krb5: make sure KDC certificate is readable

When requesting certificate for KDC profile, make sure its public part
is actually readable to others.

Fixes https://pagure.io/freeipa/issue/6973

Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>

install/restart_scripts/renew_kdc_cert

@@ -3,19 +3,15 @@
 # Copyright (C) 2017  FreeIPA Contributors see COPYING for license
 #
 
-import os
 import syslog
 import traceback
 
 from ipaplatform import services
-from ipaplatform.paths import paths
 from ipaserver.install import certs
 
 
 def main():
     with certs.renewal_lock:
-        os.chmod(paths.KDC_CERT, 0o644)
-
         try:
             if services.knownservices.krb5kdc.is_running():
                 syslog.syslog(syslog.LOG_NOTICE, 'restarting krb5kdc')

ipalib/install/certmonger.py

@@ -302,7 +302,7 @@ def add_subject(request_id, subject):
 def request_and_wait_for_cert(
         certpath, subject, principal, nickname=None, passwd_fname=None,
         dns=None, ca='IPA', profile=None,
-        pre_command=None, post_command=None, storage='NSSDB'):
+        pre_command=None, post_command=None, storage='NSSDB', perms=None):
     """
     Execute certmonger to request a server certificate.
 
@@ -310,7 +310,7 @@ def request_and_wait_for_cert(
     """
     reqId = request_cert(certpath, subject, principal, nickname,
                          passwd_fname, dns, ca, profile,
-                         pre_command, post_command, storage)
+                         pre_command, post_command, storage, perms)
     state = wait_for_request(reqId, api.env.startup_timeout)
     ca_error = get_request_value(reqId, 'ca-error')
     if state != 'MONITORING' or ca_error:
@@ -321,12 +321,14 @@ def request_and_wait_for_cert(
 def request_cert(
         certpath, subject, principal, nickname=None, passwd_fname=None,
         dns=None, ca='IPA', profile=None,
-        pre_command=None, post_command=None, storage='NSSDB'):
+        pre_command=None, post_command=None, storage='NSSDB', perms=None):
     """
     Execute certmonger to request a server certificate.
 
     ``dns``
         A sequence of DNS names to appear in SAN request extension.
+    ``perms``
+        A tuple of (cert, key) permissions in e.g., (0644,0660)
     """
     if storage == 'FILE':
         certfile, keyfile = certpath
@@ -367,6 +369,10 @@ def request_cert(
             post_command = certmonger_cmd_template % (post_command)
         request_parameters['cert-postsave-command'] = post_command
 
+    if perms:
+        request_parameters['key-perms'] = perms[0]
+        request_parameters['cert-perms'] = perms[1]
+
     result = cm.obj_if.add_request(request_parameters)
     try:
         if result[0]:

ipaserver/install/krbinstance.py

@@ -432,7 +432,8 @@ class KrbInstance(service.Service):
                 dns=self.fqdn,
                 storage='FILE',
                 profile=KDC_PROFILE,
-                post_command='renew_kdc_cert')
+                post_command='renew_kdc_cert',
+                perms=(0o644, 0o600))
         except dbus.DBusException as e:
             # if the certificate is already tracked, ignore the error
             name = e.get_dbus_name()