Update barbican config files permissions
The /etc/barbican/*.conf files are world readable.
This may lead to sensitive information leakage and cloud compromise.
Set barbican config files permissions to 0640.
Set barbican config files owner and group to root:barbican.
Change-Id: I603cc9a7e1e8b048a2bc0d718a1918013e884c17
diff --git a/barbican/server.sls b/barbican/server.sls
index f31fbcf..f242e35 100644
--- a/barbican/server.sls
+++ b/barbican/server.sls
@@ -13,6 +13,8 @@
file.managed:
- source: salt://barbican/files/{{ server.version }}/barbican.conf.{{ grains.os_family }}
- template: jinja
+ - mode: 0640
+ - group: barbican
- require:
- pkg: barbican_server_packages
@@ -47,7 +49,8 @@
/etc/barbican/logging.conf:
file.managed:
- - user: barbican
+ - mode: 0640
+ - user: root
- group: barbican
- source: salt://oslo_templates/files/logging/_logging.conf
- template: jinja