From eed91e3a0932cd02b3367f57e77893a84291766c Mon Sep 17 00:00:00 2001
From: Mark Reynolds <mreynolds@redhat.com>
Date: Jan 07 2020 20:30:58 +0000
Subject: [PATCH 1/2] Issue 50806 - healthcheck - make file perm check more robust


Description:  The previous permissions check was looking for an exact
              value/level, but it should be looking for the required
              minimum permission.

relates: https://pagure.io/389-ds-base/issue/50806

Reviewed by: ?

---

diff --git a/src/lib389/lib389/dseldif.py b/src/lib389/lib389/dseldif.py
index 75fc76a..f5a44c4 100644
--- a/src/lib389/lib389/dseldif.py
+++ b/src/lib389/lib389/dseldif.py
@@ -329,9 +329,9 @@ class FSChecks(object):
         self.dirsrv = dirsrv
         self._certdb = self.dirsrv.get_cert_dir()
         self.ds_files = [
-            ('/etc/resolv.conf', '644', DSPERMLE0001),
-            (self._certdb + "/pin.txt", '600', DSPERMLE0002),
-            (self._certdb + "/pwdfile.txt", '600', DSPERMLE0002),
+            ('/etc/resolv.conf', [6, 4, 4], DSPERMLE0001),
+            (self._certdb + "/pin.txt", [4, 0, 0], DSPERMLE0002),
+            (self._certdb + "/pwdfile.txt", [4, 0, 0], DSPERMLE0002),
         ]
         self._lint_functions = [self._lint_file_perms]
 
@@ -347,11 +347,15 @@ class FSChecks(object):
         # Check file permissions are correct
         for ds_file in self.ds_files:
             perms = str(oct(os.stat(ds_file[0])[ST_MODE])[-3:])
-            if perms != ds_file[1]:
-                report = copy.deepcopy(ds_file[2])
-                report['items'].append(ds_file[0])
-                report['detail'] = report['detail'].replace('FILE', ds_file[0])
-                report['detail'] = report['detail'].replace('PERMS', ds_file[1])
-                report['fix'] = report['fix'].replace('FILE', ds_file[0])
-                report['fix'] = report['fix'].replace('PERMS', ds_file[1])
-                yield report
+            bad = False
+            for i in range(0, 3):
+                if int(perms[i]) != ds_file[1][i] and not int(perms[i]) & ds_file[1][i]:
+                    # Bad permissions, report it...
+                    report = copy.deepcopy(ds_file[2])
+                    report['items'].append(ds_file[0])
+                    report['detail'] = report['detail'].replace('FILE', ds_file[0])
+                    report['detail'] = report['detail'].replace('PERMS', "".join(str(x) for x in ds_file[1]))
+                    report['fix'] = report['fix'].replace('FILE', ds_file[0])
+                    report['fix'] = report['fix'].replace('PERMS', "".join(str(x) for x in ds_file[1]))
+                    yield report
+                    break

From b974e80c0bf3a80641ed55f85d44946e42c04b10 Mon Sep 17 00:00:00 2001
From: Mark Reynolds <mreynolds@redhat.com>
Date: Jan 08 2020 16:30:32 +0000
Subject: [PATCH 2/2] apply mhonek's code change suggestion


---

diff --git a/src/lib389/lib389/dseldif.py b/src/lib389/lib389/dseldif.py
index f5a44c4..49b34a1 100644
--- a/src/lib389/lib389/dseldif.py
+++ b/src/lib389/lib389/dseldif.py
@@ -346,10 +346,9 @@ class FSChecks(object):
     def _lint_file_perms(self):
         # Check file permissions are correct
         for ds_file in self.ds_files:
-            perms = str(oct(os.stat(ds_file[0])[ST_MODE])[-3:])
-            bad = False
-            for i in range(0, 3):
-                if int(perms[i]) != ds_file[1][i] and not int(perms[i]) & ds_file[1][i]:
+            perms = list(map(int, str(oct(os.stat(ds_file[0])[ST_MODE])[-3:])))
+            for p, e in zip(perms, ds_file[1]):
+                if p != e and not p & e:
                     # Bad permissions, report it...
                     report = copy.deepcopy(ds_file[2])
                     report['items'].append(ds_file[0])