|
 |
89cb6d |
From e6627a5d7818684bad09ad952aa0415a929b231a Mon Sep 17 00:00:00 2001
|
|
|
89cb6d |
From: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
89cb6d |
Date: Mon, 3 Aug 2020 18:53:47 +0200
|
|
|
89cb6d |
Subject: [PATCH] ipatests: check KDC cert permissions in CA less install
|
|
|
89cb6d |
|
|
|
89cb6d |
The KDC certificate file must be stored with 644 permissions.
|
|
|
89cb6d |
Add a test checking the file permissions on server + replica.
|
|
|
89cb6d |
|
|
|
89cb6d |
Related: https://pagure.io/freeipa/issue/8440
|
|
|
89cb6d |
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
|
|
|
89cb6d |
---
|
|
|
89cb6d |
ipatests/test_integration/test_caless.py | 9 +++++++++
|
|
|
89cb6d |
1 file changed, 9 insertions(+)
|
|
|
89cb6d |
|
|
|
89cb6d |
diff --git a/ipatests/test_integration/test_caless.py b/ipatests/test_integration/test_caless.py
|
|
|
89cb6d |
index 529611b183e14f7b23910987bb15ee21492d6f27..fc38b807d357c995b2d6fc04c5612109d38b5f1e 100644
|
|
|
89cb6d |
--- a/ipatests/test_integration/test_caless.py
|
|
|
89cb6d |
+++ b/ipatests/test_integration/test_caless.py
|
|
|
89cb6d |
@@ -1564,6 +1564,13 @@ class TestCertInstall(CALessBase):
|
|
|
89cb6d |
assert result.returncode == 0
|
|
|
89cb6d |
|
|
|
89cb6d |
|
|
|
89cb6d |
+def verify_kdc_cert_perms(host):
|
|
|
89cb6d |
+ """Verify that the KDC cert pem file has 0644 perms"""
|
|
|
89cb6d |
+ cmd = host.run_command(['stat', '-c',
|
|
|
89cb6d |
+ '"%a %G:%U"', paths.KDC_CERT])
|
|
|
89cb6d |
+ assert "644 root:root" in cmd.stdout_text
|
|
|
89cb6d |
+
|
|
|
89cb6d |
+
|
|
|
89cb6d |
class TestPKINIT(CALessBase):
|
|
|
89cb6d |
"""Install master and replica with PKINIT"""
|
|
|
89cb6d |
num_replicas = 1
|
|
|
89cb6d |
@@ -1577,6 +1584,7 @@ class TestPKINIT(CALessBase):
|
|
|
89cb6d |
result = cls.install_server(pkinit_pkcs12_exists=True,
|
|
|
89cb6d |
pkinit_pin=_DEFAULT)
|
|
|
89cb6d |
assert result.returncode == 0
|
|
|
89cb6d |
+ verify_kdc_cert_perms(cls.master)
|
|
|
89cb6d |
|
|
|
89cb6d |
@replica_install_teardown
|
|
|
89cb6d |
def test_server_replica_install_pkinit(self):
|
|
|
89cb6d |
@@ -1586,6 +1594,7 @@ class TestPKINIT(CALessBase):
|
|
|
89cb6d |
pkinit_pin=_DEFAULT)
|
|
|
89cb6d |
assert result.returncode == 0
|
|
|
89cb6d |
self.verify_installation()
|
|
|
89cb6d |
+ verify_kdc_cert_perms(self.replicas[0])
|
|
|
89cb6d |
|
|
|
89cb6d |
|
|
|
89cb6d |
class TestServerReplicaCALessToCAFull(CALessBase):
|
|
|
89cb6d |
--
|
|
|
89cb6d |
2.26.2
|
|
|
89cb6d |
|