diff options
author | Silvio Rhatto <rhatto@riseup.net> | 2013-04-12 17:09:03 -0300 |
---|---|---|
committer | Silvio Rhatto <rhatto@riseup.net> | 2013-04-12 17:09:03 -0300 |
commit | fe1c86b8f938283e9dd8196a8b11a9648f4b49e6 (patch) | |
tree | c2d999eca03862a3e4af57e0885397adf6bbc6ec /manifests/subsystem/sysctl.pp | |
parent | ec5c750d12bdc7948bb3c04f0c72817718a0bf47 (diff) | |
download | puppet-nodo-fe1c86b8f938283e9dd8196a8b11a9648f4b49e6.tar.gz puppet-nodo-fe1c86b8f938283e9dd8196a8b11a9648f4b49e6.tar.bz2 |
Major refactor
Diffstat (limited to 'manifests/subsystem/sysctl.pp')
-rw-r--r-- | manifests/subsystem/sysctl.pp | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/manifests/subsystem/sysctl.pp b/manifests/subsystem/sysctl.pp new file mode 100644 index 0000000..1df0348 --- /dev/null +++ b/manifests/subsystem/sysctl.pp @@ -0,0 +1,55 @@ +class nodo::subsystem::sysctl { + # Root exploit fix, see http://wiki.debian.org/mmap_min_addr + # Maybe this can be remove in the future or included in a sysctl puppet module + file { "/etc/sysctl.d/mmap_min_addr.conf": + owner => "root", + group => "root", + mode => 0644, + ensure => present, + content => "vm.mmap_min_addr = 4096\n", + } + + # See http://www.linux-vserver.org/Frequently_Asked_Questions + file { "/etc/sysctl.d/net.ipv4.conf.all.promote_secondaries.conf": + owner => "root", + group => "root", + mode => 0644, + ensure => present, + content => "net.ipv4.conf.all.promote_secondaries = 1\n", + } + + exec { "/etc/init.d/procps restart": + subscribe => File["/etc/sysctl.d/mmap_min_addr.conf", "/etc/sysctl.d/net.ipv4.conf.all.promote_secondaries.conf"], + refreshonly => true, + } + + $printk_levels = '3 4 1 3' + + file { "/etc/sysctl.d/kernel.printk.conf": + owner => "root", + group => "root", + mode => 0644, + ensure => present, + content => "kernel.printk = ${printk_levels}\n", + } + + exec { "/bin/echo '${printk_levels}' > /proc/sys/kernel/printk": + subscribe => File["/etc/sysctl.d/kernel.printk.conf"], + refreshonly => true, + } +} + +class sysctl::appliance($kernel_panic = hiera('nodo::sysctl::appliance', '20')) { + file { "/etc/sysctl.d/kernel.panic.conf": + owner => "root", + group => "root", + mode => 0644, + ensure => present, + content => "kernel.panic = ${kernel_panic}\n", + } + + exec { "/bin/echo '${kernel_panic}' > /proc/sys/kernel/panic": + subscribe => File["/etc/sysctl.d/kernel.panic.conf"], + refreshonly => true, + } +} |