(maint) Restrict file permissions

PuppetDB runs as the puppetdb user.  This user must have read access to
the various configuration files but does not need write access to them.

This ensure the service configuration cannot be unexpectedly changed by
PuppetDB itself if some vulnerability allow random code execution,
limiting the possibilities of exploitation and pivoting if such a
vulnerability is found.

Author: smortex

manifests/server.pp

@@ -149,7 +149,6 @@
   class { 'puppetdb::server::global':
     vardir         => $vardir,
     confdir        => $confdir,
-    puppetdb_user  => $puppetdb_user,
     puppetdb_group => $puppetdb_group,
     notify         => Service[$puppetdb_service],
   }
@@ -190,7 +189,6 @@
     conn_keep_alive           => $conn_keep_alive,
     conn_lifetime             => $conn_lifetime,
     confdir                   => $confdir,
-    puppetdb_user             => $puppetdb_user,
     puppetdb_group            => $puppetdb_group,
     migrate                   => $migrate,
     notify                    => Service[$puppetdb_service],
@@ -225,7 +223,6 @@
     conn_keep_alive        => $read_conn_keep_alive,
     conn_lifetime          => $read_conn_lifetime,
     confdir                => $confdir,
-    puppetdb_user          => $puppetdb_user,
     puppetdb_group         => $puppetdb_group,
     notify                 => Service[$puppetdb_service],
     database_max_pool_size => $read_database_max_pool_size,
@@ -235,29 +232,29 @@
     file {
       $ssl_dir:
         ensure => directory,
-        owner  => $puppetdb_user,
+        owner  => 'root',
         group  => $puppetdb_group,
-        mode   => '0700';
+        mode   => '0755';
       $ssl_key_path:
         ensure  => file,
         content => $ssl_key,
-        owner   => $puppetdb_user,
+        owner   => 'root',
         group   => $puppetdb_group,
-        mode    => '0600',
+        mode    => '0640',
         notify  => Service[$puppetdb_service];
       $ssl_cert_path:
         ensure  => file,
         content => $ssl_cert,
-        owner   => $puppetdb_user,
+        owner   => 'root',
         group   => $puppetdb_group,
-        mode    => '0600',
+        mode    => '0644',
         notify  => Service[$puppetdb_service];
       $ssl_ca_cert_path:
         ensure  => file,
         content => $ssl_ca_cert,
-        owner   => $puppetdb_user,
+        owner   => 'root',
         group   => $puppetdb_group,
-        mode    => '0600',
+        mode    => '0644',
         notify  => Service[$puppetdb_service];
     }
   }
@@ -275,9 +272,9 @@
 
     file { $ssl_key_pk8_path:
       ensure => present,
-      owner  => $puppetdb_user,
+      owner  => 'root',
       group  => $puppetdb_group,
-      mode   => '0600',
+      mode   => '0640',
       notify => Service[$puppetdb_service]
     }
   }
@@ -298,7 +295,6 @@
     confdir            => $confdir,
     max_threads        => $max_threads,
     notify             => Service[$puppetdb_service],
-    puppetdb_user      => $puppetdb_user,
     puppetdb_group     => $puppetdb_group,
   }
 
@@ -307,7 +303,6 @@
     certificate_whitelist      => $certificate_whitelist,
     disable_update_checking    => $disable_update_checking,
     confdir                    => $confdir,
-    puppetdb_user              => $puppetdb_user,
     puppetdb_group             => $puppetdb_group,
     notify                     => Service[$puppetdb_service],
   }

manifests/server/database.pp

@@ -21,7 +21,6 @@
   $conn_keep_alive           = $puppetdb::params::conn_keep_alive,
   $conn_lifetime             = $puppetdb::params::conn_lifetime,
   $confdir                   = $puppetdb::params::confdir,
-  $puppetdb_user             = $puppetdb::params::puppetdb_user,
   $puppetdb_group            = $puppetdb::params::puppetdb_group,
   $database_max_pool_size    = $puppetdb::params::database_max_pool_size,
   $migrate                   = $puppetdb::params::migrate,
@@ -54,9 +53,9 @@
 
   file { $database_ini:
     ensure => file,
-    owner  => $puppetdb_user,
+    owner  => 'root',
     group  => $puppetdb_group,
-    mode   => '0600',
+    mode   => '0640',
   }
 
   $file_require = File[$database_ini]

manifests/server/global.pp

@@ -2,17 +2,16 @@
 class puppetdb::server::global (
   $vardir         = $puppetdb::params::vardir,
   $confdir        = $puppetdb::params::confdir,
-  $puppetdb_user  = $puppetdb::params::puppetdb_user,
   $puppetdb_group = $puppetdb::params::puppetdb_group,
 ) inherits puppetdb::params {
 
   $config_ini = "${confdir}/config.ini"
 
   file { $config_ini:
     ensure => file,
-    owner  => $puppetdb_user,
+    owner  => 'root',
     group  => $puppetdb_group,
-    mode   => '0600',
+    mode   => '0640',
   }
 
   # Set the defaults

manifests/server/jetty.pp

@@ -14,17 +14,16 @@
   Optional[String] $cipher_suites = $puppetdb::params::cipher_suites,
   $confdir                        = $puppetdb::params::confdir,
   $max_threads                    = $puppetdb::params::max_threads,
-  $puppetdb_user                  = $puppetdb::params::puppetdb_user,
   $puppetdb_group                 = $puppetdb::params::puppetdb_group,
 ) inherits puppetdb::params {
 
   $jetty_ini = "${confdir}/jetty.ini"
 
   file { $jetty_ini:
     ensure => file,
-    owner  => $puppetdb_user,
+    owner  => 'root',
     group  => $puppetdb_group,
-    mode   => '0600',
+    mode   => '0640',
   }
 
   # Set the defaults

manifests/server/puppetdb.pp

@@ -4,17 +4,16 @@
   $certificate_whitelist      = $puppetdb::params::certificate_whitelist,
   $disable_update_checking    = $puppetdb::params::disable_update_checking,
   $confdir                    = $puppetdb::params::confdir,
-  $puppetdb_user              = $puppetdb::params::puppetdb_user,
   $puppetdb_group             = $puppetdb::params::puppetdb_group,
 ) inherits puppetdb::params {
 
   $puppetdb_ini = "${confdir}/puppetdb.ini"
 
   file { $puppetdb_ini:
     ensure => file,
-    owner  => $puppetdb_user,
+    owner  => 'root',
     group  => $puppetdb_group,
-    mode   => '0600',
+    mode   => '0640',
   }
 
   # Set the defaults

manifests/server/read_database.pp

@@ -14,7 +14,6 @@
   $conn_keep_alive        = $puppetdb::params::read_conn_keep_alive,
   $conn_lifetime          = $puppetdb::params::read_conn_lifetime,
   $confdir                = $puppetdb::params::confdir,
-  $puppetdb_user          = $puppetdb::params::puppetdb_user,
   $puppetdb_group         = $puppetdb::params::puppetdb_group,
   $database_max_pool_size = $puppetdb::params::read_database_max_pool_size,
   $postgresql_ssl_on      = $puppetdb::params::postgresql_ssl_on,
@@ -47,9 +46,9 @@
 
     file { $read_database_ini:
       ensure => file,
-      owner  => $puppetdb_user,
+      owner  => 'root',
       group  => $puppetdb_group,
-      mode   => '0600',
+      mode   => '0640',
     }
 
     $file_require = File[$read_database_ini]

spec/unit/classes/server/database_ini_spec.rb

@@ -19,9 +19,9 @@
         is_expected.to contain_file('/etc/puppetlabs/puppetdb/conf.d/database.ini')
           .with(
             'ensure'  => 'file',
-            'owner'   => 'puppetdb',
+            'owner'   => 'root',
             'group'   => 'puppetdb',
-            'mode'    => '0600',
+            'mode'    => '0640',
           )
       }
       it {

spec/unit/classes/server/global_ini_spec.rb

@@ -26,9 +26,9 @@
         is_expected.to contain_file('/etc/puppetlabs/puppetdb/conf.d/config.ini')
           .with(
             'ensure'  => 'file',
-            'owner'   => 'puppetdb',
+            'owner'   => 'root',
             'group'   => 'puppetdb',
-            'mode'    => '0600',
+            'mode'    => '0640',
           )
       }
     end

spec/unit/classes/server/jetty_ini_spec.rb

@@ -16,9 +16,9 @@
         is_expected.to contain_file('/etc/puppetlabs/puppetdb/conf.d/jetty.ini')
           .with(
             'ensure'  => 'file',
-            'owner'   => 'puppetdb',
+            'owner'   => 'root',
             'group'   => 'puppetdb',
-            'mode'    => '0600',
+            'mode'    => '0640',
           )
       }
       it {

spec/unit/classes/server/puppetdb_ini_spec.rb

@@ -36,9 +36,9 @@
         is_expected.to contain_file('/etc/puppetlabs/puppetdb/conf.d/puppetdb.ini')
           .with(
             'ensure'  => 'file',
-            'owner'   => 'puppetdb',
+            'owner'   => 'root',
             'group'   => 'puppetdb',
-            'mode'    => '0600',
+            'mode'    => '0640',
           )
       }
       it {