From: Guillaume Abrioux <gabrioux@redhat.com>
Date: Wed, 15 May 2019 12:38:46 +0000 (+0200)
Subject: dashboard: set less permissive permissions on dashboard certificate/key
X-Git-Tag: v4.0.0rc8~8
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=79ad697af74808198b1ea3a2d363830776c40265;p=ceph-ansible.git

dashboard: set less permissive permissions on dashboard certificate/key

use `0440` instead of `0644` is enough

Signed-off-by: Guillaume Abrioux <gabrioux@redhat.com>
(cherry picked from commit 14f381200d7341ff5c5ce19e8768da8e97f43fcd)
---

diff --git a/roles/ceph-dashboard/tasks/configure_dashboard.yml b/roles/ceph-dashboard/tasks/configure_dashboard.yml
index ba7e57049..d61edd6c8 100644
--- a/roles/ceph-dashboard/tasks/configure_dashboard.yml
+++ b/roles/ceph-dashboard/tasks/configure_dashboard.yml
@@ -20,7 +20,7 @@
     dest: "/etc/ceph/ceph-dashboard.crt"
     owner: root
     group: root
-    mode: 0644
+    mode: 0440
   when:
     - dashboard_crt
     - dashboard_protocol == "https"
@@ -31,7 +31,7 @@
     dest: "/etc/ceph/ceph-dashboard.key"
     owner: root
     group: root
-    mode: 0644
+    mode: 0440
   when:
     - dashboard_key
     - dashboard_protocol == "https"
diff --git a/roles/ceph-grafana/tasks/configure_grafana.yml b/roles/ceph-grafana/tasks/configure_grafana.yml
index 80522e42f..bbb5ab224 100644
--- a/roles/ceph-grafana/tasks/configure_grafana.yml
+++ b/roles/ceph-grafana/tasks/configure_grafana.yml
@@ -49,7 +49,7 @@
   copy:
     src: "{{ grafana_key }}"
     dest: "/etc/grafana/ceph-dashboard.key"
-    mode: 0640
+    mode: 0440
   when:
     - grafana_key
     - dashboard_protocol == "https"