From eae4cc4ce2d0f9a0186a134ed25b58315cf38de1 Mon Sep 17 00:00:00 2001 From: Gilles Dartiguelongue Date: Tue, 17 Oct 2017 17:06:59 +0200 Subject: [PATCH 1/3] Switch default file owner to sensu Debian packaging from sensu repository sets ownership to sensu user. Stick to this by default. --- sensu/configfile_map.jinja | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sensu/configfile_map.jinja b/sensu/configfile_map.jinja index f137f69..277d462 100644 --- a/sensu/configfile_map.jinja +++ b/sensu/configfile_map.jinja @@ -1,8 +1,8 @@ {% set files = salt['grains.filter_by']({ 'default': { 'files': { - 'user': 'root', - 'group': 'root', + 'user': 'sensu', + 'group': 'sensu', }, }, 'Windows': { From 61d040d2bae15e10c092a89420e03b27beb4e0ec Mon Sep 17 00:00:00 2001 From: Gilles Dartiguelongue Date: Tue, 17 Oct 2017 17:24:52 +0200 Subject: [PATCH 2/3] Set configuration files ownership to user running sensu --- sensu/api_conf.sls | 4 ++-- sensu/client.sls | 6 ++++-- sensu/rabbitmq_conf.sls | 4 ++-- sensu/redis_conf.sls | 4 ++-- sensu/server.sls | 6 ++++++ sensu/transport_conf.sls | 4 ++-- sensu/uchiwa.sls | 4 ++-- 7 files changed, 20 insertions(+), 12 deletions(-) diff --git a/sensu/api_conf.sls b/sensu/api_conf.sls index 720a63c..93c19a6 100644 --- a/sensu/api_conf.sls +++ b/sensu/api_conf.sls @@ -6,8 +6,8 @@ include: /etc/sensu/conf.d/api.json: file.serialize: - formatter: json - - user: root - - group: root + - user: {{ files.files.user }} + - group: {{ files.files.group }} - mode: 644 - require: - pkg: sensu diff --git a/sensu/client.sls b/sensu/client.sls index 2cfbe7e..39e329d 100644 --- a/sensu/client.sls +++ b/sensu/client.sls @@ -29,6 +29,8 @@ sensu_standalone_checks_file: - dataset: checks: {{ salt['pillar.get']('sensu:standalone_checks') }} - formatter: json + - user: {{ files.files.user }} + - group: {{ files.files.group }} - require: - pkg: sensu - watch_in: @@ -42,8 +44,8 @@ sensu_standalone_checks_file: /etc/sensu/conf.d/client.json: file.serialize: - formatter: json - - user: {{files.files.user}} - - group: {{files.files.group}} + - user: {{ files.files.user }} + - group: {{ files.files.group }} {% if grains['os_family'] != 'Windows' %} - mode: 644 {% endif %} diff --git a/sensu/rabbitmq_conf.sls b/sensu/rabbitmq_conf.sls index 1c160fa..18df28c 100644 --- a/sensu/rabbitmq_conf.sls +++ b/sensu/rabbitmq_conf.sls @@ -7,8 +7,8 @@ include: /etc/sensu/conf.d/rabbitmq.json: file.serialize: - formatter: json - - user: {{files.files.user}} - - group: {{files.files.group}} + - user: {{ files.files.user }} + - group: {{ files.files.group }} - makedirs: True {% if grains['os_family'] != 'Windows' %} - mode: 644 diff --git a/sensu/redis_conf.sls b/sensu/redis_conf.sls index 5d0b252..fd27828 100644 --- a/sensu/redis_conf.sls +++ b/sensu/redis_conf.sls @@ -3,8 +3,8 @@ /etc/sensu/conf.d/redis.json: file.serialize: - formatter: json - - user: root - - group: root + - user: {{ files.files.user }} + - group: {{ files.files.group }} - mode: 644 - require: - pkg: sensu diff --git a/sensu/server.sls b/sensu/server.sls index 606c6c6..27f6201 100644 --- a/sensu/server.sls +++ b/sensu/server.sls @@ -10,6 +10,8 @@ include: file.recurse: - source: salt://{{ sensu.paths.conf_d }} - template: jinja + - user: {{ files.files.user }} + - group: {{ files.files.group }} - require: - pkg: sensu - watch_in: @@ -22,6 +24,8 @@ sensu_subscription_checks_file: - dataset: checks: {{ salt['pillar.get']('sensu:checks') }} - formatter: json + - user: {{ files.files.user }} + - group: {{ files.files.group }} - require: - pkg: sensu - watch_in: @@ -39,6 +43,8 @@ sensu_handlers_file: - name: {{ sensu.paths.handlers_file }} - dataset_pillar: sensu:handlers - formatter: json + - user: {{ files.files.user }} + - group: {{ files.files.group }} - require: - pkg: sensu - watch_in: diff --git a/sensu/transport_conf.sls b/sensu/transport_conf.sls index 8c2bdd0..582e6b1 100644 --- a/sensu/transport_conf.sls +++ b/sensu/transport_conf.sls @@ -6,8 +6,8 @@ include: /etc/sensu/conf.d/transport.json: file.serialize: - formatter: json - - user: root - - group: root + - user: {{ files.files.user }} + - group: {{ files.files.group }} - mode: 644 - require: - pkg: sensu diff --git a/sensu/uchiwa.sls b/sensu/uchiwa.sls index f3ad7e6..357e930 100644 --- a/sensu/uchiwa.sls +++ b/sensu/uchiwa.sls @@ -10,9 +10,9 @@ uchiwa: file.serialize: - name: /etc/sensu/uchiwa.json - formatter: json + - user: {{ files.files.user }} + - group: {{ files.files.group }} - mode: 644 - - user: uchiwa - - group: sensu - require: - pkg: uchiwa - dataset: From 803c4ec1e5923518d38f941c6929d5a30340a6a7 Mon Sep 17 00:00:00 2001 From: Gilles Dartiguelongue Date: Tue, 17 Oct 2017 17:31:10 +0200 Subject: [PATCH 3/3] Set more restrictive permissions on configuration files, closes #49 --- sensu/api_conf.sls | 3 ++- sensu/client.sls | 7 +++++-- sensu/rabbitmq_conf.sls | 6 +++--- sensu/redis_conf.sls | 3 ++- sensu/server.sls | 8 ++++++++ sensu/transport_conf.sls | 3 +++ sensu/uchiwa.sls | 3 ++- 7 files changed, 25 insertions(+), 8 deletions(-) diff --git a/sensu/api_conf.sls b/sensu/api_conf.sls index 93c19a6..26bdec0 100644 --- a/sensu/api_conf.sls +++ b/sensu/api_conf.sls @@ -1,4 +1,5 @@ {% from "sensu/pillar_map.jinja" import sensu with context -%} +{% from "sensu/configfile_map.jinja" import files with context %} include: - sensu @@ -8,7 +9,7 @@ include: - formatter: json - user: {{ files.files.user }} - group: {{ files.files.group }} - - mode: 644 + - mode: 640 - require: - pkg: sensu - dataset: diff --git a/sensu/client.sls b/sensu/client.sls index 39e329d..53424ed 100644 --- a/sensu/client.sls +++ b/sensu/client.sls @@ -31,6 +31,9 @@ sensu_standalone_checks_file: - formatter: json - user: {{ files.files.user }} - group: {{ files.files.group }} + {%- if grains['os_family'] != 'Windows' %} + - mode: 640 + {%- endif %} - require: - pkg: sensu - watch_in: @@ -46,9 +49,9 @@ sensu_standalone_checks_file: - formatter: json - user: {{ files.files.user }} - group: {{ files.files.group }} - {% if grains['os_family'] != 'Windows' %} + {%- if grains['os_family'] != 'Windows' %} - mode: 644 - {% endif %} + {%- endif %} - makedirs: True - dataset: client: diff --git a/sensu/rabbitmq_conf.sls b/sensu/rabbitmq_conf.sls index 18df28c..c970413 100644 --- a/sensu/rabbitmq_conf.sls +++ b/sensu/rabbitmq_conf.sls @@ -10,9 +10,9 @@ include: - user: {{ files.files.user }} - group: {{ files.files.group }} - makedirs: True - {% if grains['os_family'] != 'Windows' %} - - mode: 644 - {% endif %} + {%- if grains['os_family'] != 'Windows' %} + - mode: 640 + {%- endif %} - dataset: rabbitmq: host: {{ sensu.rabbitmq.host }} diff --git a/sensu/redis_conf.sls b/sensu/redis_conf.sls index fd27828..90f0d8f 100644 --- a/sensu/redis_conf.sls +++ b/sensu/redis_conf.sls @@ -1,11 +1,12 @@ {% from "sensu/pillar_map.jinja" import sensu with context -%} +{% from "sensu/configfile_map.jinja" import files with context %} /etc/sensu/conf.d/redis.json: file.serialize: - formatter: json - user: {{ files.files.user }} - group: {{ files.files.group }} - - mode: 644 + - mode: 640 - require: - pkg: sensu - dataset: diff --git a/sensu/server.sls b/sensu/server.sls index 27f6201..90d47e3 100644 --- a/sensu/server.sls +++ b/sensu/server.sls @@ -1,4 +1,5 @@ {% from "sensu/pillar_map.jinja" import sensu with context -%} +{% from "sensu/configfile_map.jinja" import files with context %} include: - sensu @@ -12,6 +13,10 @@ include: - template: jinja - user: {{ files.files.user }} - group: {{ files.files.group }} + {%- if grains['os_family'] != 'Windows' %} + - file_mode: 640 + - dir_mode: 750 + {%- endif %} - require: - pkg: sensu - watch_in: @@ -26,6 +31,9 @@ sensu_subscription_checks_file: - formatter: json - user: {{ files.files.user }} - group: {{ files.files.group }} + {%- if grains['os_family'] != 'Windows' %} + - mode: 640 + {%- endif %} - require: - pkg: sensu - watch_in: diff --git a/sensu/transport_conf.sls b/sensu/transport_conf.sls index 582e6b1..7886659 100644 --- a/sensu/transport_conf.sls +++ b/sensu/transport_conf.sls @@ -1,4 +1,5 @@ {% from "sensu/pillar_map.jinja" import sensu with context -%} +{% from "sensu/configfile_map.jinja" import files with context %} include: - sensu @@ -8,7 +9,9 @@ include: - formatter: json - user: {{ files.files.user }} - group: {{ files.files.group }} + {%- if grains['os_family'] != 'Windows' %} - mode: 644 + {%- endif %} - require: - pkg: sensu - dataset: diff --git a/sensu/uchiwa.sls b/sensu/uchiwa.sls index 357e930..24dcf4e 100644 --- a/sensu/uchiwa.sls +++ b/sensu/uchiwa.sls @@ -1,4 +1,5 @@ {% from "sensu/pillar_map.jinja" import sensu with context -%} +{% from "sensu/configfile_map.jinja" import files with context %} include: - sensu @@ -12,7 +13,7 @@ uchiwa: - formatter: json - user: {{ files.files.user }} - group: {{ files.files.group }} - - mode: 644 + - mode: 640 - require: - pkg: uchiwa - dataset: