From 1dcdad51a48c17dd5dbb7eb9bbb8cef23cf00e29 Mon Sep 17 00:00:00 2001
From: Gabriel Becker <ggasparb@redhat.com>
Date: Mon, 23 Aug 2021 10:26:39 +0200
Subject: [PATCH] Fix remaining audit rule files permissions.
---
.../audit_rules_immutable/ansible/shared.yml | 1 +
.../audit_rules_immutable/bash/shared.sh | 1 +
shared/templates/audit_file_contents/ansible.template | 5 +++++
shared/templates/audit_file_contents/bash.template | 2 ++
4 files changed, 9 insertions(+)
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/ansible/shared.yml
index 1cafb744cc3..736d4c333e4 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/ansible/shared.yml
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/ansible/shared.yml
@@ -22,6 +22,7 @@
path: "{{ item }}"
create: True
line: "-e 2"
+ mode: o-rwx
loop:
- "/etc/audit/audit.rules"
- "/etc/audit/rules.d/immutable.rules"
diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh
index 29cd4a5de6f..36e0691493f 100644
--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh
+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh
@@ -20,4 +20,5 @@ do
echo '# Set the audit.rules configuration immutable per security requirements' >> $AUDIT_FILE
echo '# Reboot is required to change audit rules once this setting is applied' >> $AUDIT_FILE
echo '-e 2' >> $AUDIT_FILE
+ chmod o-rwx $AUDIT_FILE
done
diff --git a/shared/templates/audit_file_contents/ansible.template b/shared/templates/audit_file_contents/ansible.template
index c2852745451..a262386cfbf 100644
--- a/shared/templates/audit_file_contents/ansible.template
+++ b/shared/templates/audit_file_contents/ansible.template
@@ -9,3 +9,8 @@
contents=CONTENTS,
)
}}}
+
+- name: Remove any permissions from other group
+ file:
+ path: {{{ FILEPATH }}}
+ mode: o-rwx
diff --git a/shared/templates/audit_file_contents/bash.template b/shared/templates/audit_file_contents/bash.template
index f264be6f14d..d6277167892 100644
--- a/shared/templates/audit_file_contents/bash.template
+++ b/shared/templates/audit_file_contents/bash.template
@@ -11,4 +11,6 @@
)
}}}
+chmod o-rwx {{{ FILEPATH }}}
+
augenrules --load