameter is unconditional within the task
Collaborator
Author
|
All findings from review round 1 addressed in 69e5777 and 0993236. Fixed:
0993236 reverts the Kept as-is (see PR description "Scope decisions"):
|
Collaborator
Author
|
CI: All failures are pre-existing or infrastructure issues. Yaml Lint on Changed yaml files
Run Tests (Automatus)
Red Hat Konflux
|
macko1
marked this pull request as ready for review
August 4, 2026 12:36
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
macko1
changed the title
Mab879
requested changes
Aug 4, 2026
Mab879
left a comment
Mab879
left a comment
Member
There was a problem hiding this comment.
For all new modes should we just quote them now in Ansible?
Please see my other comments below.
| else | ||
| echo "ExecStart=-$sulogin" >> "$service_file" | ||
| fi | ||
| {{% endif %}} |
Member
There was a problem hiding this comment.
You need to chmod the drop-in file.
| else | ||
| mkdir -p "$DROPIN_DIR" | ||
| chmod 0755 "$DROPIN_DIR" | ||
| echo "* hard core 0" >> $DROPIN_FILE |
Member
There was a problem hiding this comment.
You should chmod the drop-in file as well.
|
|
||
| {{{ include_directive }}} | ||
| EOF | ||
| chmod 0644 {{{ base_config }}} |
Member
There was a problem hiding this comment.
Suggested change
| chmod 0644 {{{ base_config }}} | |
| chmod 0600 {{{ base_config }}} |
Based on my quick test on a default RHEL 10 box.
Add `mode:` to Ansible macros and `chmod` to bash macros in
`shared/macros/` that create files without explicit permissions.
`owner:` and `group:` are not added — remediations run as `root`,
so every created file is owned by `root:root` by default. Adding
explicit ownership to every task inflates the diff without changing
runtime behavior.
Ansible macros fixed in `shared/macros/10-ansible.jinja`:
- `ansible_file_contents` macro
- `ansible.builtin.copy` task without `mode:`
- `ansible_pam_faillock_enable` macro
- `ansible.builtin.copy` tasks for `cac_faillock` and
`cac_faillock_notify` without `mode:`
- `ansible_pam_pwquality_enable` macro
- `ansible.builtin.copy` task without `mode:`
- `ansible_setup_rsyslog_common` macro
- `ansible.builtin.file` with `state: touch` for
`/etc/rsyslog.conf` without `mode:`
- `ansible.builtin.file` with `state: directory` for
`/etc/rsyslog.d` without `mode:`
- `ansible_enable_dconf_user_profile` macro
- `ansible.builtin.lineinfile` with `create: yes` without `mode:`
Bash macros fixed in `shared/macros/10-bash.jinja`:
- `bash_sshd_remediation` — `mkdir` without `chmod`
(`0700` for `/etc/ssh/sshd_config.d/`)
- `bash_create_audit_remediation_unsuccessful_file_modification_detailed`
— `mkdir` and `cat` heredoc without `chmod`
(`0750`/`0600` for `/etc/audit/rules.d/`)
- `bash_dconf_settings` and `bash_dconf_lock`
— `mkdir` without `chmod` for `/etc/dconf/db/`
- `bash_enable_pam_faillock_directly_in_pam_files`
— `cat` heredoc without `chmod`
- `bash_pam_pwquality_enable` — `cat` heredoc without `chmod`
- `bash_pam_unix_enable` — `cp` without `chmod`
- `bash_pam_pwhistory_enable` — `cat` heredoc without `chmod`
- `set_config_file` — `touch` without `chmod`
- `bash_file_contents` — `cat` heredoc without `chmod`
- `bash_sssd_ensure_default_config`
— `mkdir` (`0711` for `/etc/sssd/`) and `touch` (`0600`) without `chmod`
- `bash_ensure_ini_config` — `mkdir` without `chmod`
- `bash_enable_dconf_user_profile`
— `mkdir` and `echo` without `chmod` for `/etc/dconf/`
None of the fixed macros accept a `mode` parameter, so all values
are hardcoded. Mode values match RPM package defaults and OVAL
permission checks.
Add `mode:` to Ansible template tasks and `chmod` to bash templates
in `shared/templates/` that create files without explicit permissions.
Ansible templates fixed:
- `accounts_password/ansible.template`
- `ansible.builtin.lineinfile`, `mode: 0644` for
`/etc/security/pwquality.conf`
- `audit_rules_syscall_events/ansible.template`
- all four `ansible.builtin.lineinfile` tasks, `mode: 0600`
for `/etc/audit/rules.d/` files
- `cis_banner/ansible.template`
- `ansible.builtin.copy`, `mode: 0644` for `/etc/issue`,
`/etc/issue.net`, `/etc/motd`
- `dconf_ini_file/ansible.template`
- `community.general.ini_file` and `ansible.builtin.lineinfile`
tasks, `mode: 0644` for `/etc/dconf/db/` files
- `kernel_module_disabled/ansible.template`
- `ansible.builtin.lineinfile` tasks, `mode: 0644` for
`/etc/modprobe.d/*.conf`
- `systemd_dropin_configuration/ansible.template`
- `community.general.ini_file`, `mode: 0644` for
`complianceascode_hardening.conf`
- `zipl_bls_entries_option/ansible.template`
- `ansible.builtin.lineinfile`, `mode: 0644` for
`/etc/kernel/cmdline`
Bash templates fixed:
- `cis_banner/bash.template`
- `chmod 0644` after `echo` redirect
- `zipl_bls_entries_option/bash.template`
- `chmod 0644` after `echo` redirect to `/etc/kernel/cmdline`
- `pam_account_password_faillock/bash.template`
- `chmod 0644` after `cp` to `/etc/security/faillock.conf`
Add `mode:` to Ansible tasks and `chmod` to bash commands across
standalone remediation files in `linux_os/` that create files
without explicit permissions.
Ansible modules fixed:
- `ansible.builtin.lineinfile` with `create: yes`
- `auditd` retention rules for `/etc/audit/auditd.conf` (`0640`)
- NTP config for `chrony`, `ntpd`, `timesyncd` (`0644`)
- SSH client config in `/etc/profile.d/` (`0644`)
- `/etc/login.defs` (`0644`)
- `dconf` settings and locks in `/etc/dconf/db/` (`0644`)
- `rsyslog` config (`0644`)
- `systemd` drop-in files (`0644`)
- kernel module config in `/etc/modprobe.d/` (`0644`)
- network config for `nmcli` and `nftables` (`0644`)
- SELinux config (`0644`)
- `community.general.ini_file`
- `dconf`/GNOME settings (`0644`)
- SSSD config in `/etc/sssd/` (`0600`)
- `dnf`/`yum` config (`0644`)
- `systemd` drop-in files (`0644`)
- `ansible.builtin.copy`
- banner files `/etc/issue`, `/etc/issue.net`, `/etc/motd` (`0644`)
- `chrony-wait.service` (`0644`)
- TFTP drop-in (`0644`)
- coredump limits drop-in (`0644`)
- shadow backup `/etc/shadow-` (`0000`)
- `ansible.builtin.blockinfile` with `create: yes`
- audit file modification rules in `/etc/audit/rules.d/` (`0600`)
- `systemd` service overrides (`0644`)
- `tmux` profile in `/etc/profile.d/` (`0644`)
- `modprobe` wireless config (`0644`)
- `ansible.builtin.file` with `state: touch` or `state: directory`
- `faillock` directories (`0755`)
- `rsyslog` touch (`0644`) and directory (`0755`)
- crypto policy directories (`0755`)
Bash commands fixed:
- `mkdir`
- `systemd`, `journal`, SSSD, `logind`, `rsyslog`, `faillock` dirs
- `echo`/`printf` redirect
- banners, SSH client, crypto policy, `modprobe`, `nftables`, `polkit`
- `cat` heredoc
- `chrony-wait`, TFTP drop-in, `systemd` mount, AIDE, `openssl`,
FIPS, PAM, SSH confirm
- `touch`
- `rsyslog`, `journal-upload`, `nftables`
- `cp`
- `/etc/shadow-`, `/etc/group-`, `/etc/passwd-` backups,
`/etc/sudoers.bak`, PAM `pkcs11` config
- `nft` redirect
- `nftables` filter rules
Manual corrections after the automated script:
- `ensure_logrotate_activated`: `chmod 0755` (not `0644`) because
`/etc/cron.daily/logrotate` is an executable script
- `sshd_use_directory_configuration`: `chmod 0700` (not `0755`)
because the `openssh-server` RPM sets `/etc/ssh/sshd_config.d/`
to `drwx------`
- `no_legacy_plus_entries_etc_shadow`: `mode: 0000` (not `0644`)
because `/etc/shadow-` matches `/etc/shadow` permissions
Fix indentation and trailing whitespace errors in remediation files where the `mode:` insertion script used incorrect indentation or left trailing spaces. Indentation fixes: - `tftp_uses_secure_mode_systemd/ansible/shared.yml` - `accounts_umask_etc_csh_cshrc/ansible/shared.yml` - `accounts_umask_etc_login_defs/ansible/shared.yml` - `rsyslog_remote_access_monitoring/ansible/ubuntu.yml` - `aide_check_audit_tools/ansible/shared.yml` Trailing whitespace removed: - `chronyd_configure_pool_and_server/ansible/shared.yml` - `dir_system_commands_group_root_owned/ansible/shared.yml` - `dir_system_commands_root_owned/ansible/shared.yml` - `harden_openssl_crypto_policy/ansible/shared.yml`
Address all findings from the code review:
Critical:
- Remove `mode: 0755` from `dir_system_commands_group_root_owned`
and `dir_system_commands_root_owned` — these tasks use
`recurse: yes` over `/usr/bin`, `/usr/sbin`, etc. and adding
`mode:` would strip setuid bits from `sudo`, `passwd`, `su`
High:
- Parameterize `set_config_file` macro in `10-bash.jinja` to accept
a `mode` parameter (default `0644`) so callers can override it
- Pass `mode="0640"` from `bash_auditd_config_set` (for
`/etc/audit/auditd.conf`)
- Pass `mode="0600"` from `bash_sshd_config_set` (for
`/etc/ssh/sshd_config`)
- Add `chmod 0600` for all four `cp` commands in
`audit_rules_for_ospp/bash/shared.sh`
Medium:
- Change `/var/tmp` from `chmod 0755` to `chmod 1777` (sticky bit)
- Quote all unquoted shell variables in `chmod` calls
- Fix tab/space indentation in `ensure_logrotate_activated`
- Move `mode: 0644` after `{{% endif %}}` in
`require_emergency_target_auth` and `require_singleuser_auth`
so the parameter is unconditional within the task
The yamllint fix commit re-indented tasks inside a block: section from 4 spaces to 8 spaces. This changed the content: |- scalar indentation, altering the systemd unit file content written by the remediation. Reverted to the original 4-space indent (pre-existing yamllint style issue) and kept only the mode: additions.
Bash remediations creating drop-in files via shell redirects and ansible remediations using ansible_lineinfile with create=yes were missing explicit chmod/mode. Files inherit umask-based permissions instead of explicit values, making remediation output non-deterministic. Changes: - Add chmod to bash remediations using shell redirects (>>, >, cat >) - Add mode= parameter to ansible_lineinfile macro calls where missing - Quote mode values in direct ansible tasks (mode: 0644 → mode: '0644')
macko1
force-pushed
the
RHEL-182657-remediation-explicit-permissions
branch
from
August 5, 2026 13:31
0993236 to
f4bc93f
Compare
Collaborator
Author
|
@macko1: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Both macros call ansible_set_config_file, which already accepts a mode= parameter and threads it through ansible_only_lineinfile down to ansible.builtin.lineinfile. Neither caller passed it, so files created by ansible.builtin.lineinfile with create: yes fell back to umask-derived permissions. ansible_auditd_set now passes mode="0640" for /etc/audit/auditd.conf. ansible_sshd_set now passes mode="0600" for /etc/ssh/sshd_config, but only in the non-distributed branch; the distributed branch already sets mode via a separate follow-up task. ansible_auditd_set is not called by any rule today. ansible_sshd_set is used by every rule with config_is_distributed=false. Verified on ol8 with sshd_rekey_limit, which renders mode: '0600' on the /etc/ssh/sshd_config task.
Collaborator
Author
|
PR desc updated, PTAL again, @Mab879 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Ansible and bash remediations create files without setting permissions explicitly. The resulting permissions depend on the process
umask. On default RHEL (umask 0022) that produces0644, but on hardened systems with a stricterumaskthe result isunpredictable.
This PR adds explicit permissions to file-creating remediations in:
Rationale
Remediation output must be deterministic. File permissions must not depend on the runtime
umask.Permissions by file type
The values below match RPM package defaults (checked with
rpm -qlv) and any existing OVAL permission checks./etc/audit/rules.d/*.rules→0600(OVAL enforced)/etc/audit/auditd.conf→0640(RPM default)/etc/ssh/sshd_config,/etc/ssh/sshd_config.d/*.conf→0600/etc/ssh/sshd_config.d/directory →0700/etc/sssd/→0600files,0711directories/etc/sudoers,/etc/sudoers.d/→0440/etc/shadow-→0000/etc/cron.daily/*→07550755/etc/profile.d/*.sh→0644(shell profile scripts, world-readable)/etc/systemd/system/*.service.d/*.conf→0644(systemd drop-ins, world-readable)/etc/security/limits.d/*.conf→0644(PAM limits drop-ins, world-readable)/etc/tmpfiles.d/*.conf→0644(systemd tmpfiles, world-readable)/etc/permissions.local→0644(SUSE permissions config, world-readable)0644What this PR does not change, and why
owner:andgroup:are not set, because remediations run asrootand every created file isalready owned by
root:root. Addingowner: rootandgroup: rootexplicitly to every taskinflates the diff without changing the resulting file ownership.
/etc/sssd/sssd.confkeeps mode0600even though the RPM default is0640:bash_sssd_ensure_default_configmacro wraps the fix in
umask u=rw,go=they don't exist otherwise the sssd module fails to start"
0640risks breaking SSSD startup on affected systemsThe
ansible.posix.sysctl,ansible.builtin.cron, andansible.posix.mountAnsible modulesdon't accept a
mode:parameter (confirmed fromansible-doc). Nothing to fix here.The
ansible.builtin.replaceAnsible module never creates files. Fails with "Path does notexist" if the target is missing (confirmed from its module source
ansible/modules/replace.pyline 254).The macros
ansible_shell_set,ansible_selinux_config_set, andansible_login_defscallthe
ansible.builtin.lineinfileAnsible module withcreate: yesand nomodeparameter,but their target files' permissions already default to
0644when installed, so the missingmodeparameter produces the correct result by coincidence.Changes
Macros (
shared/macros/10-ansible.jinja,shared/macros/10-bash.jinja): addedmode:/chmodso every caller inherits explicit permissions automatically.
Templates (
shared/templates/): addedmode:/chmodto file-creating templates so every ruleusing them is covered in one place.
Handwritten remediations (
linux_os/): rule-specificbash/shared.shoransible/shared.ymlfiles that don't call a macro or template, added
mode:orchmoddirectly.Bash remediations that create drop-in files via shell redirect (
>>,>,cat >) withoutchmod. Affects these rules:require_emergency_target_auth(systemd drop-in/etc/systemd/system/emergency.service.d/10-oscap.conf)disable_users_coredumps(PAM limits drop-in/etc/security/limits.d/10-ssg-hardening.conf)sshd_use_directory_configuration(/etc/ssh/sshd_config, corrected from0644to0600)accounts_tmout(/etc/profile.d/tmout.sh)audit_rules_immutable_login_uids(/etc/audit/rules.d/immutable.rules)Ansible remediations using the
ansible_lineinfilemacro withcreate: yesbut nomode=parameter, so the file it creates gets no explicit mode. Affects these rules:
accounts_tmout(/etc/profile.d/tmout.sh)rootfiles_configured(/etc/tmpfiles.d/rootfiles.conf)permissions_local_var_log_audit(/etc/permissions.local, 4ansible_lineinfilecalls)Ansible remediations with unquoted octal
mode:values, quoted for YAML 1.1 compatibility(
mode: 0644→mode: '0644'). Only these two rules, because they're the only ones wherethis PR itself added a new
mode:value that happened to be unquoted:require_emergency_target_authdisable_users_coredumpsmode:values already in the codebase is aseparate, larger cleanup.
The macros
ansible_auditd_setandansible_sshd_setwere missingmode:. Theansible_set_config_filemacro they call already accepts amode=parameter, so the fixwas adding
mode="0640"andmode="0600"to these two call sites, not new plumbing:ansible_auditd_set(shared/macros/10-ansible.jinja) is unused by any ComplianceAsCoderule today, but is now correct if a future rule calls it
ansible_sshd_setwrites directly into/etc/ssh/sshd_configin one mode, and to aseparate drop-in file under
/etc/ssh/sshd_config.d/in another (controlled byconfig_is_distributed). Only the first way was missingmode:; the drop-in way alreadysets it via a separate task. Verified on the
ol8product with thesshd_rekey_limitrule.How to test
./build_product rhel10and confirm it passes.ansibleandoscap(bash).Assisted by Claude.