X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fdebian_org%2Fmanifests%2Finit.pp;h=db17a742d20011f2919f81714fa557348f1a1672;hb=731c86b98743b06f4c3612b0ec9d3df2158126cc;hp=30f0be56508fb918a9ce70767c73052736fc521d;hpb=a300523e661ea2038b71803522617cc921445c57;p=mirror%2Fdsa-puppet.git

diff --git a/modules/debian_org/manifests/init.pp b/modules/debian_org/manifests/init.pp
index 30f0be565..db17a742d 100644
--- a/modules/debian_org/manifests/init.pp
+++ b/modules/debian_org/manifests/init.pp
@@ -41,12 +41,6 @@ class debian_org {
 		ensure => installed,
 		tag    => extra_repo,
 	}
-	file { '/etc/ssh/ssh_known_hosts':
-		ensure  => present,
-		replace => false,
-		mode    => '0644',
-		source  => 'puppet:///modules/debian_org/basic-ssh_known_hosts'
-	}
 
 	if versioncmp($::lsbmajdistrelease, '8') >= 0 {
 		$rubyfs_package = 'ruby-filesystem'
@@ -178,7 +172,20 @@ class debian_org {
 		notify => Exec['systemctl daemon-reload'],
 	}
 
-	file { '/etc/cron.d/dsa-puppet-stuff':
+	concat { '/etc/cron.d/dsa-puppet-stuff': }
+	concat::fragment { 'dsa-puppet-stuff---header':
+		target => '/etc/cron.d/dsa-puppet-stuff',
+		order  => '000',
+		content  => @(EOF)
+			## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
+			SHELL=/bin/bash
+			MAILTO=root
+			PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/nagios/plugins
+			| EOF
+	}
+	concat::fragment { 'dsa-puppet-stuff---all':
+		target => '/etc/cron.d/dsa-puppet-stuff',
+		order  => '010',
 		content => template('debian_org/dsa-puppet-stuff.cron.erb'),
 		require => Package['debian.org'],
 	}
@@ -229,7 +236,7 @@ class debian_org {
 	}
 	file { '/etc/default/locale':
 		content => "",
-		mode => '0440',
+		mode => '0444',
 	}
 
 	# set mmap_min_addr to 4096 to mitigate
@@ -329,4 +336,36 @@ class debian_org {
 			package { 'irqbalance': ensure => installed }
 		}
 	}
+
+
+	# https://www.decadent.org.uk/ben/blog/bpf-security-issues-in-debian.html
+	site::sysctl { 'unprivileged_bpf_disabled':
+		key   => 'kernel.unprivileged_bpf_disabled',
+		value => '1',
+	}
+
+	# Disable kpartx udev rules
+	file { '/etc/udev/rules.d/60-kpartx.rules':
+		ensure => $has_lib_udev_rules_d_60_kpartx_rules ? { true  => 'present', default => 'absent' },
+		content => "",
+		mode => '0444',
+	}
+
+	# this is only to avoid warnings, else puppet will complain that we
+	# have a symlink there, even if we're not replacing it anyhow.
+	if ! $has_etc_ssh_ssh_known_hosts {
+		file { '/etc/ssh/ssh_known_hosts':
+			ensure  => 'present',
+			replace => 'no',
+			content => inline_template('<%= open("/etc/ssh/ssh_known_hosts").read() %>'),
+			notify  => Exec['ud-replicate'],
+		}
+	}
+
+	exec { 'ud-replicate':
+		path => '/usr/bin:/usr/sbin:/bin:/sbin',
+		command => '/usr/bin/ud-replicate',
+		refreshonly => true,
+		require => Package['userdir-ldap']
+	}
 }