Description of problem:

Some organizations are setting the umask to 0027 due to security baselines
according to regulations or company internal rules


Version-Release number of selected component (if applicable):
4.4


How reproducible:
Always


Steps to Reproduce:
1. ipa-backup --online --data
2. ipa-restore --online --data /back/up/dir
3. IPA server crippled

Actual results:
/var/lib/dirsrv/slapd-EXAMPLE-COM/ldif/EXAMPLE-COM-ipaca.ldif
/var/lib/dirsrv/slapd-EXAMPLE-COM/ldif/EXAMPLE-COM-userRoot.ldif

and probably others do not provide access rights for the dirsrv user, in this
case 0600


Expected results:
ipa-restore should manually set 0644 for those files to avoid the directory
server not starting anymore


Additional info:

Mitigation:

Set the umask to 0022 (at least temporary)
systemctl start dirsrv@EXAMPLE-COM (if nor running anymore)
re-run ipa-restore --online --data /back/up/dir