From 19bfd7c36d6d087f0cd7def5eb4d8850c395fb4b Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Fri, 22 Jun 2018 12:53:19 +0200 Subject: [PATCH] Fix permission of public files in upgrader Make CA bundles, certs, and cert directories world-accessible in upgrader. Fixes: https://pagure.io/freeipa/issue/7594 Signed-off-by: Christian Heimes Reviewed-By: Tibor Dudlak Reviewed-By: Rob Crittenden Reviewed-By: Rob Crittenden --- ipaserver/install/server/upgrade.py | 31 +++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py index 4e5096e598cd10e3bd98f91946b4d26377d0de6e..7faaacd5d2f0c39bcf744c288b283009ccb3ead5 100644 --- a/ipaserver/install/server/upgrade.py +++ b/ipaserver/install/server/upgrade.py @@ -4,12 +4,14 @@ from __future__ import print_function, absolute_import +import errno import logging import re import os import shutil import pwd import fileinput +import stat import sys import tempfile from contextlib import contextmanager @@ -1656,6 +1658,34 @@ def update_replica_config(db_suffix): logger.info("Updated entry %s", dn) +def fix_permissions(): + """Fix permission of public accessible files and directories + + In case IPA was installed with restricted umask, some public files and + directories may not be readable and accessible. + + See https://pagure.io/freeipa/issue/7594 + """ + candidates = [ + paths.HTTPD_ALIAS_DIR, + paths.CA_BUNDLE_PEM, + paths.KDC_CA_BUNDLE_PEM, + paths.IPA_CA_CRT, + paths.IPA_P11_KIT, + ] + for filename in candidates: + try: + s = os.stat(filename) + except OSError as e: + if e.errno != errno.ENOENT: + raise + continue + mode = 0o755 if stat.S_ISDIR(s.st_mode) else 0o644 + if mode != stat.S_IMODE(s.st_mode): + logger.debug("Fix permission of %s to %o", filename, mode) + os.chmod(filename, mode) + + def upgrade_configuration(): """ Execute configuration upgrade of the IPA services @@ -1677,6 +1707,7 @@ def upgrade_configuration(): ds.start(ds_serverid) check_certs() + fix_permissions() auto_redirect = find_autoredirect(fqdn) sub_dict = dict( -- 2.17.1