Don't follow symlinks in file_permission_user_init_files(_root)

[Mab879]

Description:

• Don't follow symlinks in file_permission_user_init_files(_root)

Rationale:

Follow up to #14808

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permission_user_init_files' differs.
--- xccdf_org.ssgproject.content_rule_file_permission_user_init_files
+++ xccdf_org.ssgproject.content_rule_file_permission_user_init_files
@@ -46,6 +46,7 @@
   ansible.builtin.file:
     path: '{{ item.1.path }}'
     mode: u-s,g-wxs,o=
+    follow: false
   loop: '{{ q(''ansible.builtin.subelements'', found_init_files.results, ''files'',
     {''skip_missing'': True}) }}'
   tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permission_user_init_files_root' differs.
--- xccdf_org.ssgproject.content_rule_file_permission_user_init_files_root
+++ xccdf_org.ssgproject.content_rule_file_permission_user_init_files_root
@@ -12,7 +12,7 @@
     if ! grep -qP "$USERS_IGNORED_REGEX" <<< "${interactive_users[$i]}" && \
         [ "${interactive_users_shell[$i]}" != "/sbin/nologin" ]; then
 
-        readarray -t init_files < <(find "${interactive_users_home[$i]}" -maxdepth 1 \
+        readarray -t init_files < <(find "${interactive_users_home[$i]}" -type f -maxdepth 1 \
             -exec basename {} \; | grep -P "$var_user_initialization_files_regex")
         for file in "${init_files[@]}"; do
             chmod u-s,g-wxs,o= "${interactive_users_home[$i]}/$file"

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permission_user_init_files_root' differs.
--- xccdf_org.ssgproject.content_rule_file_permission_user_init_files_root
+++ xccdf_org.ssgproject.content_rule_file_permission_user_init_files_root
@@ -46,6 +46,7 @@
   ansible.builtin.file:
     path: '{{ item.1.path }}'
     mode: u-s,g-wxs,o=
+    follow: false
   loop: '{{ q(''ansible.builtin.subelements'', found_init_files.results, ''files'',
     {''skip_missing'': True}) }}'
   tags:

[macko1]

@Mab879 any idea why CaC have both file_permission_user_init_files and file_permission_user_init_files_root ? the file_permission_user_init_files_root seems to duplicate the former + adds /root/<init files>

[Mab879]

@Mab879 any idea why CaC have both file_permission_user_init_files and file_permission_user_init_files_root ? the file_permission_user_init_files_root seems to duplicate the former + adds /root/<init files>

Looks like Jan add this rule little over 2 years ago. Seems like CIS and STIG benchmark split.

[macko1]

Ansible fix seems fine.
Bash can be sketchy - there is a very slight chance of race condition (toctou) before looking for the file (is not symlink) and changing permissions on it. Maybe using chmod --no-dereference would be safer?

@Mab879

[Mab879]

chmod --no-dereference

That is RHEL 10+ only. Reverting.

[openshift-ci]

@Mab879: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/4.12-images	dbd5e9e	link	true	/test 4.12-images

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.