Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow changing the configuration directory and files owner #535

Merged
merged 1 commit into from
Sep 7, 2021

Conversation

thias
Copy link
Contributor

@thias thias commented May 21, 2020

This is because it's good practice to keep the service from potentially overwriting its own configuration through some security flaw, meaning having the owner 'root', the group 'consul' and files mode 0640 and directories mode 0750 makes the most sense to keep everyting secure and private.

Note that this works for me because I deploy consul using an rpm where I have set the config directory to have mode 0750, but this is not something this Puppet module will be enforcing. Should a new config_dir_mode also be added, defaulting to undef to keep backwards compatibility?

@thias
Copy link
Contributor Author

thias commented May 11, 2021

I've fixed the default value to now honor the "user" override, and also added a spec test to check for config dir and file ownership when this parameter is used.

@thias thias reopened this May 11, 2021
@thias
Copy link
Contributor Author

thias commented May 11, 2021

FYI, the failing check is because some CentOS 6 packages couldn't be installed for one of the jobs.

@thias
Copy link
Contributor Author

thias commented Sep 7, 2021

@solarkennedy : Any feedback on this change? It's fairly straightforward, passes checks and (to me at least) makes a lot of sense security-wise.

@solarkennedy
Copy link
Contributor

I think this is fine

@solarkennedy solarkennedy merged commit e4d41bd into voxpupuli:master Sep 7, 2021
@bastelfreak bastelfreak added the enhancement New feature or request label Apr 20, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants