IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Ensure that public cert and CA bundle are readable

Browse Source 
In CIS hardened mode, the process umask is 027. This results in some
files not being world readable. Ensure that write_certificate_list()
calls in client installer, server installer, and upgrader create cert
bundles with permission bits 0644.

Fixes: https://pagure.io/freeipa/issue/7594
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Christian Heimes
2018-06-22 12:17:23 +02:00
committed by Tibor Dudlák
parent 0e21d93391
commit ba8cbb8c62
8 changed files with 21 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
ipaclient/install/client.py
View File

@@ -1879,7 +1879,7 @@ def get_ca_certs(fstore, options, server, basedn, realm):
if ca_certs is not None:
try:
x509.write_certificate_list(ca_certs, ca_file)
x509.write_certificate_list(ca_certs, ca_file, mode=0o644)
except Exception as e:
if os.path.exists(ca_file):
try:
@@ -2874,10 +2874,14 @@ def _install(options):
x509.write_certificate_list(
[c for c, n, t, u in ca_certs if t is not False],
paths.KDC_CA_BUNDLE_PEM)
paths.KDC_CA_BUNDLE_PEM,
mode=0o644
)
x509.write_certificate_list(
[c for c, n, t, u in ca_certs if t is not False],
paths.CA_BUNDLE_PEM)
paths.CA_BUNDLE_PEM,
mode=0o644
)
# Add the CA certificates to the IPA NSS database
logger.debug("Adding CA certificates to the IPA NSS database.")

4
ipaclient/install/ipa_certupdate.py
View File

@@ -186,10 +186,10 @@ def update_server(certs):
update_file(paths.CACERT_PEM, certs)
def update_file(filename, certs, mode=0o444):
def update_file(filename, certs, mode=0o644):
certs = (c[0] for c in certs if c[2] is not False)
try:
x509.write_certificate_list(certs, filename)
x509.write_certificate_list(certs, filename, mode=mode)
except Exception as e:
logger.error("failed to update %s: %s", filename, e)