Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1058810

Summary: [engine-image-uploader] /etc/ovirt-engine/imageuploader.conf is world readable (can contain password!)
Product: [Retired] oVirt Reporter: Jiri Belka <jbelka>
Component: ovirt-image-uploaderAssignee: Sandro Bonazzola <sbonazzo>
Status: CLOSED CURRENTRELEASE QA Contact: Martin Pavlik <mpavlik>
Severity: medium Docs Contact:
Priority: medium    
Version: 3.4CC: acathrow, gklein, iheim, myakove, pstehlik, sbonazzo, yeylon
Target Milestone: ---Keywords: EasyFix
Target Release: 3.4.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: integration
Fixed In Version: ovirt-3.4.0-rc Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 1058807 Environment:
Last Closed: 2014-03-31 12:28:08 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1058807    
Bug Blocks:    

Description Jiri Belka 2014-01-28 14:48:20 UTC 
Same applies to engine-image-uploader.

+++ This bug was initially created as a clone of Bug #1058807 +++

Description of problem:

/etc/ovirt-engine/isouploader.conf is world readable (can contain password!)

# ls -l /etc/ovirt-engine/isouploader.conf
-rw-r--r--. 1 root root 791 Nov 19 11:28 /etc/ovirt-engine/isouploader.conf
# grep -i pass /etc/ovirt-engine/isouploader.conf
# the oVirt Engine REST API password.
#passwd=PASSWORD

Version-Release number of selected component (if applicable):
ovirt-iso-uploader-3.4.0-0.1.beta1.el6.noarch / same in 3.3 + 3.2!

How reproducible:
100%

Steps to Reproduce:
1.
2.
3.

Actual results:
world readable

Expected results:
u=rw,g=r,o=

Additional info:
clone to 3.3.Z + 3.2.Z
Comment 1 Sandro Bonazzola 2014-01-31 09:55:50 UTC 
See comments on bug #1058807
Comment 2 Sandro Bonazzola 2014-02-20 16:04:35 UTC 
merged on both master and 3.4 branch.
Comment 3 Sandro Bonazzola 2014-03-03 15:24:03 UTC 
This is an automated message.

This BZ should be fixed in oVirt 3.4.0 RC repository, assignee please update the status of the bug to ON_QA once you've verified that the change is included in the build.
Comment 4 Martin Pavlik 2014-03-12 08:59:29 UTC 
verified ovirt-rc2 and av2.1
Comment 5 Sandro Bonazzola 2014-03-31 12:28:08 UTC 
this is an automated message: moving to Closed CURRENT RELEASE since oVirt 3.4.0 has been released