← Back to branch summary

~canonical-hw-cert/charms/xenial/snappy-device-agent/trunk

« back to all changes in this revision

Viewing changes to hooks/charmhelpers/contrib/hardening/host/checks/limits.py

  • Committer: Paul Larson
  • Date: 2016-05-16 20:27:32 UTC
  • Revision ID: paul.larson@canonical.com-20160516202732-9r4nkyl2f91w9xo3
Add support for xenial

Show diffs side-by-side

added added

removed removed

Lines of Context:
hooks/charmhelpers/contrib/hardening/host/checks/limits.py
 
1
# Copyright 2016 Canonical Limited.
 
2
#
 
3
# This file is part of charm-helpers.
 
4
#
 
5
# charm-helpers is free software: you can redistribute it and/or modify
 
6
# it under the terms of the GNU Lesser General Public License version 3 as
 
7
# published by the Free Software Foundation.
 
8
#
 
9
# charm-helpers is distributed in the hope that it will be useful,
 
10
# but WITHOUT ANY WARRANTY; without even the implied warranty of
 
11
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
12
# GNU Lesser General Public License for more details.
 
13
#
 
14
# You should have received a copy of the GNU Lesser General Public License
 
15
# along with charm-helpers.  If not, see <http://www.gnu.org/licenses/>.
 
16
 
 
17
from charmhelpers.contrib.hardening.audits.file import (
 
18
    DirectoryPermissionAudit,
 
19
    TemplatedFile,
 
20
)
 
21
from charmhelpers.contrib.hardening.host import TEMPLATES_DIR
 
22
from charmhelpers.contrib.hardening import utils
 
23
 
 
24
 
 
25
def get_audits():
 
26
    """Get OS hardening security limits audits.
 
27
 
 
28
    :returns:  dictionary of audits
 
29
    """
 
30
    audits = []
 
31
    settings = utils.get_settings('os')
 
32
 
 
33
    # Ensure that the /etc/security/limits.d directory is only writable
 
34
    # by the root user, but others can execute and read.
 
35
    audits.append(DirectoryPermissionAudit('/etc/security/limits.d',
 
36
                                           user='root', group='root',
 
37
                                           mode=0o755))
 
38
 
 
39
    # If core dumps are not enabled, then don't allow core dumps to be
 
40
    # created as they may contain sensitive information.
 
41
    if not settings['security']['kernel_enable_core_dump']:
 
42
        audits.append(TemplatedFile('/etc/security/limits.d/10.hardcore.conf',
 
43
                                    SecurityLimitsContext(),
 
44
                                    template_dir=TEMPLATES_DIR,
 
45
                                    user='root', group='root', mode=0o0440))
 
46
    return audits
 
47
 
 
48
 
 
49
class SecurityLimitsContext(object):
 
50
 
 
51
    def __call__(self):
 
52
        settings = utils.get_settings('os')
 
53
        ctxt = {'disable_core_dump':
 
54
                not settings['security']['kernel_enable_core_dump']}
 
55
        return ctxt