|
 |
2ff659 |
From 4a97145c3a76a4d9ebf52b3905410a0bd7bec856 Mon Sep 17 00:00:00 2001
|
|
|
2ff659 |
From: Rob Crittenden <rcritten@redhat.com>
|
|
|
2ff659 |
Date: Tue, 4 Aug 2020 15:09:56 -0400
|
|
|
2ff659 |
Subject: [PATCH] Set mode of /etc/ipa/ca.crt to 0644 in CA-less installations
|
|
|
2ff659 |
|
|
|
2ff659 |
It was previously being set to 0444 which triggered a warning
|
|
|
2ff659 |
in freeipa-healthcheck.
|
|
|
2ff659 |
|
|
|
2ff659 |
Even root needs DAC_OVERRIDE capability to write to a 0o444 file
|
|
|
2ff659 |
which may not be available in some environments.
|
|
|
2ff659 |
|
|
|
2ff659 |
https://pagure.io/freeipa/issue/8441
|
|
|
2ff659 |
|
|
|
2ff659 |
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
2ff659 |
---
|
|
|
2ff659 |
ipaserver/install/certs.py | 2 +-
|
|
|
2ff659 |
ipaserver/install/server/install.py | 5 ++---
|
|
|
2ff659 |
2 files changed, 3 insertions(+), 4 deletions(-)
|
|
|
2ff659 |
|
|
|
2ff659 |
diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py
|
|
|
2ff659 |
index 22ee79bd1..51d9f9221 100644
|
|
|
2ff659 |
--- a/ipaserver/install/certs.py
|
|
|
2ff659 |
+++ b/ipaserver/install/certs.py
|
|
|
2ff659 |
@@ -329,7 +329,7 @@ class CertDB:
|
|
|
2ff659 |
ipautil.backup_file(cacert_fname)
|
|
|
2ff659 |
root_nicknames = self.find_root_cert(nickname)[:-1]
|
|
|
2ff659 |
with open(cacert_fname, "w") as f:
|
|
|
2ff659 |
- os.fchmod(f.fileno(), stat.S_IRUSR | stat.S_IRGRP | stat.S_IROTH)
|
|
|
2ff659 |
+ os.fchmod(f.fileno(), 0o644)
|
|
|
2ff659 |
for root in root_nicknames:
|
|
|
2ff659 |
result = self.run_certutil(["-L", "-n", root, "-a"],
|
|
|
2ff659 |
capture_output=True)
|
|
|
2ff659 |
diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py
|
|
|
2ff659 |
index b53c58e2a..6a593602f 100644
|
|
|
2ff659 |
--- a/ipaserver/install/server/install.py
|
|
|
2ff659 |
+++ b/ipaserver/install/server/install.py
|
|
|
2ff659 |
@@ -891,9 +891,8 @@ def install(installer):
|
|
|
2ff659 |
|
|
|
2ff659 |
ca.install_step_0(False, None, options, custodia=custodia)
|
|
|
2ff659 |
else:
|
|
|
2ff659 |
- # Put the CA cert where other instances expect it
|
|
|
2ff659 |
- x509.write_certificate(http_ca_cert, paths.IPA_CA_CRT)
|
|
|
2ff659 |
- os.chmod(paths.IPA_CA_CRT, 0o444)
|
|
|
2ff659 |
+ # /etc/ipa/ca.crt is created as a side-effect of
|
|
|
2ff659 |
+ # dsinstance::enable_ssl() via export_ca_cert()
|
|
|
2ff659 |
|
|
|
2ff659 |
if not options.no_pkinit:
|
|
|
2ff659 |
x509.write_certificate(http_ca_cert, paths.KDC_CA_BUNDLE_PEM)
|
|
|
2ff659 |
--
|
|
|
2ff659 |
2.26.2
|
|
|
2ff659 |
|
|
|
2ff659 |
From da2079ce2cc841aec56da872131112eb24326f81 Mon Sep 17 00:00:00 2001
|
|
|
2ff659 |
From: Rob Crittenden <rcritten@redhat.com>
|
|
|
2ff659 |
Date: Tue, 4 Aug 2020 15:12:20 -0400
|
|
|
2ff659 |
Subject: [PATCH] ipatests: Check permissions of /etc/ipa/ca.crt new
|
|
|
2ff659 |
installations
|
|
|
2ff659 |
|
|
|
2ff659 |
It should be 0644 root:root for both CA-ful and CA-less installs.
|
|
|
2ff659 |
|
|
|
2ff659 |
https://pagure.io/freeipa/issue/8441
|
|
|
2ff659 |
|
|
|
2ff659 |
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
2ff659 |
---
|
|
|
2ff659 |
ipatests/test_integration/test_caless.py | 8 ++++++++
|
|
|
2ff659 |
ipatests/test_integration/test_installation.py | 10 ++++++++++
|
|
|
2ff659 |
2 files changed, 18 insertions(+)
|
|
|
2ff659 |
|
|
|
2ff659 |
diff --git a/ipatests/test_integration/test_caless.py b/ipatests/test_integration/test_caless.py
|
|
|
2ff659 |
index 1ea7d9896..16dfbb320 100644
|
|
|
2ff659 |
--- a/ipatests/test_integration/test_caless.py
|
|
|
2ff659 |
+++ b/ipatests/test_integration/test_caless.py
|
|
|
2ff659 |
@@ -394,6 +394,14 @@ class CALessBase(IntegrationTest):
|
|
|
2ff659 |
host, cert_from_ldap.public_bytes(x509.Encoding.PEM))
|
|
|
2ff659 |
assert cert_from_ldap == expected_cacrt
|
|
|
2ff659 |
|
|
|
2ff659 |
+ result = host.run_command(
|
|
|
2ff659 |
+ ["/usr/bin/stat", "-c", "%U:%G:%a", paths.IPA_CA_CRT]
|
|
|
2ff659 |
+ )
|
|
|
2ff659 |
+ (owner, group, mode) = result.stdout_text.strip().split(':')
|
|
|
2ff659 |
+ assert owner == "root"
|
|
|
2ff659 |
+ assert group == "root"
|
|
|
2ff659 |
+ assert mode == "644"
|
|
|
2ff659 |
+
|
|
|
2ff659 |
# Verify certmonger was not started
|
|
|
2ff659 |
result = host.run_command(['getcert', 'list'], raiseonerr=False)
|
|
|
2ff659 |
assert result.returncode == 0
|
|
|
2ff659 |
diff --git a/ipatests/test_integration/test_installation.py b/ipatests/test_integration/test_installation.py
|
|
|
2ff659 |
index 100a5a766..fb1990083 100644
|
|
|
2ff659 |
--- a/ipatests/test_integration/test_installation.py
|
|
|
2ff659 |
+++ b/ipatests/test_integration/test_installation.py
|
|
|
2ff659 |
@@ -346,6 +346,16 @@ class TestInstallCA(IntegrationTest):
|
|
|
2ff659 |
status = tasks.wait_for_request(self.master, request_id[0], 300)
|
|
|
2ff659 |
assert status == "MONITORING"
|
|
|
2ff659 |
|
|
|
2ff659 |
+ def test_ipa_ca_crt_permissions(self):
|
|
|
2ff659 |
+ """Verify that /etc/ipa/ca.cert is mode 0644 root:root"""
|
|
|
2ff659 |
+ result = self.master.run_command(
|
|
|
2ff659 |
+ ["/usr/bin/stat", "-c", "%U:%G:%a", paths.IPA_CA_CRT]
|
|
|
2ff659 |
+ )
|
|
|
2ff659 |
+ out = str(result.stdout_text.strip())
|
|
|
2ff659 |
+ (owner, group, mode) = out.split(':')
|
|
|
2ff659 |
+ assert mode == "644"
|
|
|
2ff659 |
+ assert owner == "root"
|
|
|
2ff659 |
+ assert group == "root"
|
|
|
2ff659 |
|
|
|
2ff659 |
class TestInstallWithCA_KRA1(InstallTestBase1):
|
|
|
2ff659 |
|
|
|
2ff659 |
--
|
|
|
2ff659 |
2.26.2
|
|
|
2ff659 |
|