Bug 1458453

Summary:	IPA installation should chmod important files
Product:	Red Hat Enterprise Linux 7	Reporter:	David Pinkerton <dpinkert>
Component:	ipa	Assignee:	IPA Maintainers <ipa-maint>
Status:	CLOSED DUPLICATE	QA Contact:	ipa-qe <ipa-qe>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.3	CC:	pvoborni, rcritten, tscherf
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-07-28 15:38:24 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description David Pinkerton 2017-06-02 23:18:39 UTC

Description of problem:

When ipa is installed on a hardened SOE the ipa installation process does not verify the umask for /etc/pki/ca-trust/source/ipa.p11-kit.


Version-Release number of selected component (if applicable):
ipa-server-4.4.0

How reproducible:
100%


Steps to Reproduce:
1. Install a hardened version of RHEL7.3 (root's umask set to 077)
2. Create a replica 
3. Replication fails


Actual results:
Replica installs but synchronization fails.

Expected results:
Replica synchronization 

Additional info:

After installing the second replica:-
kinit admin - worked
ipa user-find - hangs



Once the error was detected, both servers were rebuilt with a 022 umask.
Synchronization worked.

Comment 2 Petr Vobornik 2017-06-09 16:37:33 UTC

probably a duplicate of bug 1427897 and bug 1448697 , see bug 1448697, comment 2

Comment 3 Petr Vobornik 2017-07-28 15:38:24 UTC


*** This bug has been marked as a duplicate of bug 1427897 ***