Add rules for access to all files under /boot/grub2#14199
Add rules for access to all files under /boot/grub2#14199vojtapolasek merged 1 commit intoComplianceAsCode:masterfrom
/boot/grub2#14199Conversation
|
Skipping CI for Draft Pull Request. |
9c6f842 to
81119c3
Compare
vojtapolasek
left a comment
There was a problem hiding this comment.
Looks mostly good, please see comments.
| title: 'All GRUB configuration files must be group-owned by root' | ||
|
|
||
| description: |- | ||
| The file <tt>{{{ grub2_uefi_boot_path }}}</tt> should |
There was a problem hiding this comment.
I suggest the description talks about "files within the directory" rather than a file.
| The file <tt>{{{ grub2_uefi_boot_path }}}</tt> should | ||
| have mode <tt>0600</tt> to prevent | ||
| destruction or modification of the file. | ||
| {{{ describe_file_group_owner(file=grub2_uefi_boot_path ~ "/grub.cfg", group="root") }}} |
There was a problem hiding this comment.
Wrong macro used, this is about file permissions.
| title: 'All GRUB configuration files must be owned by root' | ||
|
|
||
| description: |- | ||
| The file <tt>{{{ grub2_uefi_boot_path }}}/grub.cfg</tt> should |
There was a problem hiding this comment.
The specific file is mentioned here while the rule covers all files within the directory.
81119c3 to
cfb1806
Compare
cfb1806 to
4ef6926
Compare
vojtapolasek
left a comment
There was a problem hiding this comment.
Hello,
sorry that it took so long. Please rebase and see my comment.
Also please set the severity of rules to medium. Thank you.
| title: 'All GRUB configuration files must be owned by root' | ||
|
|
||
| description: |- | ||
| The files in <tt>{{{ grub2_uefi_boot_path }}}/grub.cfg</tt> should |
There was a problem hiding this comment.
| The files in <tt>{{{ grub2_uefi_boot_path }}}/grub.cfg</tt> should | |
| The files in <tt>{{{ grub2_uefi_boot_path }}}</tt> should |
4ef6926 to
cdd2b7b
Compare
ATEX Test ResultsTest artifacts have been submitted to Testing Farm. Results: View Test Results This comment was automatically generated by the ATEX workflow. |
cdd2b7b to
7f1303d
Compare
|
@Mab879: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
16e20f6
into
ComplianceAsCode:master
Description:
Rationale:
Update the rules to match upstream.