From e4084fc1608cd13e73ce201471ff518105f4b9f5 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Fri, 22 Jun 2018 12:17:23 +0200 Subject: [PATCH] Ensure that public cert and CA bundle are readable In CIS hardened mode, the process umask is 027. This results in some files not being world readable. Ensure that write_certificate_list() calls in client installer, server installer, and upgrader create cert bundles with permission bits 0644. Fixes: https://pagure.io/freeipa/issue/7594 Signed-off-by: Christian Heimes Reviewed-By: Tibor Dudlak Reviewed-By: Rob Crittenden Reviewed-By: Rob Crittenden --- ipaclient/install/client.py | 10 +++++++--- ipaclient/install/ipa_certupdate.py | 4 ++-- ipalib/x509.py | 5 ++++- ipaserver/install/cainstance.py | 2 +- ipaserver/install/httpinstance.py | 2 +- ipaserver/install/installutils.py | 6 +++++- ipaserver/install/krbinstance.py | 2 +- ipaserver/install/server/replicainstall.py | 2 +- 8 files changed, 22 insertions(+), 11 deletions(-) diff --git a/ipaclient/install/client.py b/ipaclient/install/client.py index 0fbe31b762561b3e2ee2f35a666a93de8857bced..a1c74b41f790917a302ab32f6be7a4d23a989708 100644 --- a/ipaclient/install/client.py +++ b/ipaclient/install/client.py @@ -1837,7 +1837,7 @@ def get_ca_certs(fstore, options, server, basedn, realm): if ca_certs is not None: try: - x509.write_certificate_list(ca_certs, ca_file) + x509.write_certificate_list(ca_certs, ca_file, mode=0o644) except Exception as e: if os.path.exists(ca_file): try: @@ -2775,10 +2775,14 @@ def _install(options): x509.write_certificate_list( [c for c, n, t, u in ca_certs if t is not False], - paths.KDC_CA_BUNDLE_PEM) + paths.KDC_CA_BUNDLE_PEM, + mode=0o644 + ) x509.write_certificate_list( [c for c, n, t, u in ca_certs if t is not False], - paths.CA_BUNDLE_PEM) + paths.CA_BUNDLE_PEM, + mode=0o644 + ) # Add the CA certificates to the IPA NSS database logger.debug("Adding CA certificates to the IPA NSS database.") diff --git a/ipaclient/install/ipa_certupdate.py b/ipaclient/install/ipa_certupdate.py index 875cd7000c09aee044c5141a889617c9195182b1..878af250428fbf122c048d612fefc17e4ea674ff 100644 --- a/ipaclient/install/ipa_certupdate.py +++ b/ipaclient/install/ipa_certupdate.py @@ -187,10 +187,10 @@ def update_server(certs): update_file(paths.CACERT_PEM, certs) -def update_file(filename, certs, mode=0o444): +def update_file(filename, certs, mode=0o644): certs = (c[0] for c in certs if c[2] is not False) try: - x509.write_certificate_list(certs, filename) + x509.write_certificate_list(certs, filename, mode=mode) except Exception as e: logger.error("failed to update %s: %s", filename, e) diff --git a/ipalib/x509.py b/ipalib/x509.py index 67a9af4c5d3456f8cdd6d966373be75d7036f1b7..cfacfa6fc784a4bc1559d68da0cc505874346e22 100644 --- a/ipalib/x509.py +++ b/ipalib/x509.py @@ -36,6 +36,7 @@ import datetime import ipaddress import ssl import base64 +import os import re from cryptography import x509 as crypto_x509 @@ -519,7 +520,7 @@ def write_certificate(cert, filename): raise errors.FileError(reason=str(e)) -def write_certificate_list(certs, filename): +def write_certificate_list(certs, filename, mode=None): """ Write a list of certificates to a file in PEM format. @@ -529,6 +530,8 @@ def write_certificate_list(certs, filename): try: with open(filename, 'wb') as f: + if mode is not None: + os.fchmod(f.fileno(), mode) for cert in certs: f.write(cert.public_bytes(Encoding.PEM)) except (IOError, OSError) as e: diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index ffcebd719a16ebc5a991b35507b96411ad31eb10..d6e467097808594756d947fa721b8cf10fe7d043 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -848,7 +848,7 @@ class CAInstance(DogtagInstance): for path in [paths.IPA_CA_CRT, paths.KDC_CA_BUNDLE_PEM, paths.CA_BUNDLE_PEM]: - x509.write_certificate_list(certlist, path) + x509.write_certificate_list(certlist, path, mode=0o644) def __request_ra_certificate(self): """ diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py index 3f83248dd89118aeecfbf458c5079dde8b2cb93d..05b88998353597aebc39b6dad5e1a688dca84f49 100644 --- a/ipaserver/install/httpinstance.py +++ b/ipaserver/install/httpinstance.py @@ -481,7 +481,7 @@ class HTTPInstance(service.Service): raise RuntimeError("HTTPD cert was issued by an unknown CA.") # at this time we can assume any CA cert will be valid since this is # only run during installation - x509.write_certificate_list(certlist, paths.CA_CRT) + x509.write_certificate_list(certlist, paths.CA_CRT, mode=0o644) def is_kdcproxy_configured(self): """Check if KDC proxy has already been configured in the past""" diff --git a/ipaserver/install/installutils.py b/ipaserver/install/installutils.py index 6614da69a0a046cdfa1b309f77972ead9de1279f..64beeffaebc4bcfe2b11dbf1109e54d7a9479d67 100644 --- a/ipaserver/install/installutils.py +++ b/ipaserver/install/installutils.py @@ -1314,7 +1314,11 @@ def load_external_cert(files, ca_subject): cert_file.flush() ca_file = tempfile.NamedTemporaryFile() - x509.write_certificate_list(ca_cert_chain[1:], ca_file.name) + x509.write_certificate_list( + ca_cert_chain[1:], + ca_file.name, + mode=0o644 + ) ca_file.flush() return cert_file, ca_file diff --git a/ipaserver/install/krbinstance.py b/ipaserver/install/krbinstance.py index 09cafb7b84623594fe88083f5b914cee0f050409..a3079bd6304a41116f9aa5e78b6c6c71d72d7aa6 100644 --- a/ipaserver/install/krbinstance.py +++ b/ipaserver/install/krbinstance.py @@ -495,7 +495,7 @@ class KrbInstance(service.Service): self.api.env.realm, False) ca_certs = [c for c, _n, t, _u in ca_certs if t is not False] - x509.write_certificate_list(ca_certs, paths.CACERT_PEM) + x509.write_certificate_list(ca_certs, paths.CACERT_PEM, mode=0o644) def issue_selfsigned_pkinit_certs(self): self._call_certmonger(certmonger_ca="SelfSign") diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py index 525a62c474c7429b7efee4853eb71e487e656bba..eb354f81ba6e4cbc3848f9c24338fb85cc7639ae 100644 --- a/ipaserver/install/server/replicainstall.py +++ b/ipaserver/install/server/replicainstall.py @@ -147,7 +147,7 @@ def install_ca_cert(ldap, base_dn, realm, cafile, destfile=paths.IPA_CA_CRT): pass else: certs = [c[0] for c in certs if c[2] is not False] - x509.write_certificate_list(certs, destfile) + x509.write_certificate_list(certs, destfile, mode=0o644) except Exception as e: raise ScriptError("error copying files: " + str(e)) return destfile -- 2.17.1