IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Fix permission of public files in upgrader

Browse Source 
Make CA bundles, certs, and cert directories world-accessible in
upgrader.

Fixes: https://pagure.io/freeipa/issue/7594
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Christian Heimes 2018-06-22 12:53:19 +02:00 committed by Tibor Dudlák
parent 89b2137dc2
commit c2eb0f1612
No known key found for this signature in database
GPG Key ID: 12B8BD343576CDF5
1 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
ipaserver/install/server/upgrade.py
View File

@ -4,12 +4,14 @@
from __future__ import print_function, absolute_import from __future__ import print_function, absolute_import
import errno
import logging import logging
import re import re
import os import os
import shutil import shutil
import pwd import pwd
import fileinput import fileinput
import stat
import sys import sys
import tempfile import tempfile
from contextlib import contextmanager from contextlib import contextmanager
@ -1700,6 +1702,34 @@ def migrate_to_authselect():
sysupgrade.set_upgrade_state('authcfg', 'migrated_to_authselect', True) sysupgrade.set_upgrade_state('authcfg', 'migrated_to_authselect', True)
def fix_permissions():
"""Fix permission of public accessible files and directories
In case IPA was installed with restricted umask, some public files and
directories may not be readable and accessible.
See https://pagure.io/freeipa/issue/7594
"""
candidates = [
os.path.dirname(paths.GSSAPI_SESSION_KEY),
paths.CA_BUNDLE_PEM,
paths.KDC_CA_BUNDLE_PEM,
paths.IPA_CA_CRT,
paths.IPA_P11_KIT,
]
for filename in candidates:
try:
s = os.stat(filename)
except OSError as e:
if e.errno != errno.ENOENT:
raise
continue
mode = 0o755 if stat.S_ISDIR(s.st_mode) else 0o644
if mode != stat.S_IMODE(s.st_mode):
logger.debug("Fix permission of %s to %o", filename, mode)
os.chmod(filename, mode)
def upgrade_configuration(): def upgrade_configuration():
""" """
Execute configuration upgrade of the IPA services Execute configuration upgrade of the IPA services
@ -1724,6 +1754,7 @@ def upgrade_configuration():
ntpd_cleanup(fqdn, fstore) ntpd_cleanup(fqdn, fstore)
check_certs() check_certs()
fix_permissions()
auto_redirect = find_autoredirect(fqdn) auto_redirect = find_autoredirect(fqdn)
sub_dict = dict( sub_dict = dict(