Secure salt minion files.
By default salt minion meta files are created with wide
permissions.
This makes OS tokens, keystone credentials unprotected.
Patch fixes this.
Prod-Related: CEEMCP-13 unprotected keystone credentials
Customer-Found
Change-Id: I18283cff4aec795e0656b7b3519381792e8a6e54
diff --git a/salt/files/userdata b/salt/files/userdata
index ac3a286..2291c88 100644
--- a/salt/files/userdata
+++ b/salt/files/userdata
@@ -6,4 +6,6 @@
sh install_salt.sh
echo "id: {{ node_name }}.{{ cluster.domain }}" > /etc/salt/minion.d/minion.conf
echo "master: salt/master: {{ cluster.config.host }}" >> /etc/salt/minion.d/minion.conf
-service salt-minion restart
\ No newline at end of file
+chown root:root /etc/salt/minion.d/minion.conf
+chmod 0600 /etc/salt/minion.d/minion.conf
+service salt-minion restart
diff --git a/salt/master/minion.sls b/salt/master/minion.sls
index eab2509..0b40c05 100644
--- a/salt/master/minion.sls
+++ b/salt/master/minion.sls
@@ -8,6 +8,8 @@
file.managed:
- source: salt://salt/files/_orchestration.conf
- user: root
+ - group: root
+ - mode: 600
- template: jinja
- makedirs: true
- require:
diff --git a/salt/minion/base.sls b/salt/minion/base.sls
index 62a1748..a9b1714 100644
--- a/salt/minion/base.sls
+++ b/salt/minion/base.sls
@@ -32,6 +32,7 @@
- source: salt://salt/files/minion.conf
- user: root
- group: root
+ - mode: 600
- template: jinja
- require:
- {{ minion.install_state }}
@@ -42,6 +43,8 @@
file.managed:
- source: salt://salt/files/_renderer.conf
- user: root
+ - group: root
+ - mode: 600
- template: jinja
- require:
- {{ minion.install_state }}
diff --git a/salt/minion/service.sls b/salt/minion/service.sls
index 6dbe75a..436b27c 100644
--- a/salt/minion/service.sls
+++ b/salt/minion/service.sls
@@ -31,6 +31,7 @@
- source: salt://salt/files/minion.conf
- user: root
- group: root
+ - mode: 600
- template: jinja
- require:
- {{ minion.install_state }}
@@ -45,6 +46,9 @@
salt_minion_config_{{ service_name }}_{{ name }}:
file.managed:
- name: /etc/salt/minion.d/_{{ name }}.conf
+ - user: root
+ - group: root
+ - mode: 600
- contents: |
{{ conf|yaml(False)|indent(8) }}
- require:
@@ -99,6 +103,8 @@
file.managed:
- source: salt://salt/files/_renderer.conf
- user: root
+ - group: root
+ - mode: 600
- template: jinja
- require:
- {{ minion.install_state }}