From c3ee037c2dd92ccb277523919e991471c9caa3c6 Mon Sep 17 00:00:00 2001
From: Stanislav Laznicka <slaznick@redhat.com>
Date: Tue, 11 Apr 2017 10:21:15 +0200
Subject: [PATCH] Fix CA-less to CA-full upgrade

CertDB would have always created a directory on initialization. This
behavior changes here by replacing the truncate argument with create
which will only create the database when really required.

https://pagure.io/freeipa/issue/6853

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
---
 ipaserver/install/ca.py           |  2 ++
 ipaserver/install/certs.py        | 38 ++++++++++++++++++++++++++++----------
 ipaserver/install/httpinstance.py |  2 +-
 3 files changed, 31 insertions(+), 11 deletions(-)

diff --git a/ipaserver/install/ca.py b/ipaserver/install/ca.py
index db3b744a51b0ae2ba12f79c155a1bb0698d94bec..8ee0fda23411563c70b7db5f39f43c2869c108b5 100644
--- a/ipaserver/install/ca.py
+++ b/ipaserver/install/ca.py
@@ -183,6 +183,8 @@ def install_check(standalone, replica_config, options):
             realm_name, nssdir=dirname, subject_base=options._subject_base)
 
         for db in (cadb, dsdb):
+            if not db.exists():
+                continue
             for nickname, _trust_flags in db.list_certs():
                 if nickname == certdb.get_ca_nickname(realm_name):
                     raise ScriptError(
diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py
index 16139f81f0d0bd6889a9f38948204bb5bc018028..89e57134f24c505d669057eefffb7862b3b8179a 100644
--- a/ipaserver/install/certs.py
+++ b/ipaserver/install/certs.py
@@ -99,7 +99,7 @@ class CertDB(object):
     # TODO: Remove all selfsign code
     def __init__(self, realm, nssdir, fstore=None,
                  host_name=None, subject_base=None, ca_subject=None,
-                 user=None, group=None, mode=None, truncate=False):
+                 user=None, group=None, mode=None, create=False):
         self.nssdb = NSSDatabase(nssdir)
 
         self.secdir = nssdir
@@ -132,15 +132,16 @@ class CertDB(object):
         self.uid = 0
         self.gid = 0
 
-        if not truncate and os.path.exists(self.secdir):
-            # We are going to set the owner of all of the cert
-            # files to the owner of the containing directory
-            # instead of that of the process. This works when
-            # this is called by root for a daemon that runs as
-            # a normal user
-            mode = os.stat(self.secdir)
-            self.uid = mode[stat.ST_UID]
-            self.gid = mode[stat.ST_GID]
+        if not create:
+            if os.path.isdir(self.secdir):
+                # We are going to set the owner of all of the cert
+                # files to the owner of the containing directory
+                # instead of that of the process. This works when
+                # this is called by root for a daemon that runs as
+                # a normal user
+                mode = os.stat(self.secdir)
+                self.uid = mode[stat.ST_UID]
+                self.gid = mode[stat.ST_GID]
         else:
             if user is not None:
                 pu = pwd.getpwnam(user)
@@ -162,6 +163,23 @@ class CertDB(object):
     def passwd_fname(self):
         return self.nssdb.pwd_file
 
+    def exists(self):
+        """
+        Checks whether all NSS database files + our pwd_file exist
+        """
+        db_files = (
+            self.secdir,
+            self.certdb_fname,
+            self.keydb_fname,
+            self.secmod_fname,
+            self.nssdb.pwd_file,
+        )
+
+        for f in db_files:
+            if not os.path.exists(f):
+                return False
+        return True
+
     def __del__(self):
         if self.reqdir is not None:
             shutil.rmtree(self.reqdir, ignore_errors=True)
diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py
index 8e444be2d23ec5e7890d221508bc866de2854c89..aeb5c5e450813469e1b6cd374b30cd4aab338537 100644
--- a/ipaserver/install/httpinstance.py
+++ b/ipaserver/install/httpinstance.py
@@ -366,7 +366,7 @@ class HTTPInstance(service.Service):
         db = certs.CertDB(self.realm, nssdir=paths.HTTPD_ALIAS_DIR,
                           subject_base=self.subject_base, user="root",
                           group=constants.HTTPD_GROUP,
-                          truncate=True)
+                          create=True)
         self.disable_system_trust()
         self.create_password_conf()
         if self.pkcs12_info:
-- 
2.12.2