ffd0bdb7ad
Add a default policy for custom directories and files to constrain what users can do. The intention is to ensure that directories and files can be created only in `/etc` and also that none of the important configuration files can be overwritten by this customization. Add the policy validation to all distro implementation. Signed-off-by: Tomáš Hozza <thozza@redhat.com>
31 lines
846 B
Go
31 lines
846 B
Go
package pathpolicy
|
|
|
|
// MountpointPolicies is a set of default mountpoint policies used for filesystem customizations
|
|
var MountpointPolicies = NewPathPolicies(map[string]PathPolicy{
|
|
"/": {Exact: true},
|
|
"/boot": {Exact: true},
|
|
"/var": {},
|
|
"/opt": {},
|
|
"/srv": {},
|
|
"/usr": {},
|
|
"/app": {},
|
|
"/data": {},
|
|
"/home": {},
|
|
"/tmp": {},
|
|
})
|
|
|
|
// CustomDirectoriesPolicies is a set of default policies for custom directories
|
|
var CustomDirectoriesPolicies = NewPathPolicies(map[string]PathPolicy{
|
|
"/": {Deny: true},
|
|
"/etc": {},
|
|
})
|
|
|
|
// CustomFilesPolicies is a set of default policies for custom files
|
|
var CustomFilesPolicies = NewPathPolicies(map[string]PathPolicy{
|
|
"/": {Deny: true},
|
|
"/etc": {},
|
|
"/etc/fstab": {Deny: true},
|
|
"/etc/shadow": {Deny: true},
|
|
"/etc/passwd": {Deny: true},
|
|
"/etc/group": {Deny: true},
|
|
})
|