Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[xenial] run haveged process confined by AppArmor #4118

Merged
merged 3 commits into from
Feb 12, 2019
Merged

[xenial] run haveged process confined by AppArmor #4118

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
30beccc
apparmor: ensure haveged runs confined
redshiftzero Feb 11, 2019
34743e3
testinfra: all processes with an apparmor profile should run confined
redshiftzero Feb 11, 2019
c32d260
apparmor: only modify haveged apparmor config for xenial
redshiftzero Feb 12, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions install_files/ansible-base/roles/app/tasks/configure_haveged.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,3 +38,43 @@
tags:
- haveged
- hardening

# The following three tasks resolve haveged AppArmor issues on Xenial described in
# https://github.com/freedomofpress/securedrop/issues/4098.

- name: Check whether haveged AppArmor profile exists in expected location for Xenial.
stat:
path: "/etc/apparmor.d/usr.sbin.haveged"
register: haveged_apparmor
# Do not report changed, this task does not modify state.
changed_when: false
tags:
- haveged
- hardening

# This temporary fix ensures that the pid file haveged uses is whitelisted
# by AppArmor.
# Upstream bug: https://bugs.launchpad.net/ubuntu/+source/haveged/+bug/1708674
- name: Whitelist haveged pid file in its AppArmor profile.
lineinfile:
dest: /etc/apparmor.d/usr.sbin.haveged
insertafter: " #include <abstractions/base>"
line: " /run/haveged.pid rw,"
when: haveged_apparmor.stat.exists
tags:
- haveged
- hardening

# This temporary fix resolves a race condition where haveged would start
# prior to AppArmor, in which case haveged would be running unconfined.
# Bug described in: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=824179
- name: Start apparmor prior to haveged process.
lineinfile:
dest: /lib/systemd/system/haveged.service
regexp: "^After=systemd-random-seed.service"
line: "After=apparmor.service systemd-random-seed.service"
backrefs: yes
when: haveged_apparmor.stat.exists
tags:
- haveged
- hardening
6 changes: 1 addition & 5 deletions molecule/testinfra/staging/app/test_apparmor.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,12 +116,8 @@ def test_aastatus_unconfined(host):
""" Ensure that there are no processes that are unconfined but have
a profile """

# Trusty should show 0 unconfined processes. In Xenial, haveged
# is unconfined by default, due to introduction of a new profile.
# We should consider enforcing that, too.
# Trusty and Xenial should show 0 unconfined processes.
expected_unconfined = 0
if host.system_info.codename == "xenial":
expected_unconfined = 1

unconfined_chk = str("{} processes are unconfined but have"
" a profile defined".format(expected_unconfined))
Expand Down