New feature: mount a ramdisk on /var/run.

This helps protecting users privacy since /var/run/utmp cannot be deleted.

diff --git a/README b/README
index 32b8678a6d70575dae6b415fa47a858618b0ff10..68cf39b1b67296270eaff1b5a63e09df9cddae97 100644 (file)
--- a/README
+++ b/README
@@ -47,6 +47,18 @@ $disable_lastlog
 Default: lastlog is disabled.
 When set to a false, non-empty value, lastlog is not changed.
 
+$ramdisk_on_var_run
+-------------------
+
+Default: have the initscripts mount a ramdisk on /var/run.
+When set to a false, non-empty value, the mounting of a ramdisk on
+/var/run is disabled.
+
+Please note that the changes only take effect on reboot. When enabling
+this feature, you probably want to get rid of any file previously
+stored on the files (such as utmp) stored in the non-ramdisk
+underlying /var/run directory.
+
 Copyright
 =========
 

diff --git a/manifests/debian.pp b/manifests/debian.pp
index 02c2dad497f1714fb948bd44d4984e47de161e13..e68185b63f7f5f96b169259c5f8208cc1cfabe4a 100644 (file)
--- a/manifests/debian.pp
+++ b/manifests/debian.pp
@@ -30,4 +30,10 @@ class loginrecords::debian inherits loginrecords::base {
     class{'loginrecords::wtmp::enable': }
   }
 
+  if $loginrecords::ramdisk_on_var_run {
+    class{'loginrecords::ramrun::enable': }
+  } else {
+    class{'loginrecords::ramrun::disable': }
+  }
+
 }

diff --git a/manifests/init.pp b/manifests/init.pp
index 446819b4c83c80f0cba73f248a75e057951169c2..0bc7a22671a5dc65bab74d3519fae16382a242c6 100644 (file)
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -3,7 +3,8 @@ class loginrecords(
     $disable_faillog = true,
     $disable_lastlog = true,
     $protect_utmp = true,
-    $disable_wtmp = true
+    $disable_wtmp = true,
+    $ramdisk_on_var_run = true
 ){
     # Include main class
     case $kernel {

diff --git a/manifests/ramrun/disable.pp b/manifests/ramrun/disable.pp
new file mode 100644 (file)
index 0000000..304d234
--- /dev/null
+++ b/manifests/ramrun/disable.pp
@@ -0,0 +1,7 @@
+class loginrecords::ramrun::disable inherits loginrecords::ramrun::enable {
+
+  Augeas { "ramdisk-on-var-run":
+    changes => "set RAMRUN yes",
+  }
+
+}

diff --git a/manifests/ramrun/enable.pp b/manifests/ramrun/enable.pp
new file mode 100644 (file)
index 0000000..564ef06
--- /dev/null
+++ b/manifests/ramrun/enable.pp
@@ -0,0 +1,8 @@
+class loginrecords::ramrun::enable {
+
+  augeas { "ramdisk-on-var-run":
+    context => "/files/etc/default/rcS",
+    changes => "set RAMRUN yes",
+  }
+
+}