|
 |
483b06 |
From 9e724963967a79fd171e79d2353ec7b655f13c47 Mon Sep 17 00:00:00 2001
|
|
|
483b06 |
From: Jan Cholasta <jcholast@redhat.com>
|
|
|
483b06 |
Date: Thu, 11 May 2017 07:00:42 +0000
|
|
|
483b06 |
Subject: [PATCH] certs: do not export keys world-readable in
|
|
|
483b06 |
install_key_from_p12
|
|
|
483b06 |
|
|
|
483b06 |
Make sure the exported private key files are readable only by the owner.
|
|
|
483b06 |
|
|
|
483b06 |
https://pagure.io/freeipa/issue/6831
|
|
|
483b06 |
|
|
|
483b06 |
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
|
|
|
483b06 |
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
|
|
|
483b06 |
---
|
|
|
483b06 |
ipaserver/install/certs.py | 3 ++-
|
|
|
483b06 |
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
483b06 |
|
|
|
483b06 |
diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py
|
|
|
483b06 |
index 17b9ebad4a128e292e453af44ca9d63cfb1e6ea2..06a7e2143964484fa45106ca381043eb440dc5b1 100644
|
|
|
483b06 |
--- a/ipaserver/install/certs.py
|
|
|
483b06 |
+++ b/ipaserver/install/certs.py
|
|
|
483b06 |
@@ -73,7 +73,8 @@ def install_key_from_p12(p12_fname, p12_passwd, pem_fname):
|
|
|
483b06 |
pwd = ipautil.write_tmp_file(p12_passwd)
|
|
|
483b06 |
ipautil.run([paths.OPENSSL, "pkcs12", "-nodes", "-nocerts",
|
|
|
483b06 |
"-in", p12_fname, "-out", pem_fname,
|
|
|
483b06 |
- "-passin", "file:" + pwd.name])
|
|
|
483b06 |
+ "-passin", "file:" + pwd.name],
|
|
|
483b06 |
+ umask=0o077)
|
|
|
483b06 |
|
|
|
483b06 |
|
|
|
483b06 |
def export_pem_p12(pkcs12_fname, pkcs12_pwd_fname, nickname, pem_fname):
|
|
|
483b06 |
--
|
|
|
483b06 |
2.9.4
|
|
|
483b06 |
|