add prod dirs via .gitkeep

[kbrock]

part of ManageIQ/manageiq#20394

requires:

• add prod dirs via .gitkeep manageiq#21355

Goal

Manipulate the files less. Letting them get created by git and staying as hands off as possible.

Changes

• Create directories in main repo (via .gitkeep) instead of using mkdir in the rpmspec
• ensure world can not read sensitive files (by locking down the directory)
• don't bother locking down files since the directories are locked.
• set both group and user bits so files created by root will be available for processes running as manageiq.
• put directories in core and ui sections to better designate purpose of directories.

(the changes are listed as final result, some of the changes were partially in place before this PR)

[Fryguy]

@bdunne please review.

[kbrock]

update: moved chmod for core over to ui.

unwip: rpm working

[kbrock]

removed a few of the chown lines to hopefully make this less opinionated and make easier to merge.
We can address those changes at a later date

[Fryguy]

Would it be simpler to just 6750 the entire data dir into the previous line?

Suggested change

	%{__chmod} 6750 %{buildroot}%{app_root}/{log,config,certs}
	%{__chmod} 6750 %{buildroot}%{app_root}/data/git_repos
	%{__chmod} 6750 %{buildroot}%{app_root}/{log,config,certs,data}

[Fryguy]

I'm not sure what else is in there, but I assume anything else needs writability as well

[kbrock]

by default, the directories are 755. So all the lines above changing to manageiq.manageiq makes them writeable and readable.

This change says that root (basically just evmserverd and appliance_console) will write to these directories, and we want manageiq to be able to read and write to those files. (the umask for root is 755 and makes our processes blow up.)

There area also some ui directories that need access. I have moved those over to the ui spec per previous request in this pr

[kbrock]

^ ignore.

So we can chmod -r data which will change anything that we add at a later time.
Just need to be aware if we add any files to github, they will potentially be running with escalated privileges

[Fryguy]

I don't think we should chmod -r, because the content inside the git repos directory are external git repos. Not sure what side effects that might cause. Maybe @NickLaMuro has some thoughts here.

[NickLaMuro]

So, seems that git will only track the executable permissions, not the full set of nix permission levels:

https://stackoverflow.com/questions/10516201/updating-and-committing-only-a-files-permissions-using-git-version-control

So, with that said, I assume what ever we do here, it needs to be able to allow anyone that executes playbooks that might come with a role (and I assume that could include a shell/python executable) to be able to run those scripts. But that might be less of an issue since the repos here are just bare repos, and so the actually checkout happens into /tmp.

So we might be okay with whatever is done here as /tmp is where any actually interaction would come from from a potentially different and less privileged user.

[kbrock]

I chmod the data dir and the git_repo

let me know if this is not what you were asking for

[kbrock]

@Fryguy I'm confused what you want

%{__chmod} 6750 %{buildroot}%{app_root}/data/git_repos

Would it be simpler to just 6750 the entire data dir

ok

%{__chmod} -r 6750 %{buildroot}%{app_root}/data

I don't think we should chmod -r, because the content inside the git repos directory are external git repos

My goal was to chmod 6750 data/git_repos
I can chmod 750 git_repos, chown manageiq and require all manipulations to be from manageiq.
It will not be that hard to test. But I need to set git_repos.'

What exactly are you asking for?

Put something in place. Hope that is what you were asking for.

[miq-bot]

Checked commit kbrock@3df8dbd with ruby 2.6.3, rubocop 1.13.0, haml-lint 0.35.0, and yamllint
0 files checked, 0 offenses detected
Everything looks fine. ⭐