Fix up config file permissions on the host

Several config file permissions are incorrect on the host. In general,
files should be 0660, and directories and executables 0770.

Change-Id: Id276ac1864f280554e98b937f2845bb424d521de
Closes-Bug: #1821579
This commit is contained in:
Mark Goddard 2019-03-22 19:18:45 +00:00
parent 0b67ce93eb
commit a4bb8567da
32 changed files with 72 additions and 20 deletions

View File

@ -20,6 +20,7 @@
file:
path: /etc/sudoers.d/kolla-ansible-users
state: touch
mode: "0640"
become: True
when: create_kolla_user_sudoers | bool

View File

@ -21,7 +21,7 @@
src: "{{ node_custom_config }}/ceilometer/polling.yaml"
dest: "{{ node_config_directory }}/{{ item.key }}/polling.yaml"
force: True
mode: "0600"
mode: "0660"
become: true
register: ceilometer_polling_overwriting
when:
@ -123,6 +123,7 @@
template:
src: "pipeline.yaml.j2"
dest: "{{ node_config_directory }}/{{ item.key }}/pipeline.yaml"
mode: "0660"
become: true
register: ceilometer_pipelines
when:
@ -163,6 +164,7 @@
copy:
src: "{{ node_custom_config }}/vmware_ca"
dest: "{{ node_config_directory }}/ceilometer-compute/vmware_ca"
mode: "0660"
register: vcenter_ca_file
when:
- nova_compute_virt_type == "vmware"

View File

@ -60,7 +60,7 @@
template:
src: "{{ item }}"
dest: "{{ node_config_directory }}/ceph-nfs/ganesha.conf"
mode: 0600
mode: "0600"
become: true
when:
- inventory_hostname in groups['ceph-nfs']

View File

@ -35,7 +35,7 @@
[mds.{{ item.item }}]
key = {{ item.keyring.key }}
dest: "{{ node_config_directory }}/ceph-mds/ceph.mds.{{ inventory_hostname }}.keyring"
mode: 0600
mode: "0600"
when:
- inventory_hostname == item.item
with_items: "{{ ceph_mds_auth.results }}"

View File

@ -15,7 +15,7 @@
[mgr.{{ item.item }}]
key = {{ item.keyring.key }}
dest: "{{ node_config_directory }}/ceph-mgr/ceph.mgr.{{ inventory_hostname }}.keyring"
mode: 0600
mode: "0600"
when:
- inventory_hostname == item.item
with_items: "{{ ceph_mgr_keyring.results }}"

View File

@ -68,6 +68,7 @@
template:
src: "{{ item }}"
dest: "{{ node_config_directory }}/cinder-api/cinder-wsgi.conf"
mode: "0660"
with_first_found:
- "{{ node_custom_config }}/cinder/{{ inventory_hostname }}/cinder-wsgi.conf"
- "{{ node_custom_config }}/cinder/cinder-wsgi.conf"
@ -108,6 +109,7 @@
template:
src: "{{ cinder_policy_file_path }}"
dest: "{{ node_config_directory }}/{{ item.key }}/{{ cinder_policy_file }}"
mode: "0660"
register: cinder_policy_overwriting
when:
- item.value.enabled | bool
@ -125,6 +127,7 @@
template:
src: "{{ item }}"
dest: "{{ node_config_directory }}/cinder-volume/nfs_shares"
mode: "0660"
with_first_found:
- files:
- "{{ node_custom_config }}/nfs_shares.j2"

View File

@ -16,6 +16,7 @@
file:
path: "{{ node_config_directory }}/{{ item }}"
state: "directory"
mode: "0770"
become: true
with_items:
- "fluentd"
@ -72,6 +73,7 @@
template:
src: "{{ item.path }}"
dest: "{{ node_config_directory }}/fluentd/input/{{ item.path | basename }}"
mode: "0660"
register: fluentd_input_custom
when:
- enable_fluentd | bool
@ -172,6 +174,7 @@
template:
src: "{{ item.path }}"
dest: "{{ node_config_directory }}/fluentd/format/{{ item.path | basename }}"
mode: "0660"
register: fluentd_format_custom
when:
- enable_fluentd | bool

View File

@ -3,6 +3,7 @@
template:
src: "{{ node_custom_config }}/designate/rndc.conf"
dest: "{{ node_config_directory }}/{{ item.key }}/rndc.conf"
mode: "0660"
register: designate_rndc_conf
when:
- designate_backend_external == 'bind9'
@ -17,6 +18,7 @@
template:
src: "{{ node_custom_config }}/designate/rndc.key"
dest: "{{ node_config_directory }}/{{ item.key }}/rndc.key"
mode: "0660"
register: designate_rndc_key_file
when:
- designate_backend_external == 'bind9'

View File

@ -160,7 +160,7 @@
template:
src: "{{ designate_policy_file_path }}"
dest: "{{ node_config_directory }}/{{ item.key }}/{{ designate_policy_file }}"
mode: "0770"
mode: "0660"
become: true
register: designate_policy_overwriting
when:

View File

@ -83,7 +83,7 @@
template:
src: "{{ freezer_policy_file_path }}"
dest: "{{ node_config_directory }}/{{ item.key }}/{{ freezer_policy_file }}"
mode: "0770"
mode: "0660"
become: true
register: freezer_policy_overwriting
when:

View File

@ -6,6 +6,7 @@
- "{{ node_custom_config }}/ceph.conf"
- "{{ node_custom_config }}/ceph/{{ inventory_hostname }}/ceph.conf"
dest: "{{ node_config_directory }}/{{ item }}/ceph.conf"
mode: "0660"
become: true
when: inventory_hostname in groups[item]
with_items:

View File

@ -99,6 +99,7 @@
template:
src: "{{ gnocchi_policy_file_path }}"
dest: "{{ node_config_directory }}/{{ item.key }}/{{ gnocchi_policy_file }}"
mode: "0660"
register: gnocchi_policy_overwriting
when:
- gnocchi_policy_file is defined

View File

@ -3,6 +3,7 @@
template:
src: "{{ node_custom_config }}/gnocchi/ceph.conf"
dest: "{{ node_config_directory }}/{{ item }}/ceph.conf"
mode: "0660"
become: true
when: inventory_hostname in groups[item]
with_items:
@ -18,6 +19,7 @@
copy:
src: "{{ node_custom_config }}/gnocchi/ceph.client.gnocchi.keyring"
dest: "{{ node_config_directory }}/{{ item }}/ceph.client.gnocchi.keyring"
mode: "0660"
become: true
when: inventory_hostname in groups[item]
with_items:

View File

@ -73,6 +73,7 @@
template:
src: "{{ node_custom_config }}/grafana/grafana_home_dashboard.json"
dest: "{{ node_config_directory }}/grafana/grafana_home_dashboard.json"
mode: "0660"
register: grafana_home_dashboard
when: grafana_custom_dashboard_file.stat.exists
notify:

View File

@ -245,7 +245,7 @@
template:
src: "{{ ironic_policy_file_path }}"
dest: "{{ node_config_directory }}/{{ item.key }}/{{ ironic_policy_file }}"
mode: "0770"
mode: "0660"
become: true
register: ironic_policy_jsons
when:

View File

@ -91,6 +91,7 @@
file:
dest: "{{ node_config_directory }}/keystone/domains/"
state: "directory"
mode: "0770"
become: true
when:
- inventory_hostname in groups[keystone.group]

View File

@ -110,6 +110,7 @@
template:
src: "{{ manila_policy_file_path }}"
dest: "{{ node_config_directory }}/{{ item.key }}/{{ manila_policy_file }}"
mode: "0660"
register: manila_policy_overwriting
when:
- manila_policy_file is defined

View File

@ -4,12 +4,17 @@
when: not has_cluster | bool
- name: Cleaning up temp file on mariadb hosts
file: path=/tmp/kolla_mariadb_grastate.dat state=absent
file:
path: /tmp/kolla_mariadb_grastate.dat
state: absent
changed_when: false
check_mode: no
- name: Cleaning up temp file on localhost
local_action: file path=/tmp/kolla_mariadb_recover_inventory_name state=absent
local_action:
module: file
path: /tmp/kolla_mariadb_recover_inventory_name
state: absent
changed_when: false
check_mode: no
run_once: true
@ -50,7 +55,9 @@
register: wsrep_recovery_seqno
- name: Removing MariaDB log file from /tmp
file: path=/tmp/mariadb_tmp.log state=absent
file:
path: /tmp/mariadb_tmp.log
state: absent
changed_when: false
check_mode: no

View File

@ -86,6 +86,7 @@
template:
src: "{{ item }}"
dest: "{{ node_config_directory }}/mistral-event-engine/event_definitions.yaml"
mode: "0660"
register: mistral_event_definitions_confs
when:
- inventory_hostname in groups[service.group]

View File

@ -36,7 +36,7 @@
template:
src: "{{ item.key }}.json.j2"
dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
mode: "0770"
mode: "0660"
register: neutron_config_jsons
when:
- item.value.enabled | bool
@ -94,6 +94,7 @@
- "{{ node_custom_config }}/neutron/neutron_lbaas.conf"
- "{{ node_custom_config }}/neutron/{{ inventory_hostname }}/neutron_lbaas.conf"
dest: "{{ node_config_directory }}/{{ item.key }}/neutron_lbaas.conf"
mode: "0660"
register: neutron_lbaas_confs
when:
- item.value.enabled | bool
@ -116,6 +117,7 @@
- "{{ node_custom_config }}/neutron/neutron_vpnaas.conf"
- "{{ node_custom_config }}/neutron/{{ inventory_hostname }}/neutron_vpnaas.conf"
dest: "{{ node_config_directory }}/{{ item.key }}/neutron_vpnaas.conf"
mode: "0660"
register: neutron_vpnaas_confs
when:
- item.value.enabled | bool
@ -185,6 +187,7 @@
- "{{ node_custom_config }}/neutron/sriov_agent.ini"
- "{{ node_custom_config }}/neutron/{{ inventory_hostname }}/sriov_agent.ini"
dest: "{{ node_config_directory }}/{{ service_name }}/sriov_agent.ini"
mode: "0660"
register: neutron_sriov_agent_ini
when:
- neutron_sriov_agent.enabled | bool
@ -353,6 +356,7 @@
- "{{ role_path }}/templates/bgp_dragent.ini.j2"
- "{{ node_custom_config }}/neutron/bgp_dragent.ini"
dest: "{{ node_config_directory }}/{{ service_name }}/bgp_dragent.ini"
mode: "0660"
register: neutron_bgp_dragent_ini
when:
- neutron_bgp_dragent.enabled | bool
@ -375,6 +379,7 @@
- "{{ node_custom_config }}/neutron/nsx.ini"
- "{{ node_custom_config }}/neutron/{{ inventory_hostname }}/nsx.ini"
dest: "{{ node_config_directory }}/{{ service_name }}/nsx.ini"
mode: "0660"
register: nsx_ini
when:
- neutron_server.enabled | bool
@ -420,6 +425,7 @@
template:
src: neutron-l3-agent-wrapper.sh.j2
dest: "{{ node_config_directory }}/{{ service_name }}/neutron-l3-agent-wrapper.sh"
mode: "0770"
register: neutron_l3_agent_wrapper
when:
- service.enabled | bool

View File

@ -4,7 +4,7 @@
file:
path: "{{ node_config_directory }}/nova-compute-fake-{{ item }}"
state: "directory"
recurse: yes
mode: "0770"
with_sequence: start=1 end={{ num_nova_fake_per_node }}
notify:
- Restart nova-compute-fake containers

View File

@ -62,7 +62,7 @@
template:
src: "{{ item.key }}.json.j2"
dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
mode: "0770"
mode: "0660"
register: config_jsons
when:
- inventory_hostname in groups[item.value.group]
@ -144,6 +144,7 @@
copy:
src: "{{ node_custom_config }}/vmware_ca"
dest: "{{ node_config_directory }}/nova-compute/vmware_ca"
mode: "0660"
register: vcenter_ca_file
when:
- nova_compute_virt_type == "vmware"
@ -159,6 +160,7 @@
copy:
src: "{{ item }}"
dest: "{{ node_config_directory }}/nova-compute/release"
mode: "0660"
with_first_found:
- files:
- "{{ node_custom_config }}/nova_compute/{{ inventory_hostname }}/release"
@ -188,6 +190,7 @@
template:
src: "{{ nova_policy_file_path }}"
dest: "{{ node_config_directory }}/{{ item.key }}/{{ nova_policy_file }}"
mode: "0660"
register: nova_policy_overwriting
when:
- inventory_hostname in groups[item.value.group]

View File

@ -104,6 +104,7 @@
copy:
src: "{{ node_custom_config }}/octavia/{{ item }}"
dest: "{{ node_config_directory }}/octavia-housekeeping/{{ item }}"
mode: "0660"
become: true
register: octavia_housekeeping_certificate
when:
@ -122,6 +123,7 @@
copy:
src: "{{ node_custom_config }}/octavia/{{ item }}"
dest: "{{ node_config_directory }}/octavia-health-manager/{{ item }}"
mode: "0660"
become: true
register: octavia_health_manager_certificate
when:

View File

@ -198,6 +198,7 @@
template:
src: "{{ item }}"
dest: "{{ node_config_directory }}/opendaylight/10-rest-connector.xml"
mode: "0660"
become: true
with_first_found:
- "{{ node_custom_config }}/opendaylight/{{ inventory_hostname }}/10-rest-connector.xml"

View File

@ -24,7 +24,7 @@
template:
src: "{{ item.key }}.json.j2"
dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
mode: "0770"
mode: "0660"
register: openvswitch_config_jsons
when:
- item.value.enabled | bool
@ -40,6 +40,7 @@
template:
src: "{{ role_path }}/templates/start-ovs.j2"
dest: "{{ node_config_directory }}/openvswitch-vswitchd/start-ovs"
mode: "0770"
register: openvswitch_start_ovs
when:
- inventory_hostname in groups[service.group]
@ -54,6 +55,7 @@
template:
src: "{{ role_path }}/templates/start-ovsdb-server.j2"
dest: "{{ node_config_directory }}/openvswitch-db-server/start-ovsdb-server"
mode: "0770"
register: openvswitch_start_ovsdb_server
when:
- inventory_hostname in groups[service.group]

View File

@ -15,6 +15,7 @@
template:
src: "{{ item.key }}.json.j2"
dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
mode: "0660"
register: ovsdpdk_config_jsons
when:
- item.value.enabled | bool
@ -27,7 +28,7 @@
copy:
src: ../tools/ovs-dpdkctl.sh
dest: "{{ node_config_directory }}/ovsdpdk-db/ovs-dpdkctl.sh"
mode: 0777
mode: "0770"
- name: Install ovs-dpdkctl service and config
become: True

View File

@ -34,7 +34,7 @@
template:
src: "{{ item.key }}.json.j2"
dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
mode: "0770"
mode: "0660"
when:
- inventory_hostname in groups[item.value.group]
- item.value.enabled | bool
@ -69,6 +69,7 @@
template:
src: "placement-api-wsgi.conf.j2"
dest: "{{ node_config_directory }}/placement-api/placement-api-wsgi.conf"
mode: "0660"
when:
- inventory_hostname in groups[service.group]
- service.enabled | bool
@ -82,6 +83,7 @@
template:
src: "migrate-db.rc.j2"
dest: "{{ node_config_directory }}/placement-api/migrate-db.rc"
mode: "0660"
when:
- inventory_hostname in groups[service.group]
- service.enabled | bool
@ -93,6 +95,7 @@
template:
src: "{{ placement_policy_file_path }}"
dest: "{{ placement_config_directory }}/{{ item.key }}/{{ placement_policy_file }}"
mode: "0660"
when:
- inventory_hostname in groups[item.value.group]
- item.value.enabled | bool

View File

@ -17,6 +17,7 @@
template:
src: "{{ item.key }}.json.j2"
dest: "{{ node_config_directory }}/{{ item.key }}/config.json"
mode: "0660"
register: prometheus_config_jsons
when:
- inventory_hostname in groups[item.value.group]
@ -60,6 +61,7 @@
template:
src: "{{ item }}"
dest: "{{ node_config_directory }}/prometheus-server/prometheus.yml"
mode: "0660"
register: prometheus_confs
when:
- inventory_hostname in groups[service.group]
@ -78,6 +80,7 @@
template:
src: "{{ item }}"
dest: "{{ node_config_directory }}/prometheus-alertmanager/prometheus-alertmanager.yml"
mode: "0660"
register: prometheus_alertmanager_confs
when:
- inventory_hostname in groups[service.group]
@ -99,6 +102,7 @@
- "{{ node_custom_config }}/prometheus-mysqld-exporter/my.cnf"
- "{{ role_path }}/templates/my.cnf.j2"
dest: "{{ node_config_directory }}/prometheus-mysqld-exporter/my.cnf"
mode: "0660"
register: prometheus_conf_mycnf
when:
- inventory_hostname in groups[service.group]
@ -112,6 +116,7 @@
template:
src: "{{ item }}"
dest: "{{ node_config_directory }}/prometheus-openstack-exporter/clouds.yml"
mode: "0660"
register: prometheus_openstack_exporter_confs
when:
- inventory_hostname in groups[service.group]

View File

@ -16,7 +16,7 @@
template:
src: "{{ item.key }}.json.j2"
dest: "{{ node_config_directory }}/{{ project_name }}/config.json"
mode: "0770"
mode: "0660"
become: true
when:
- inventory_hostname in groups[item.value.group]
@ -33,7 +33,7 @@
template:
src: "{{ item }}"
dest: "{{ node_config_directory }}/{{ project_name }}/rabbitmq-env.conf"
mode: "0770"
mode: "0660"
with_first_found:
- "{{ node_custom_config }}/rabbitmq/{{ inventory_hostname }}/rabbitmq-env.conf"
- "{{ node_custom_config }}/rabbitmq/rabbitmq-env.conf"
@ -53,7 +53,7 @@
template:
src: "{{ item }}"
dest: "{{ node_config_directory }}/{{ project_name }}/rabbitmq.conf"
mode: "0770"
mode: "0660"
with_first_found:
- "{{ node_custom_config }}/rabbitmq/{{ inventory_hostname }}/rabbitmq.conf"
- "{{ node_custom_config }}/rabbitmq/rabbitmq.conf"
@ -72,7 +72,7 @@
template:
src: "{{ item }}"
dest: "{{ node_config_directory }}/{{ project_name }}/definitions.json"
mode: "0770"
mode: "0660"
with_first_found:
- "{{ node_custom_config }}/rabbitmq/{{ inventory_hostname }}/definitions.json"
- "{{ node_custom_config }}/rabbitmq/definitions.json"

View File

@ -193,6 +193,7 @@
template:
src: "{{ node_custom_config }}/swift/policy.json"
dest: "{{ node_config_directory }}/{{ item }}/policy.json"
mode: "0660"
with_items:
- "swift-account-auditor"
- "swift-account-reaper"

View File

@ -92,6 +92,7 @@
template:
src: "{{ trove_policy_file_path }}"
dest: "{{ node_config_directory }}/{{ item.key }}/{{ trove_policy_file }}"
mode: "0660"
register: trove_policy_overwriting
when:
- trove_policy_file is defined

View File

@ -70,6 +70,7 @@
template:
src: "{{ watcher_policy_file_path }}"
dest: "{{ node_config_directory }}/{{ item.key }}/{{ watcher_policy_file }}"
mode: "0660"
register: watcher_policy_overwriting
when:
- watcher_policy_file is defined