Skip to content

add testing and support for current versions of Fedora and FreeBSD #709

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 14 commits into from
Nov 16, 2023
Merged

add testing and support for current versions of Fedora and FreeBSD #709

merged 14 commits into from
Nov 16, 2023

Conversation

schurzi
Copy link
Contributor

@schurzi schurzi commented Nov 10, 2023

No description provided.

@schurzi schurzi requested a review from rndmh3ro November 10, 2023 19:14
schurzi added 11 commits November 14, 2023 18:26
@schurzi
also harden /home mount
52b7850 
Signed-off-by: Martin Schurz <[email protected]>
@schurzi
also harden /tmp mount
93d651e 
Signed-off-by: Martin Schurz <[email protected]>
@schurzi
test mock efi directory
3a94803 
Signed-off-by: Martin Schurz <[email protected]>
@schurzi
remove mock
18aa186 
Signed-off-by: Martin Schurz <[email protected]>
@schurzi
umount efi
1ba19b4 
Signed-off-by: Martin Schurz <[email protected]>
@schurzi
add /tmp to special mountpoints
bc9dd64 
Signed-off-by: Martin Schurz <[email protected]>
@schurzi
set options for /tmp mount
def0f69 
Signed-off-by: Martin Schurz <[email protected]>
@schurzi
create /tmp mount
a77f3c8 
Signed-off-by: Martin Schurz <[email protected]>
@schurzi
create /tmp mount and mount it ...
be7bd21 
Signed-off-by: Martin Schurz <[email protected]>
@schurzi
make fewer changes to default test run
2874814 
Signed-off-by: Martin Schurz <[email protected]>
@schurzi
use correct Ansible var
fc5660f 
Signed-off-by: Martin Schurz <[email protected]>
@schurzi
Copy link
Contributor Author

schurzi commented Nov 15, 2023

@rndmh3ro ready for review.

I had to explicitly add /tmp to mountpoints_list since mounts based on tmpfs are not in the Ansible variable. This should be no problem. Basically this made our role always skip /tmp if it was mounted as a tmpfs. We do not harden it by default, so this should be finde. But everyone who has had hardening for /tmp configured has not had the hardening applied until now. So this might be a breaking change.

@rndmh3ro
Copy link
Member

Thanks, LGTM!

But everyone who has had hardening for /tmp configured has not had the hardening applied until now. So this might be a breaking change.

If this wasn't working but should have, its just a bugfix to me.

@rndmh3ro rndmh3ro merged commit 3d98cbf into master Nov 16, 2023
@rndmh3ro rndmh3ro deleted the fedora39 branch November 16, 2023 08:14
millerthegorilla pushed a commit to millerthegorilla/ansible-collection-hardening that referenced this pull request Apr 13, 2025
@schurzi @millerthegorilla
add testing and support for current versions of Fedora and FreeBSD (d…
833ab42 
…ev-sec#709)

* add testing and support for current versions of Fedora and FreeBSD

Signed-off-by: Martin Schurz <[email protected]>

* add waivers for FreeBSD

Signed-off-by: Martin Schurz <[email protected]>

* use original fedora images

Signed-off-by: Martin Schurz <[email protected]>

* also harden /home mount

Signed-off-by: Martin Schurz <[email protected]>

* also harden /tmp mount

Signed-off-by: Martin Schurz <[email protected]>

* test mock efi directory

Signed-off-by: Martin Schurz <[email protected]>

* remove mock

Signed-off-by: Martin Schurz <[email protected]>

* umount efi

Signed-off-by: Martin Schurz <[email protected]>

* add /tmp to special mountpoints

Signed-off-by: Martin Schurz <[email protected]>

* set options for /tmp mount

Signed-off-by: Martin Schurz <[email protected]>

* create /tmp mount

Signed-off-by: Martin Schurz <[email protected]>

* create /tmp mount and mount it ...

Signed-off-by: Martin Schurz <[email protected]>

* make fewer changes to default test run

Signed-off-by: Martin Schurz <[email protected]>

* use correct Ansible var

Signed-off-by: Martin Schurz <[email protected]>

---------

Signed-off-by: Martin Schurz <[email protected]>
Signed-off-by: James Miller <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rndmh3ro rndmh3ro Awaiting requested review from rndmh3ro

Assignees
No one assigned
Labels
enhancement minor os_hardening ssh_hardening
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@schurzi @rndmh3ro