Bug 444602

Summary: permission problems on mod_nss database in Fedora 9
Product: [Retired] freeIPA Reporter: Rob Crittenden <rcritten>
Component: ipa-serverAssignee: Rob Crittenden <rcritten>
Status: CLOSED ERRATA QA Contact: Chandrasekar Kannan <ckannan>
Severity: high Docs Contact:
Priority: high    
Version: 1.0CC: benl, jgalipea
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: freeipa-2.0.0-1.fc15 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-03-27 07:13:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 453489    
Attachments:
Description Flags
set permissions on mod_nss database none

Description Rob Crittenden 2008-04-29 14:37:35 UTC 
The version of NSS in Fedora 9 required changes to mod_nss to do the
NSS_Initialize() in the children. This means that the apache user needs to be
able to read the database.

The solution was to set the database mode to 640 root:apache.

IPA creates its own database and sets the mode to 600 root:root

The installer needs to accommodate this change.
Comment 1 Rob Crittenden 2008-04-29 14:38:16 UTC 
Created attachment 304123 [details]
set permissions on mod_nss database
Comment 2 Rob Crittenden 2008-04-30 13:45:23 UTC 
ipa-1-0: 3bbad0704d747b64ba69e0076f21e1aaba80963e
master: 274eb708c28abf25087c3656ec93370c2000efd3
Comment 4 Jenny Severance 2008-11-21 19:27:16 UTC 
I am verifying this bug...

Assuming the correct location for the files is:
[root@jennyv3 alias]# pwd
/etc/httpd/alias

It appears this bug is fixed.
[root@jennyv3 alias]# ls -al
total 272
drwxr-xr-x 2 root root    4096 Nov 17 05:19 .
drwxr-xr-x 5 root root    4096 Nov 17 05:15 ..
-rw-r----- 1 root apache 65536 Nov 17 05:19 cert8.db
-rw------- 1 root root   65536 Nov 17 05:15 cert8.db.orig
-rw------- 1 root root    4395 Nov 17 05:15 install.log
-rw-r----- 1 root apache 16384 Nov 17 05:19 key3.db
-rw------- 1 root root   16384 Nov 17 05:15 key3.db.orig
lrwxrwxrwx 1 root root      30 Nov 17 05:15 libnssckbi.so -> ../../../usr/lib/libnssckbi.so
-r-------- 1 root root      40 Nov 17 05:19 noise.txt
-rw------- 1 root root       1 Nov 17 05:19 pwdfile.txt
-rw-r----- 1 root apache 16384 Nov 17 05:19 secmod.db
-rw------- 1 root root   16384 Nov 17 05:15 secmod.db.orig

Can someone please confirm?

Thanks
Jenny
Comment 5 Chandrasekar Kannan 2008-11-21 19:33:12 UTC 
yes. looks good to me.
Comment 6 Jenny Severance 2008-11-21 19:42:15 UTC 
Done .. Fix verified.