cmueller/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Ensure files created by authorized_key have correct selinux context

Browse source 
Three changes:
* Add set_default_selinux_context() to module_common that sets
  a file's context according to the defaults in the policy
* In atomic_replace(), set the default context for the file if
  selinux is enabled and the destination file does not exist.
* In authorized_key, set the default context when creating
  $HOME/.ssh and $HOME/.ssh/authorized_keys.  If these already
  exist, this won't touch them.
This commit is contained in:
Stephen Fromm 2012-12-13 16:29:40 -08:00
parent 393079d5e4
commit d8e3a00933
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
authorized_key
View file

@ -97,6 +97,8 @@ def keyfile(module, user, write=False):
if not os.path.exists(sshdir):
os.mkdir(sshdir, 0700)
if module.selinux_enabled():
module.set_default_selinux_context(sshdir, False)
os.chown(sshdir, uid, gid)
os.chmod(sshdir, 0700)
@ -105,6 +107,8 @@ def keyfile(module, user, write=False):
f = open(keysfile, "w") #touches file so we can set ownership and perms
finally:
f.close()
if module.selinux_enabled():
module.set_default_selinux_context(keysfile, False)
os.chown(keysfile, uid, gid)
os.chmod(keysfile, 0600)