sailesh1993 / rpms / cloud-init

Forked from rpms/cloud-init a year ago
Clone
d9e4dd
From 680ebcb46d1db6f02f2b21c158b4a9af2d789ba3 Mon Sep 17 00:00:00 2001
d9e4dd
From: Eduardo Otubo <otubo@redhat.com>
d9e4dd
Date: Fri, 7 May 2021 13:36:08 +0200
d9e4dd
Subject: limit permissions on def_log_file
d9e4dd
d9e4dd
This sets a default mode of 0600 on def_log_file, and makes this
d9e4dd
configurable via the def_log_file_mode option in cloud.cfg.
d9e4dd
d9e4dd
LP: #1541196
d9e4dd
Resolves: rhbz#1424612
d9e4dd
X-approved-upstream: true
d9e4dd
d9e4dd
Conflicts 21.1:
d9e4dd
    cloudinit/stages.py: adjusting call of ensure_file() to use more
d9e4dd
recent version
d9e4dd
d9e4dd
Signed-off-by: Eduardo Otubo <otubo@redhat.com>
d9e4dd
---
d9e4dd
 cloudinit/settings.py         | 1 +
d9e4dd
 cloudinit/stages.py           | 1 +
d9e4dd
 doc/examples/cloud-config.txt | 4 ++++
d9e4dd
 3 files changed, 6 insertions(+)
d9e4dd
d9e4dd
diff --git a/cloudinit/settings.py b/cloudinit/settings.py
d9e4dd
index e690c0fd..43a1490c 100644
d9e4dd
--- a/cloudinit/settings.py
d9e4dd
+++ b/cloudinit/settings.py
d9e4dd
@@ -46,6 +46,7 @@ CFG_BUILTIN = {
d9e4dd
         'None',
d9e4dd
     ],
d9e4dd
     'def_log_file': '/var/log/cloud-init.log',
d9e4dd
+    'def_log_file_mode': 0o600,
d9e4dd
     'log_cfgs': [],
d9e4dd
     'mount_default_fields': [None, None, 'auto', 'defaults,nofail', '0', '2'],
d9e4dd
     'ssh_deletekeys': False,
d9e4dd
diff --git a/cloudinit/stages.py b/cloudinit/stages.py
d9e4dd
index 3ef4491c..83e25dd1 100644
d9e4dd
--- a/cloudinit/stages.py
d9e4dd
+++ b/cloudinit/stages.py
d9e4dd
@@ -147,6 +147,7 @@ class Init(object):
d9e4dd
     def _initialize_filesystem(self):
d9e4dd
         util.ensure_dirs(self._initial_subdirs())
d9e4dd
         log_file = util.get_cfg_option_str(self.cfg, 'def_log_file')
d9e4dd
+        log_file_mode = util.get_cfg_option_int(self.cfg, 'def_log_file_mode')
d9e4dd
         if log_file:
d9e4dd
             util.ensure_file(log_file, preserve_mode=True)
d9e4dd
             perms = self.cfg.get('syslog_fix_perms')
d9e4dd
diff --git a/doc/examples/cloud-config.txt b/doc/examples/cloud-config.txt
d9e4dd
index de9a0f87..bb33ad45 100644
d9e4dd
--- a/doc/examples/cloud-config.txt
d9e4dd
+++ b/doc/examples/cloud-config.txt
d9e4dd
@@ -414,10 +414,14 @@ timezone: US/Eastern
d9e4dd
 # if syslog_fix_perms is a list, it will iterate through and use the
d9e4dd
 # first pair that does not raise error.
d9e4dd
 #
d9e4dd
+# 'def_log_file' will be created with mode 'def_log_file_mode', which
d9e4dd
+# is specified as a numeric value and defaults to 0600.
d9e4dd
+#
d9e4dd
 # the default values are '/var/log/cloud-init.log' and 'syslog:adm'
d9e4dd
 # the value of 'def_log_file' should match what is configured in logging
d9e4dd
 # if either is empty, then no change of ownership will be done
d9e4dd
 def_log_file: /var/log/my-logging-file.log
d9e4dd
+def_log_file_mode: 0600
d9e4dd
 syslog_fix_perms: syslog:root
d9e4dd
 
d9e4dd
 # you can set passwords for a user or multiple users
d9e4dd
-- 
d9e4dd
2.27.0
d9e4dd