From d4ad2c24df2477a5b4ced14a592d99547a0c029e Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Mar 12 2020 06:52:05 +0000 Subject: Tighten permissions on PKI proxy configuration As we need to store credentials for AJP protocol comminucation, ensure only root can read the configuration file. Related: https://pagure.io/freeipa/issue/8221 Signed-off-by: Alexander Bokovoy Reviewed-By: Christian Heimes Reviewed-By: Florence Blanc-Renaud Reviewed-By: Rob Crittenden (cherry picked from commit 593fac1ca9381a51ee59fac994d818ed9619bd8e) Reviewed-By: Florence Blanc-Renaud Reviewed-By: Christian Heimes Reviewed-By: Rob Crittenden --- diff --git a/freeipa.spec.in b/freeipa.spec.in index 6188b3e..862ed92 100644 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -1485,7 +1485,7 @@ fi %ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf %ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf %ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-kdc-proxy.conf -%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf +%ghost %attr(0640,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf %ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/kdcproxy/ipa-kdc-proxy.conf %ghost %attr(0644,root,root) %config(noreplace) %{_usr}/share/ipa/html/ca.crt %ghost %attr(0644,root,root) %{_usr}/share/ipa/html/krb.con diff --git a/ipaserver/install/dogtaginstance.py b/ipaserver/install/dogtaginstance.py index 7d32d36..a431b71 100644 --- a/ipaserver/install/dogtaginstance.py +++ b/ipaserver/install/dogtaginstance.py @@ -259,7 +259,7 @@ class DogtagInstance(service.Service): template = ipautil.template_file(template_filename, sub_dict) with open(paths.HTTPD_IPA_PKI_PROXY_CONF, "w") as fd: fd.write(template) - os.fchmod(fd.fileno(), 0o644) + os.fchmod(fd.fileno(), 0o640) def configure_certmonger_renewal_helpers(self): """