IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-08-14 06:54:55 -05:00
Code Issues Packages Projects Releases Wiki Activity

Ensure that public cert and CA bundle are readable

Browse Source 
In CIS hardened mode, the process umask is 027. This results in some
files not being world readable. Ensure that write_certificate_list()
calls in client installer, server installer, and upgrader create cert
bundles with permission bits 0644.

Fixes: https://pagure.io/freeipa/issue/7594
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Christian Heimes
2018-06-27 11:05:01 +02:00
committed by Tibor Dudlák
parent 0e21d93391
commit ba8cbb8c62
8 changed files with 21 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ipaserver/install/krbinstance.py
+1 -1
View File
@@ -505,7 +505,7 @@ class KrbInstance(service.Service):
self.api.env.realm,
False)
ca_certs = [c for c, _n, t, _u in ca_certs if t is not False]
x509.write_certificate_list(ca_certs, paths.CACERT_PEM)
x509.write_certificate_list(ca_certs, paths.CACERT_PEM, mode=0o644)
def issue_selfsigned_pkinit_certs(self):
self._call_certmonger(certmonger_ca="SelfSign")