Fix IPA install for secure umask

Make sure that IPA can be installed with root umask set to secure
value 077. ipa-server-install was failing in DS configuration phase
when dirsrv tried to read boot.ldif created during installation.

https://fedorahosted.org/freeipa/ticket/1282

install/tools/ipa-replica-install

@@ -443,6 +443,8 @@ def main():
 
     # Create the management framework config file
     # Note: We must do this before bootstraping and finalizing ipalib.api
+    old_umask = os.umask(022)   # must be readable for httpd
+    try:
         fd = open("/etc/ipa/default.conf", "w")
         fd.write("[global]\n")
         fd.write("basedn=" + util.realm_to_suffix(config.realm_name) + "\n")
@@ -455,6 +457,8 @@ def main():
             fd.write("ra_plugin=dogtag\n")
         fd.write("mode=production\n")
         fd.close()
+    finally:
+        os.umask(old_umask)
 
     api.bootstrap(in_server=True)
     api.finalize()

install/tools/ipa-server-install

@@ -676,6 +676,8 @@ def main():
     logging.debug("will use dns_forwarders: %s\n" % str(dns_forwarders))
 
     # Create the management framework config file and finalize api
+    old_umask = os.umask(022)   # must be readable for httpd
+    try:
         fd = open("/etc/ipa/default.conf", "w")
         fd.write("[global]\n")
         fd.write("basedn=" + util.realm_to_suffix(realm_name) + "\n")
@@ -688,6 +690,8 @@ def main():
             fd.write("ra_plugin=dogtag\n")
         fd.write("mode=production\n")
         fd.close()
+    finally:
+        os.umask(old_umask)
 
     api.bootstrap(**cfg)
     api.finalize()

install/tools/ipa-upgradeconfig

@@ -114,7 +114,11 @@ def check_certs():
     if not os.path.exists("/usr/share/ipa/html/ca.crt"):
         ca_file = "/etc/httpd/alias/cacert.asc"
         if os.path.exists(ca_file):
+            old_umask = os.umask(022)   # make sure its readable by httpd
+            try:
                 shutil.copyfile(ca_file, "/usr/share/ipa/html/ca.crt")
+            finally:
+                os.umask(old_umask)
         else:
             print "Missing Certification Authority file."
             print "You should place a copy of the CA certificate in /usr/share/ipa/html/ca.crt"

ipaserver/install/dsinstance.py

@@ -358,10 +358,13 @@ class DsInstance(service.Service):
         self.sub_dict['BASEDC'] = self.realm_name.split('.')[0].lower()
         base_txt = ipautil.template_str(BASE_TEMPLATE, self.sub_dict)
         logging.debug(base_txt)
-        base_fd = file("/var/lib/dirsrv/boot.ldif", "w")
+        old_umask = os.umask(022)   # must be readable for dirsrv
+        try:
+            base_fd = open("/var/lib/dirsrv/boot.ldif", "w")
             base_fd.write(base_txt)
-        base_fd.flush()
             base_fd.close()
+        finally:
+            os.umask(old_umask)
 
         inf_txt = ipautil.template_str(INF_TEMPLATE, self.sub_dict)
         logging.debug("writing inf template")
@@ -394,21 +397,25 @@ class DsInstance(service.Service):
         os.remove("/var/lib/dirsrv/boot.ldif")
 
     def __add_default_schemas(self):
-        shutil.copyfile(ipautil.SHARE_DIR + "60kerberos.ldif",
-                        schema_dirname(self.serverid) + "60kerberos.ldif")
-        shutil.copyfile(ipautil.SHARE_DIR + "60samba.ldif",
-                        schema_dirname(self.serverid) + "60samba.ldif")
-        shutil.copyfile(ipautil.SHARE_DIR + "60ipaconfig.ldif",
-                        schema_dirname(self.serverid) + "60ipaconfig.ldif")
-        shutil.copyfile(ipautil.SHARE_DIR + "60basev2.ldif",
-                        schema_dirname(self.serverid) + "60basev2.ldif")
-        shutil.copyfile(ipautil.SHARE_DIR + "60ipasudo.ldif",
-                        schema_dirname(self.serverid) + "60ipasudo.ldif")
+        pent = pwd.getpwnam(DS_USER)
+        for schema_fname in ("60kerberos.ldif",
+                             "60samba.ldif",
+                             "60ipaconfig.ldif",
+                             "60basev2.ldif",
+                             "60ipasudo.ldif"):
+            target_fname = schema_dirname(self.serverid) + schema_fname
+            shutil.copyfile(ipautil.SHARE_DIR + schema_fname, target_fname)
+            os.chmod(target_fname, 0440)    # read access for dirsrv user/group
+            os.chown(target_fname, pent.pw_uid, pent.pw_gid)
+
         try:
             shutil.move(schema_dirname(self.serverid) + "05rfc2247.ldif",
                             schema_dirname(self.serverid) + "05rfc2247.ldif.old")
-            shutil.copyfile(ipautil.SHARE_DIR + "05rfc2247.ldif",
-                            schema_dirname(self.serverid) + "05rfc2247.ldif")
+
+            target_fname = schema_dirname(self.serverid) + "05rfc2247.ldif"
+            shutil.copyfile(ipautil.SHARE_DIR + "05rfc2247.ldif", target_fname)
+            os.chmod(target_fname, 0440)
+            os.chown(target_fname, pent.pw_uid, pent.pw_gid)
         except IOError:
             # Does not apply with newer DS releases
             pass