← Back to branch summary

~junaidali/charms/trusty/plumgrid-director/pg-restart

« back to all changes in this revision

Viewing changes to hooks/charmhelpers/contrib/hardening/apache/checks/config.py

  • Committer: Junaid Ali
  • Date: 2016-05-01 02:16:59 UTC
  • Revision ID: junaidali@plumgrid.com-20160501021659-niy7zqw0iy1celyy
update sleep time in restart_pg, changes for make sync

Show diffs side-by-side

added added

removed removed

Lines of Context:
hooks/charmhelpers/contrib/hardening/apache/checks/config.py
1
 
# Copyright 2016 Canonical Limited.
2
 
#
3
 
# This file is part of charm-helpers.
4
 
#
5
 
# charm-helpers is free software: you can redistribute it and/or modify
6
 
# it under the terms of the GNU Lesser General Public License version 3 as
7
 
# published by the Free Software Foundation.
8
 
#
9
 
# charm-helpers is distributed in the hope that it will be useful,
10
 
# but WITHOUT ANY WARRANTY; without even the implied warranty of
11
 
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12
 
# GNU Lesser General Public License for more details.
13
 
#
14
 
# You should have received a copy of the GNU Lesser General Public License
15
 
# along with charm-helpers.  If not, see <http://www.gnu.org/licenses/>.
16
 
 
17
 
import os
18
 
import re
19
 
import subprocess
20
 
 
21
 
 
22
 
from charmhelpers.core.hookenv import (
23
 
    log,
24
 
    INFO,
25
 
)
26
 
from charmhelpers.contrib.hardening.audits.file import (
27
 
    FilePermissionAudit,
28
 
    DirectoryPermissionAudit,
29
 
    NoReadWriteForOther,
30
 
    TemplatedFile,
31
 
)
32
 
from charmhelpers.contrib.hardening.audits.apache import DisabledModuleAudit
33
 
from charmhelpers.contrib.hardening.apache import TEMPLATES_DIR
34
 
from charmhelpers.contrib.hardening import utils
35
 
 
36
 
 
37
 
def get_audits():
38
 
    """Get Apache hardening config audits.
39
 
 
40
 
    :returns:  dictionary of audits
41
 
    """
42
 
    if subprocess.call(['which', 'apache2'], stdout=subprocess.PIPE) != 0:
43
 
        log("Apache server does not appear to be installed on this node - "
44
 
            "skipping apache hardening", level=INFO)
45
 
        return []
46
 
 
47
 
    context = ApacheConfContext()
48
 
    settings = utils.get_settings('apache')
49
 
    audits = [
50
 
        FilePermissionAudit(paths='/etc/apache2/apache2.conf', user='root',
51
 
                            group='root', mode=0o0640),
52
 
 
53
 
        TemplatedFile(os.path.join(settings['common']['apache_dir'],
54
 
                                   'mods-available/alias.conf'),
55
 
                      context,
56
 
                      TEMPLATES_DIR,
57
 
                      mode=0o0755,
58
 
                      user='root',
59
 
                      service_actions=[{'service': 'apache2',
60
 
                                        'actions': ['restart']}]),
61
 
 
62
 
        TemplatedFile(os.path.join(settings['common']['apache_dir'],
63
 
                                   'conf-enabled/hardening.conf'),
64
 
                      context,
65
 
                      TEMPLATES_DIR,
66
 
                      mode=0o0640,
67
 
                      user='root',
68
 
                      service_actions=[{'service': 'apache2',
69
 
                                        'actions': ['restart']}]),
70
 
 
71
 
        DirectoryPermissionAudit(settings['common']['apache_dir'],
72
 
                                 user='root',
73
 
                                 group='root',
74
 
                                 mode=0o640),
75
 
 
76
 
        DisabledModuleAudit(settings['hardening']['modules_to_disable']),
77
 
 
78
 
        NoReadWriteForOther(settings['common']['apache_dir']),
79
 
    ]
80
 
 
81
 
    return audits
82
 
 
83
 
 
84
 
class ApacheConfContext(object):
85
 
    """Defines the set of key/value pairs to set in a apache config file.
86
 
 
87
 
    This context, when called, will return a dictionary containing the
88
 
    key/value pairs of setting to specify in the
89
 
    /etc/apache/conf-enabled/hardening.conf file.
90
 
    """
91
 
    def __call__(self):
92
 
        settings = utils.get_settings('apache')
93
 
        ctxt = settings['hardening']
94
 
 
95
 
        out = subprocess.check_output(['apache2', '-v'])
96
 
        ctxt['apache_version'] = re.search(r'.+version: Apache/(.+?)\s.+',
97
 
                                           out).group(1)
98
 
        ctxt['apache_icondir'] = '/usr/share/apache2/icons/'
99
 
        ctxt['traceenable'] = settings['hardening']['traceenable']
100
 
        return ctxt