Merge pull request #146 from martinbydefault/master

Removal of core dump hardening configuration if core dumps are allowed

Author: rndmh3ro

tasks/limits.yml

@@ -1,19 +1,35 @@
 ---
 
-- name: create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
+- block:
+  - name: create limits.d-directory if it does not exist | sysctl-31a, sysctl-31b
+    file:
+      path: '/etc/security/limits.d'
+      owner: 'root'
+      group: 'root'
+      mode: '0755'
+      state: 'directory'
+      
+  - name: create aditional limits config file -> 10.hardcore.conf | sysctl-31a, sysctl-31b
+    pam_limits:
+      dest: '/etc/security/limits.d/10.hardcore.conf'
+      domain: '*'
+      limit_type: hard
+      limit_item: core
+      value: 0
+      comment: Prevent core dumps for all users. These are usually only needed by developers and may contain sensitive information
+      
+  - name: set 10.hardcore.conf perms to 0400 and root ownership
+    file:
+      path: /etc/security/limits.d/10.hardcore.conf
+      owner: 'root'
+      group: 'root'
+      mode: '0440'
+  
+  when: 'not os_security_kernel_enable_core_dump'
+
+- name: remove 10.hardcore.conf config file
   file:
-    path: '/etc/security/limits.d'
-    owner: 'root'
-    group: 'root'
-    mode: '0755'
-    state: 'directory'
-  when: 'os_security_kernel_enable_core_dump'
+    path: /etc/security/limits.d/10.hardcore.conf
+    state: absent
 
-- name: create sane limits.conf | sysctl-31a, sysctl-31b
-  template:
-    src: 'limits.conf.j2'
-    dest: '/etc/security/limits.d/10.hardcore.conf'
-    owner: 'root'
-    group: 'root'
-    mode: '0440'
   when: 'os_security_kernel_enable_core_dump'

tasks/profile.yml

@@ -1,9 +1,15 @@
 ---
-- name: create profile.conf
+- name: add pinerolo_profile.sh to profile.d
   template:
     src: 'profile.conf.j2'
     dest: '/etc/profile.d/pinerolo_profile.sh'
     owner: 'root'
     group: 'root'
     mode: '0750'
   when: not os_security_kernel_enable_core_dump
+  
+- name: remove pinerolo_profile.sh from profile.d
+  file:
+    path: /etc/profile.d/pinerolo_profile.sh
+    state: absent
+  when: os_security_kernel_enable_core_dump