Bug 905075

Summary:	certs downloaded via 'x509-create-cert' and 'x509-get-root-cert' commands are world-readable
Product:	Red Hat OpenStack	Reporter:	Yaniv Kaul <ykaul>
Component:	python-novaclient	Assignee:	Jakub Ruzicka <jruzicka>
Status:	CLOSED ERRATA	QA Contact:	Ami Jeain <ajeain>
Severity:	high	Docs Contact:
Priority:	medium
Version:	2.1	CC:	apevec, dallan, jkt, ndipanov, yeylon, zbitter
Target Milestone:	snapshot5	Keywords:	Triaged
Target Release:	2.1
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	python-novaclient-2.10.0-5.el6ost	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-04-04 17:59:39 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Yaniv Kaul 2013-01-28 14:18:33 UTC

Description of problem:
When downloading EC2 certs via the nova client, the files are stored with too much permissions:
[ykaul@ykaul-os-horizon tmp(keystone_ykaul)]$ nova x509-create-cert
Wrote private key to pk.pem
Wrote x509 certificate to cert.pem
[ykaul@ykaul-os-horizon tmp(keystone_ykaul)]$ nova x509-get-root-cert
Wrote x509 root cert to cacert.pem
[ykaul@ykaul-os-horizon tmp(keystone_ykaul)]$ ls -l *.pem
-rw-r--r--. 1 ykaul ykaul 1029 2013-01-28 16:11 cacert.pem
-rw-r--r--. 1 ykaul ykaul 2547 2013-01-28 16:11 cert.pem
-rw-r--r--. 1 ykaul ykaul  891 2013-01-28 16:11 pk.pem


Version-Release number of selected component (if applicable):
python-novaclient-2.10.0-1.el6ost.noarch

How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 2 Zane Bitter 2013-02-15 14:59:08 UTC

Upstream patch merged:
https://github.com/openstack/python-novaclient/commit/0b4590cb2438b4ec1fd8842d7ae3f2627059cabc

Comment 5 Ami Jeain 2013-03-19 13:24:11 UTC

verified in python-novaclient-2.10.0-7.el6ost.noarch

Comment 7 errata-xmlrpc 2013-04-04 17:59:39 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0706.html