5b08af
From ca723f1846bb8e2880ac264b28bdf7ecd14c9e70 Mon Sep 17 00:00:00 2001
ef3f20
From: Lars Kellogg-Stedman <lars@redhat.com>
ef3f20
Date: Fri, 7 Apr 2017 18:50:54 -0400
c60dcd
Subject: limit permissions on def_log_file
ef3f20
ef3f20
This sets a default mode of 0600 on def_log_file, and makes this
ef3f20
configurable via the def_log_file_mode option in cloud.cfg.
ef3f20
ef3f20
LP: #1541196
ef3f20
Resolves: rhbz#1424612
ef3f20
X-approved-upstream: true
ef3f20
---
ef3f20
 cloudinit/settings.py         | 1 +
ef3f20
 cloudinit/stages.py           | 3 ++-
ef3f20
 doc/examples/cloud-config.txt | 4 ++++
ef3f20
 3 files changed, 7 insertions(+), 1 deletion(-)
ef3f20
ef3f20
diff --git a/cloudinit/settings.py b/cloudinit/settings.py
5b08af
index 3a04a58..439eee0 100644
ef3f20
--- a/cloudinit/settings.py
ef3f20
+++ b/cloudinit/settings.py
5b08af
@@ -45,6 +45,7 @@ CFG_BUILTIN = {
ef3f20
         'None',
ef3f20
     ],
ef3f20
     'def_log_file': '/var/log/cloud-init.log',
ef3f20
+    'def_log_file_mode': 0o600,
ef3f20
     'log_cfgs': [],
ef3f20
     'mount_default_fields': [None, None, 'auto', 'defaults,nofail', '0', '2'],
ef3f20
     'ssh_deletekeys': False,
ef3f20
diff --git a/cloudinit/stages.py b/cloudinit/stages.py
5b08af
index 71f3a49..68b83af 100644
ef3f20
--- a/cloudinit/stages.py
ef3f20
+++ b/cloudinit/stages.py
5b08af
@@ -149,8 +149,9 @@ class Init(object):
ef3f20
     def _initialize_filesystem(self):
ef3f20
         util.ensure_dirs(self._initial_subdirs())
ef3f20
         log_file = util.get_cfg_option_str(self.cfg, 'def_log_file')
ef3f20
+        log_file_mode = util.get_cfg_option_int(self.cfg, 'def_log_file_mode')
ef3f20
         if log_file:
ef3f20
-            util.ensure_file(log_file)
ef3f20
+            util.ensure_file(log_file, mode=log_file_mode)
ef3f20
             perms = self.cfg.get('syslog_fix_perms')
ef3f20
             if not perms:
ef3f20
                 perms = {}
ef3f20
diff --git a/doc/examples/cloud-config.txt b/doc/examples/cloud-config.txt
738010
index eb84dcf..0e82b83 100644
ef3f20
--- a/doc/examples/cloud-config.txt
ef3f20
+++ b/doc/examples/cloud-config.txt
738010
@@ -413,10 +413,14 @@ timezone: US/Eastern
ef3f20
 # if syslog_fix_perms is a list, it will iterate through and use the
ef3f20
 # first pair that does not raise error.
ef3f20
 #
ef3f20
+# 'def_log_file' will be created with mode 'def_log_file_mode', which
ef3f20
+# is specified as a numeric value and defaults to 0600.
ef3f20
+#
ef3f20
 # the default values are '/var/log/cloud-init.log' and 'syslog:adm'
ef3f20
 # the value of 'def_log_file' should match what is configured in logging
ef3f20
 # if either is empty, then no change of ownership will be done
ef3f20
 def_log_file: /var/log/my-logging-file.log
ef3f20
+def_log_file_mode: 0600
ef3f20
 syslog_fix_perms: syslog:root
ef3f20
 
ef3f20
 # you can set passwords for a user or multiple users
c60dcd
-- 
c60dcd
1.8.3.1
c60dcd