Bug 1374700

Summary: Suspicious permissions for configs and data
Product: [Fedora] Fedora Reporter: Honza Horak <hhorak>
Component: redisAssignee: Flavio Percoco <fpercoco>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 26CC: fabian.deutsch, fedora, fpercoco, i, jal233, nathans, rcollet
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1374713 1374717 (view as bug list) Environment:
Last Closed: 2017-07-21 05:30:00 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1374713, 1374717, 1390588    

Description Honza Horak 2016-09-09 13:01:25 UTC 
Description of problem:
Config and datadir of redis have suspiciously weak permissions. It seems an attacker would be able to read data content easily and also password is often stored in plaintext in /etc/redis.conf.

Version-Release number of selected component (if applicable):
redis-3.0.6-3.fc24.x86_64

How reproducible:
every-time

Steps to Reproduce:
1. ls -l /etc/redis*
2. ls -ld /var/lib/redis*

Actual results:
-rw-r--r--. 1 redis root 41599 Feb  8  2016 /etc/redis.conf
-rw-r--r--. 1 redis root  7355 Feb  8  2016 /etc/redis-sentinel.conf
drwxr-xr-x. 2 redis redis 4096 Sep  9 14:29 /var/lib/redis

Expected results:
-rw-r-----. 1 redis root 41599 Feb  8  2016 /etc/redis.conf
-rw-r-----. 1 redis root  7355 Feb  8  2016 /etc/redis-sentinel.conf
drwx------. 2 redis redis 4096 Sep  9 14:29 /var/lib/redis
Comment 1 Remi Collet 2016-09-09 13:24:34 UTC 
Probably same things for /var/log/redis
Comment 2 Remi Collet 2016-09-13 06:01:11 UTC 
See http://pkgs.fedoraproject.org/cgit/rpms/redis.git?h=private-cleanup
Comment 3 Fedora End Of Life 2017-02-28 10:14:09 UTC 
This bug appears to have been reported against 'rawhide' during the Fedora 26 development cycle.
Changing version to '26'.
Comment 4 Nathan Scott 2017-07-21 05:30:00 UTC 
This was resolved in the redis-3.2.3-2 build; marking as done.