Bug 1630361

This bug is created as a clone of upstream ticket:
https://pagure.io/freeipa/issue/7594

### Issue
CIS hardened images with FIPS 140-2 enabled do not allow Fresh install of FreeIPA 4.5 to work.

#### Steps to Reproduce

This is less about steps to reproduce, and more about what I needed to do to make freeIPA work on a FIPS 140-2 and CIS-1 2.2.0 level harden

The default umask for the following files is too restrictive and causes kinit -n to fail

~~~~
[root@example ]# kinit -n
Password for WELLKNOWN/ANONYMOUS.COM:
~~~~

Kinit was asking for a password instead of trusing the certs

These files in a CIS image are root:root 600, they need to be root:root 644
~~~~
/var/lib/ipa-client/pki/ca-bundle.pem
/etc/pki/ca-trust/source/ipa.p11-kit
~~~~
Once the permissions are fixed, you can kinit -n 

The web server fails to allow you to log in because the permissions are too restrictive on /etc/httpd/alias, the permissions shuold be 755 but CIS changes them to 600

Checking the error logs, the only detail that was returned was this

~~~~
ipa: INFO: 401 Unauthorized: [Errno 13] Permission denied
~~~~

I straced all the apache pids to determine the real error
~~~~
ps auxw | grep -E 'sbin/(apache|httpd)' | awk '{print"-p " $2}' | xargs strace -e trace=write -F -s 100000000
~~~~
When entering the username/password the following segfault is returned.
~~~~
[pid 23361] write(2, "[Thu Jun 21 18:00:54.930103 2018] [:error] [pid 23361] Unable to change directory to /etc/httpd/alias\n", 102) = 102
[pid 23361] write(2, "[Thu Jun 21 18:00:54.930307 2018] [:error] [pid 23361] Does the directory exist and do the permissions allow access?\n", 117) = 117
[pid 23361] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x28} ---
~~~~
Once the permissions were solved on  /etc/httpd/alias there were still issues, the ipaapi proxy was still returning problems.  

The httpd logs still said 
~~~~
ipa: INFO: 401 Unauthorized: [Errno 13] Permission denied
~~~~
but there were no more segfaults or problems, i traced the ipaapi process 

~~~~
ps auxw | grep -E 'ipaapi' | awk '{print"-p " $2}' | xargs strace -e trace=open -F -s 100000000
~~~~

after tracing the ipaapi proxy i found that /etc/ipa/ca.crt were also too restrictive (600), they shuold be 644

~~~~
[pid 25624] open("/etc/ipa/ca.crt", O_RDONLY) = -1 EACCES (Permission denied)
~~~~
After changing the permissions to 644 everything works.

In summary the following changes needed to be made to make FreeIPA work on a CIS hardened machine.
~~~~
chmod 644 /var/lib/ipa-client/pki/ca-bundle.pem
chmod 644 /etc/pki/ca-trust/source/ipa.p11-kit
chmod 755 /etc/httpd/alias/
chmod 644 /etc/ipa/ca.crt
~~~~
#### Actual behavior
kinit -n does not work, and unable to log into the web UI

#### Expected behavior
FreeIPA works with CIS restrictive umask settings

#### Version/Release/Distribution
   $ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.5.4-10.el7.centos.1.x86_64
ipa-client-4.5.4-10.el7.centos.1.x86_64
389-ds-base-1.3.7.5-21.el7_5.x86_64
pki-ca-10.5.1-9.el7.noarch
krb5-server-1.15.1-19.el7.x86_64


#### Additional info:
Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

~~~~

logs available in pagure ticket