ipa-server-install: fix ca setup when fs.protected_regular=1

/tmp is a sticky directory. When the OS is configured with
fs.protected_regular=1, this means that O_CREATE open is forbidden
for files in /tmp if the calling user is not owner of the file,
except if the file is owned by the owner of the directory.

The installer (executed as root) currently creates a file in /tmp,
then modifies its owner to pkiuser and finally writes the pki config
in the file. With fs.protected_regular=1, the write is denied because
root is not owner of the file at this point.
The fix performs the ownership change after the file has been written.

Fedora bug: https://bugzilla.redhat.com/show_bug.cgi?id=1677027

Fixes: https://pagure.io/freeipa/issue/7866
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>

ipaserver/install/cainstance.py

@@ -483,7 +483,6 @@ class CAInstance(DogtagInstance):
         (cfg_fd, cfg_file) = tempfile.mkstemp()
         os.close(cfg_fd)
         pent = pwd.getpwnam(self.service_user)
-        os.chown(cfg_file, pent.pw_uid, pent.pw_gid)
 
         # Create CA configuration
         config = RawConfigParser()
@@ -647,6 +646,9 @@ class CAInstance(DogtagInstance):
         with open(cfg_file, "w") as f:
             config.write(f)
 
+        # Finally chown the config file (rhbz#1677027)
+        os.chown(cfg_file, pent.pw_uid, pent.pw_gid)
+
         self.backup_state('installed', True)
         try:
             DogtagInstance.spawn_instance(