From 819cf9d403e2f6166a253076e699a91f00ce288d Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 27 Jan 2021 19:28:25 +0100 Subject: [PATCH 1/2] fix remediation --- .../dir_perms_world_writable_root_owned/ansible/shared.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/ansible/shared.yml b/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/ansible/shared.yml index d5c0a647816..893bc9e713c 100644 --- a/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/ansible/shared.yml +++ b/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/ansible/shared.yml @@ -30,7 +30,7 @@ - name: "Create empty list of excluded paths" set_fact: - excluded_paths: "[]" + excluded_paths: [] - name: "Detect nonlocal file systems and add them to excluded paths" set_fact: From a53b519a0679fbe7ca3b3d10723eaba2ccf8b04a Mon Sep 17 00:00:00 2001 From: Vojtech Polasek Date: Wed, 27 Jan 2021 19:28:57 +0100 Subject: [PATCH 2/2] add test for nonlocal filesystem --- .../tests/world_writable_dir_on_nonlocal_fs.fail.sh | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/tests/world_writable_dir_on_nonlocal_fs.fail.sh diff --git a/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/tests/world_writable_dir_on_nonlocal_fs.fail.sh b/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/tests/world_writable_dir_on_nonlocal_fs.fail.sh new file mode 100644 index 00000000000..5fb77b9004d --- /dev/null +++ b/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/tests/world_writable_dir_on_nonlocal_fs.fail.sh @@ -0,0 +1,11 @@ +#!/bin/bash +# packages = nfs-utils + +mkdir -p /tmp/testdir/testdir2 +mkdir /tmp/testmount +chown 2 /tmp/testdir/testdir2 +chmod 777 /tmp/testdir/testdir2 + +echo '/tmp/testdir localhost(rw)' > /etc/exports +systemctl restart nfs-server +mount.nfs localhost:/tmp/testdir /tmp/testmount