Skip to content

Decouple and fix permissions for logs and configs#243

Open
nick-markowski wants to merge 1 commit into
simp:masterfrom
nick-markowski:fix_167_194
Open

Decouple and fix permissions for logs and configs#243
nick-markowski wants to merge 1 commit into
simp:masterfrom
nick-markowski:fix_167_194

Conversation

@nick-markowski
Copy link
Copy Markdown
Member

Fixes #167
Fixes #194

  • Minor Gem update
  • Decouple the permissions for logs and configs
  • Add the force parameter to purge on /etc/audit

- Decouple the permissions for logs and configs
- Add the force parameter to purge on /etc/audit
@op-ct op-ct added this to Org Triage May 1, 2026
@silug silug requested a review from Copilot May 11, 2026 16:27
@silug silug moved this from New to In Progress in Org Triage May 11, 2026
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses permission management in the auditd Puppet module by separating ownership/permissions for configuration files under /etc/audit from audit log permissions under /var/log/audit, and by making /etc/audit purging able to remove nested directories (Fixes #167, #194).

Changes:

  • Add a new config_group class parameter and use it for /etc/audit/* ownership and config file modes (instead of log_group).
  • Add force => true to the /etc/audit directory resource to allow purging nested directories.
  • Update unit tests for the new parameter behavior and adjust Gem dependencies.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File Description
manifests/init.pp Introduces config_group parameter to decouple config ownership from log ownership.
manifests/config.pp Applies config_group to /etc/audit resources and sets force => true for purge behavior.
spec/classes/config_spec.rb Updates/extends expectations for new permission/group behavior and force => true.
Gemfile Updates simp-rake-helpers and removes pdk from the bundle.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread manifests/config.pp
Comment on lines 32 to 37
file { '/etc/audit':
ensure => 'directory',
owner => 'root',
group => $auditd::log_group,
group => $auditd::config_group,
mode => $config_file_mode,
recurse => true,
Comment thread manifests/config.pp
Comment on lines 42 to 47
file { '/etc/audit/rules.d':
ensure => 'directory',
owner => 'root',
group => $auditd::log_group,
group => $auditd::config_group,
mode => $config_file_mode,
recurse => true,
Comment on lines 157 to 162
@@ -101,6 +161,7 @@
mode: '0640',
recurse: true,
Comment thread Gemfile
gem 'puppet-strings'
gem 'rake'
gem 'rspec'
gem 'rspec-puppet'
Comment thread manifests/init.pp
Comment on lines 239 to 243
Stdlib::Absolutepath $log_file = '/var/log/audit/audit.log',
Auditd::LogFormat $log_format = 'raw',
String $log_group = 'root',
String $config_group = 'root',
Boolean $loginuid_immutable = true,
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: In Progress

Development

Successfully merging this pull request may close these issues.

Set force => true on /etc/audit directory Allow users to manage /etc/audit/* group independent from $auditd::log_group

4 participants