Fix logging setup on Debian

This mitigates DSA-3701 / CVE-2016-1247 and matches the default setup on Debian. https://www.debian.org/security/2016/dsa-3701 https://security-tracker.debian.org/tracker/CVE-2016-1247
voxpupuli · Oct 1, 2018 · 16bd4e7 · 16bd4e7
1 parent 7c7032f
commit 16bd4e7
Show file tree

Hide file tree

Showing 4 changed files with 23 additions and 13 deletions.
diff --git a/manifests/config.pp b/manifests/config.pp
@@ -29,6 +29,7 @@
   $global_group                   = $nginx::global_group
   $global_mode                    = $nginx::global_mode
   $log_dir                        = $nginx::log_dir
+  $log_user                       = $nginx::log_user
   $log_group                      = $nginx::log_group
   $log_mode                       = $nginx::log_mode
   $http_access_log                = $nginx::http_access_log
@@ -178,7 +179,7 @@
   file { $log_dir:
     ensure => directory,
     mode   => $log_mode,
-    owner  => $daemon_user,
+    owner  => $log_user,
     group  => $log_group,
   }
 

diff --git a/manifests/init.pp b/manifests/init.pp
@@ -37,9 +37,10 @@
   $global_owner                                              = $nginx::params::global_owner,
   $global_group                                              = $nginx::params::global_group,
   $global_mode                                               = $nginx::params::global_mode,
-  $log_dir                                                   = $nginx::params::log_dir,
-  $log_group                                                 = $nginx::params::log_group,
-  $log_mode                                                  = '0750',
+  Stdlib::Absolutepath $log_dir                              = $nginx::params::log_dir,
+  String $log_user                                           = $nginx::params::log_user,
+  String $log_group                                          = $nginx::params::log_group,
+  Stdlib::Filemode $log_mode                                 = $nginx::params::log_mode,
   Variant[String, Array[String]] $http_access_log            = "${log_dir}/${nginx::params::http_access_log_file}",
   $http_format_log                                           = undef,
   Variant[String, Array[String]] $nginx_error_log            = "${log_dir}/${nginx::params::nginx_error_log_file}",

diff --git a/manifests/params.pp b/manifests/params.pp
@@ -7,13 +7,15 @@
   ### Operating System Configuration
   ## This is my hacky... no hiera system. Oh well. :)
   $_module_defaults = {
-    'conf_dir'    => '/etc/nginx',
-    'daemon_user' => 'nginx',
-    'pid'         => '/var/run/nginx.pid',
-    'root_group'  => 'root',
-    'log_dir'     => '/var/log/nginx',
-    'log_group'   => 'root',
-    'run_dir'     => '/var/nginx',
+    'conf_dir'     => '/etc/nginx',
+    'daemon_user'  => 'nginx',
+    'pid'          => '/var/run/nginx.pid',
+    'root_group'   => 'root',
+    'log_dir'      => '/var/log/nginx',
+    'log_user'     => 'nginx',
+    'log_group'    => 'root',
+    'log_mode'     => '0750',
+    'run_dir'      => '/var/nginx',
     'package_name' => 'nginx',
     'manage_repo'  => false,
     'mime_types'   => {
@@ -109,12 +111,16 @@
         $_module_os_overrides = {
           'manage_repo' => true,
           'daemon_user' => 'www-data',
+          'log_user'    => 'root',
           'log_group'   => 'adm',
+          'log_mode'    => '0755',
         }
       } else {
         $_module_os_overrides = {
           'daemon_user' => 'www-data',
+          'log_user'    => 'root',
           'log_group'   => 'adm',
+          'log_mode'    => '0755',
         }
       }
     }
@@ -178,7 +184,9 @@
   ### Referenced Variables
   $conf_dir              = $_module_parameters['conf_dir']
   $log_dir               = $_module_parameters['log_dir']
+  $log_user              = $_module_parameters['log_user']
   $log_group             = $_module_parameters['log_group']
+  $log_mode              = $_module_parameters['log_mode']
   $run_dir               = $_module_parameters['run_dir']
   $temp_dir              = '/tmp'
   $pid                   = $_module_parameters['pid']

diff --git a/spec/classes/nginx_spec.rb b/spec/classes/nginx_spec.rb
@@ -360,9 +360,9 @@
             it do
               is_expected.to contain_file('/var/log/nginx').with(
                 ensure: 'directory',
-                owner: 'www-data',
+                owner: 'root',
                 group: 'adm',
-                mode: '0750'
+                mode: '0755'
               )
             end
           end