Merge pull request #162 from artem-sidorenko/debian-shadow

Proper permissions for shadow on debian family
dev-sec · May 22, 2017 · 2c68b00 · 2c68b00
2 parents f7d7d7e + 285946d
commit 2c68b00
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 5 deletions.
diff --git a/recipes/minimize_access.rb b/recipes/minimize_access.rb
@@ -28,11 +28,17 @@
   end
 end
 
-# shadow must only be accessible to user root
+# limit access to shadow. On debian family group shadow should be able to read it
+# (otherwise screensavers might break etc)
 file '/etc/shadow' do
   owner 'root'
-  group 'root'
-  mode '0600'
+  if node['platform_family'] == 'debian'
+    group 'shadow'
+    mode '0640'
+  else
+    group 'root'
+    mode '0600'
+  end
 end
 
 # su must only be accessible to user and group root

diff --git a/spec/recipes/minimize_access_spec.rb b/spec/recipes/minimize_access_spec.rb
@@ -82,8 +82,8 @@
   it 'creates /etc/shadow' do
     is_expected.to create_file('/etc/shadow').with(
       user: 'root',
-      group: 'root',
-      mode: '0600'
+      group: 'shadow',
+      mode: '0640'
     )
   end