Skip nodev mount option for polyinstantiated dirs#14374
Skip nodev mount option for polyinstantiated dirs#14374Mab879 merged 3 commits intoComplianceAsCode:masterfrom
Conversation
Skip attempting to set `nodev` mount option for polyinstantiated /tmp and /var/tmp mounts when enabled
|
Hi @asser. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
| - "item.options is not search('nodev')" | ||
| - "item.fstype not in excluded_fstypes" | ||
| # Attempting to change polyinstantiated mounts for /tmp and /var/tmp, if present, will fail | ||
| - "not accounts_polyinstantiated_var_tmp or item.mount != '/var/tmp/tmp-inst'" |
There was a problem hiding this comment.
Seems like this variable and the one below are sometimes not defined as will cause errors, as picked up by CI.
Something like:
| - "not accounts_polyinstantiated_var_tmp or item.mount != '/var/tmp/tmp-inst'" | |
| - "(not accounts_polyinstantiated_var_tmp | default(false)) or item.mount != '/var/tmp/tmp-inst'" |
might help.
There was a problem hiding this comment.
Indeed, thank you. Updated :)
* Add default filter to set `accounts_polyinstantiated_tmp` and `accounts_polyinstantiated_var_tmp` to false if not defined
|
This datastream diff is auto generated by the check Click here to see the full diffansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions
+++ xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions
@@ -100,8 +100,6 @@
- item.mount is match('/\w')
- item.options is not search('nodev')
- item.fstype not in excluded_fstypes
- - (not accounts_polyinstantiated_var_tmp | default(false)) or item.mount != '/var/tmp/tmp-inst'
- - (not accounts_polyinstantiated_tmp | default(false)) or item.mount != '/tmp/tmp-inst'
with_items:
- '{{ ansible_facts.mounts }}'
tags: |
Skip attempting to set
nodevmount option for polyinstantiated /tmp and /var/tmp mounts when enabledDescription:
Add clauses to skip trying to set the
nodevmount option for the polyinstantiated /tmp/tmp-inst and /var/tmp/tmp-inst mounts, when polyinstantiation is enabled.Rationale:
When applying the Ansible playbook with polyinstantiation enabled through become/sudo as a non-root user, the polyinstantiated /var/tmp/tmp-inst (and /tmp/tmp-inst) bind mounts are present in
ansible_facts.mounts, but cannot be changed with theansible.posix.mountmodule, which fails with an error (example from the generated role RedHatOfficial.rhel10_anssi_bp28_high):Review Hints:
N/A