Update aodh config files permissions
The /etc/aodh/*.conf files are world readable.
This may lead to sensitive information leakage and cloud compromise.
Set aodh config files permissions to 0640.
Set aodh config files owner and group to root:aodh.
Change-Id: I98fedad7c8427bae2a613f7ded1ca7631525c624
diff --git a/aodh/server.sls b/aodh/server.sls
index 1805af4..f1b8c83 100644
--- a/aodh/server.sls
+++ b/aodh/server.sls
@@ -11,6 +11,8 @@
file.managed:
- source: salt://aodh/files/{{ server.version }}/aodh.conf.{{ grains.os_family }}
- template: jinja
+ - mode: 0640
+ - group: aodh
- require:
- pkg: aodh_server_packages
@@ -42,7 +44,8 @@
- name: /etc/aodh/logging.conf
- source: salt://oslo_templates/files/logging/_logging.conf
- template: jinja
- - user: aodh
+ - mode: 0640
+ - user: root
- group: aodh
- require:
- pkg: aodh_server_packages
@@ -74,7 +77,8 @@
- name: /etc/aodh/logging/logging-{{ service_name }}.conf
- source: salt://oslo_templates/files/logging/_logging.conf
- template: jinja
- - user: aodh
+ - mode: 0640
+ - user: root
- group: aodh
- require:
- pkg: aodh_server_packages