← Back to branch summary

~openstack-charmers-next/charms/xenial/nova-compute/trunk

« back to all changes in this revision

Viewing changes to hooks/charmhelpers/contrib/hardening/mysql/checks/config.py

  • Committer: Edward Hope-Morley
  • Date: 2016-03-24 11:18:41 UTC
  • mto: This revision was merged to the branch mainline in revision 211.
  • Revision ID: edward.hope-morley@canonical.com-20160324111841-99ruo5hjzrpqktlx
Add hardening support

Add charmhelpers.contrib.hardening and calls to install,
config-changed, upgrade-charm and update-status hooks.
Also add new config option to allow one or more hardening
modules to be applied at runtime.

Change-Id: I525c15a14662175f2a68cdcd25a3ab2c92237850

Show diffs side-by-side

added added

removed removed

Lines of Context:
hooks/charmhelpers/contrib/hardening/mysql/checks/config.py
 
1
# Copyright 2016 Canonical Limited.
 
2
#
 
3
# This file is part of charm-helpers.
 
4
#
 
5
# charm-helpers is free software: you can redistribute it and/or modify
 
6
# it under the terms of the GNU Lesser General Public License version 3 as
 
7
# published by the Free Software Foundation.
 
8
#
 
9
# charm-helpers is distributed in the hope that it will be useful,
 
10
# but WITHOUT ANY WARRANTY; without even the implied warranty of
 
11
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
12
# GNU Lesser General Public License for more details.
 
13
#
 
14
# You should have received a copy of the GNU Lesser General Public License
 
15
# along with charm-helpers.  If not, see <http://www.gnu.org/licenses/>.
 
16
 
 
17
import six
 
18
import subprocess
 
19
 
 
20
from charmhelpers.core.hookenv import (
 
21
    log,
 
22
    WARNING,
 
23
)
 
24
from charmhelpers.contrib.hardening.audits.file import (
 
25
    FilePermissionAudit,
 
26
    DirectoryPermissionAudit,
 
27
    TemplatedFile,
 
28
)
 
29
from charmhelpers.contrib.hardening.mysql import TEMPLATES_DIR
 
30
from charmhelpers.contrib.hardening import utils
 
31
 
 
32
 
 
33
def get_audits():
 
34
    """Get MySQL hardening config audits.
 
35
 
 
36
    :returns:  dictionary of audits
 
37
    """
 
38
    if subprocess.call(['which', 'mysql'], stdout=subprocess.PIPE) != 0:
 
39
        log("MySQL does not appear to be installed on this node - "
 
40
            "skipping mysql hardening", level=WARNING)
 
41
        return []
 
42
 
 
43
    settings = utils.get_settings('mysql')
 
44
    hardening_settings = settings['hardening']
 
45
    my_cnf = hardening_settings['mysql-conf']
 
46
 
 
47
    audits = [
 
48
        FilePermissionAudit(paths=[my_cnf], user='root',
 
49
                            group='root', mode=0o0600),
 
50
 
 
51
        TemplatedFile(hardening_settings['hardening-conf'],
 
52
                      MySQLConfContext(),
 
53
                      TEMPLATES_DIR,
 
54
                      mode=0o0750,
 
55
                      user='mysql',
 
56
                      group='root',
 
57
                      service_actions=[{'service': 'mysql',
 
58
                                        'actions': ['restart']}]),
 
59
 
 
60
        # MySQL and Percona charms do not allow configuration of the
 
61
        # data directory, so use the default.
 
62
        DirectoryPermissionAudit('/var/lib/mysql',
 
63
                                 user='mysql',
 
64
                                 group='mysql',
 
65
                                 recursive=False,
 
66
                                 mode=0o755),
 
67
 
 
68
        DirectoryPermissionAudit('/etc/mysql',
 
69
                                 user='root',
 
70
                                 group='root',
 
71
                                 recursive=False,
 
72
                                 mode=0o700),
 
73
    ]
 
74
 
 
75
    return audits
 
76
 
 
77
 
 
78
class MySQLConfContext(object):
 
79
    """Defines the set of key/value pairs to set in a mysql config file.
 
80
 
 
81
    This context, when called, will return a dictionary containing the
 
82
    key/value pairs of setting to specify in the
 
83
    /etc/mysql/conf.d/hardening.cnf file.
 
84
    """
 
85
    def __call__(self):
 
86
        settings = utils.get_settings('mysql')
 
87
        # Translate for python3
 
88
        return {'mysql_settings':
 
89
                [(k, v) for k, v in six.iteritems(settings['security'])]}