Description of problem: Answer files are created world-readable by setup/upgrade/cleanup and contain passwords. Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: 1. engine-setup or engine-cleanup 2. 3. Actual results: A file is created in /var/lib/ovirt-engine/setup/answers world-readable and contains password(s) Expected results: Create these files root-readable only. Perhaps also provide an option to not save passwords there. Additional info:
We might consider also adding somewhere instructions about changing permissions for existing files. Not very relevant to RHEV (except for beta testers etc.), relevant for upstream 3.3.
(In reply to Yedidyah Bar David from comment #0) > Create these files root-readable only. Perhaps also provide an option to not > save passwords there. Using mask of 0600 should be sufficient, please avoid explicitly using root unless absolutely required, usually this is to interact with other packages. (In reply to Yedidyah Bar David from comment #1) > We might consider also adding somewhere instructions about changing > permissions for existing files. Not very relevant to RHEV (except for beta > testers etc.), relevant for upstream 3.3. just add plugin to fix permissions on /var/lib/ovirt-engine/setup/answers/* will be simpler, no?
Merged upstream on master, 3.3 and 3.3.1 branches.
ok, is24. # ls -l /var/lib/ovirt-engine/setup/answers/ /root/rhevm-answer -rw-------. 1 root root 1475 Nov 20 15:52 /root/rhevm-answer /var/lib/ovirt-engine/setup/answers/: total 12 -rw-------. 1 root root 1493 Nov 18 14:47 20131118144720-setup.conf -rw-------. 1 root root 1475 Nov 20 12:56 20131120125645-upgrade.conf -rw-------. 1 root root 1475 Nov 20 15:52 20131120155234-upgrade.conf
Closing - RHEV 3.3 Released