blob: d1fb7dd9fc4a0fd04f74a5e7f3d8661f7845c96c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
#!/bin/bash
# Check the generated configuration files.
set -o errexit
# Enable unbuffered output for Ansible in Jenkins.
export PYTHONUNBUFFERED=1
function check_config {
# Check every file in /etc/kolla/*.
failed=0
expected_user=${CONFIG_OWNER_USER:-root}
expected_group=${CONFIG_OWNER_GROUP:-root}
# Ignore files generated by Zuul.
for f in $(sudo find /etc/kolla \
-not -regex /etc/kolla/config.* \
-not -regex /etc/kolla/certificates.* \
-not -regex /etc/kolla/octavia-certificates.* \
-not -regex .*pem \
-not -regex .*key \
-not -regex ".*ca-certificates.*" \
-not -path /etc/kolla \
-not -path /etc/kolla/clouds.yaml \
-not -regex .*-openrc.sh \
-not -regex .*-openrc-system.sh \
-not -name globals.yml \
-not -name header \
-not -name inventory \
-not -name ceph-inventory \
-not -name kolla-build.conf \
-not -name passwords.yml \
-not -name passwords.yml.old \
-not -name sources.list \
-not -name template_overrides.j2)
do
mode=$(sudo stat -c %a $f)
owner=$(sudo stat -c %U:%G $f)
if [[ -d $f ]]; then
# Directories should be 770.
if [[ $mode != "770" ]]; then
failed=1
echo "ERROR: Unexpected permissions on directory $f. Got $mode, expected 770"
fi
else
# Files should be 600, 660 or 770.
if [[ ! $mode =~ ^(600|660|770)$ ]] ; then
failed=1
echo "ERROR: Unexpected permissions on file $f. Got $mode, expected 770 or 660"
fi
fi
# Owner user & group should be the config owner, default root.
if [[ $owner != "$expected_user:$expected_group" ]]; then
failed=1
echo "ERROR: Unexpected ownership on $f. Got $owner, expected $expected_user:$expected_group"
fi
done
return $failed
}
check_config
|
