(maint) Codebase Hardening

Changes made to ensure that no malformed commands are passed through to the system.

Author: david22swan

manifests/custom_config.pp

@@ -115,9 +115,10 @@
       require     => Anchor['::apache::modules_set_up'],
     }
 
+    $remove_command = ['/bin/rm', shell_escape(join([$confdir, $_filename], '/'))]
     exec { "remove ${name} if invalid":
-      command     => "/bin/rm ${confdir}/${_filename}",
-      unless      => $verify_command,
+      command     => $remove_command,
+      unless      => [$verify_command],
       subscribe   => File["apache_${name}"],
       refreshonly => true,
     }

manifests/init.pp

@@ -635,7 +635,9 @@
     path => '/bin:/sbin:/usr/bin:/usr/sbin',
   }
 
+  $confd_command = ['mkdir', $confd_dir]
   exec { "mkdir ${confd_dir}":
+    command => $confd_command,
     creates => $confd_dir,
     require => Package['httpd'],
   }
@@ -660,7 +662,9 @@
   }
 
   if ! defined(File[$mod_dir]) {
+    $mod_command = ['mkdir', $mod_dir]
     exec { "mkdir ${mod_dir}":
+      command => $mod_command,
       creates => $mod_dir,
       require => Package['httpd'],
     }
@@ -678,7 +682,9 @@
 
   if $mod_enable_dir and ! defined(File[$mod_enable_dir]) {
     $mod_load_dir = $mod_enable_dir
+    $mod_enable_command = ['mkdir', $mod_enable_dir]
     exec { "mkdir ${mod_enable_dir}":
+      command => $mod_enable_command,
       creates => $mod_enable_dir,
       require => Package['httpd'],
     }
@@ -694,7 +700,9 @@
   }
 
   if ! defined(File[$vhost_dir]) {
+    $vhost_command = ['mkdir', $vhost_dir]
     exec { "mkdir ${vhost_dir}":
+      command => $vhost_command,
       creates => $vhost_dir,
       require => Package['httpd'],
     }
@@ -709,7 +717,9 @@
 
   if $vhost_enable_dir and ! defined(File[$vhost_enable_dir]) and $manage_vhost_enable_dir {
     $vhost_load_dir = $vhost_enable_dir
+    $vhost_load_command = ['mkdir', $vhost_load_dir]
     exec { "mkdir ${vhost_load_dir}":
+      command => $vhost_load_command,
       creates => $vhost_load_dir,
       require => Package['httpd'],
     }

manifests/mpm/disable_mpm_event.pp

@@ -1,19 +1,28 @@
 # @summary disable Apache-Module event
 class apache::mpm::disable_mpm_event {
+  $event_command = ['/usr/sbin/a2dismod', 'event']
+  $event_onlyif = ['/usr/bin/test', '-e', shell_escape(join([$apache::mod_enable_dir, 'event.load'],'/'))]
   exec { '/usr/sbin/a2dismod event':
-    onlyif  => "/usr/bin/test -e ${apache::mod_enable_dir}/event.load",
+    command => $event_command,
+    onlyif  => $event_onlyif,
     require => Package['httpd'],
     before  => Class['apache::service'],
   }
+
+  $event_load_command = ['/bin/rm', shell_escape(join([$apache::mod_enable_dir, 'event_event.load'],'/'))]
+  $event_load_onlyif = ['/usr/bin/test', '-e', shell_escape(join([$apache::mod_enable_dir, 'event_event.load'],'/'))]
   exec { 'remove distribution event load file':
-    command => "/bin/rm ${apache::mod_enable_dir}/mpm_event.load",
-    onlyif  => "/usr/bin/test -e ${apache::mod_enable_dir}/mpm_event.load",
+    command => $event_load_command,
+    onlyif  => $event_load_onlyif,
     require => Package['httpd'],
     before  => Class['apache::service'],
   }
+
+  $event_conf_command = ['/bin/rm', shell_escape(join([$apache::mod_enable_dir, 'event_event.conf'],'/'))]
+  $event_conf_onlyif = ['/usr/bin/test', '-e', shell_escape(join([$apache::mod_enable_dir, 'event_event.conf'],'/'))]
   exec { 'remove distribution event conf file':
-    command => "/bin/rm ${apache::mod_enable_dir}/mpm_event.conf",
-    onlyif  => "/usr/bin/test -e ${apache::mod_enable_dir}/mpm_event.conf",
+    command => $event_conf_command,
+    onlyif  => $event_conf_onlyif,
     require => Package['httpd'],
     before  => Class['apache::service'],
   }

manifests/mpm/disable_mpm_prefork.pp

@@ -1,7 +1,10 @@
 # @summary disable Apache-Module prefork
 class apache::mpm::disable_mpm_prefork {
+  $prefork_command = ['/usr/sbin/a2dismod', 'prefork']
+  $prefork_onlyif = ['/usr/bin/test', '-e', shell_escape(join([$apache::mod_enable_dir, 'prefork.load'],'/'))]
   exec { '/usr/sbin/a2dismod prefork':
-    onlyif  => "/usr/bin/test -e ${apache::mod_enable_dir}/prefork.load",
+    command => $prefork_command,
+    onlyif  => $prefork_onlyif,
     require => Package['httpd'],
     before  => Class['apache::service'],
   }

manifests/mpm/disable_mpm_worker.pp

@@ -1,7 +1,10 @@
 # @summary disable Apache-Module worker
 class apache::mpm::disable_mpm_worker {
+  $worker_command = ['/usr/sbin/a2dismod', 'worker']
+  $worker_onlyif = ['/usr/bin/test', '-e', shell_escape(join([$apache::mod_enable_dir, 'worker.load'],'/'))]
   exec { '/usr/sbin/a2dismod worker':
-    onlyif  => "/usr/bin/test -e ${apache::mod_enable_dir}/worker.load",
+    command => $worker_command,
+    onlyif  => $worker_onlyif,
     require => Package['httpd'],
     before  => Class['apache::service'],
   }