Bug 1462841 - Satellite Packaging should properly set user/group ownership and permissions prior to satellite-installer
Satellite Packaging should properly set user/group ownership and permissions ...
Status: NEW
Product: Red Hat Satellite 6
Classification: Red Hat
Component: Packaging (Show other bugs)
6.3.0
Unspecified Unspecified
unspecified Severity high (vote)
: Unspecified
: --
Assigned To: satellite6-bugs
Katello QA List
: Triaged
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-06-19 12:47 EDT by Craig Donnelly
Modified: 2017-06-20 13:25 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Craig Donnelly 2017-06-19 12:47:58 EDT
Description of problem:
Currently, Installing Satellite packages results in a baseline inclusion of content necessary to get into the stage of being able to run 'satellite-installer' which will then finish the job.

Some of the actions 'satellite-installer' does is to ensure that user/group ownership and permissions are set correctly for files in order for Satellite to be able to operate properly across multiple components.

Due to the order of operations this is performed in, this results in failure of C2S security audits.

The reason for this is simple:

The 'satellite-installer' run will make modifications to some files (config/otherwise) once it is run, which do not actually get properly setup from installation via their RPMs.

This results in a failed `rpm -Va | grep '^.M'` check for modified file permissions after installation:

# rpm -Va | grep '^.M'
SM5...GT.  c /etc/foreman/database.yml
SM5...GT.  c /etc/foreman/settings.yaml
.M...UG..    /etc/pulp/vhosts80/puppet.conf
SM5...GT.  c /etc/foreman-proxy/settings.d/pulp.yml
SM5...GT.  c /etc/foreman-proxy/settings.d/pulpnode.yml
SM5...GT.  c /etc/foreman-proxy/settings.d/bmc.yml
SM5...GT.  c /etc/foreman-proxy/settings.d/dhcp.yml
SM5...GT.  c /etc/foreman-proxy/settings.d/dhcp_isc.yml
SM5...GT.  c /etc/foreman-proxy/settings.d/dns.yml
SM5...GT.  c /etc/foreman-proxy/settings.d/dns_nsupdate.yml
SM5...GT.  c /etc/foreman-proxy/settings.d/dns_nsupdate_gss.yml
SM5...GT.  c /etc/foreman-proxy/settings.d/logs.yml
SM5...GT.  c /etc/foreman-proxy/settings.d/puppet.yml
SM5...GT.  c /etc/foreman-proxy/settings.d/puppetca.yml
SM5...GT.  c /etc/foreman-proxy/settings.d/realm.yml
SM5...GT.  c /etc/foreman-proxy/settings.d/templates.yml
SM5...GT.  c /etc/foreman-proxy/settings.d/tftp.yml
SM5...GT.  c /etc/foreman-proxy/settings.yml
.M.......    /var/run/foreman-proxy
SM5...GT.  c /etc/foreman-proxy/settings.d/openscap.yml
SM5...GT.  c /etc/foreman-proxy/settings.d/remote_execution_ssh.yml
.M....G..    /var/lib/mongodb
.M.......    /var/run/mongodb
SM5....T.  c /etc/httpd/conf.d/pulp.conf
SM5....T.  c /etc/httpd/conf.d/pulp_content.conf
SM5..U.T.  c /etc/pulp/server.conf
SM5...GT.  c /etc/foreman-proxy/settings.d/dynflow.yml
.M...UG..    /etc/pulp/vhosts80/rpm.conf

Any of the above items that are indicated with a U or G have had user/group ownership modifications after install. (Being a config files does not exempt them from this security practice)

Some of the files above are not listed as config files but have had user/group permissions change as well as the file content. If they are being tracked as installed files by RPM, they should likely be marked as a configuration file if they are to be modified by the 'satellite-installer'.

The directories should be created with the correct user/group ownership from RPM installation if they are not going to be created by the binaries themselves.

Version-Release number of selected component (if applicable):
All Releases.

How reproducible:
100%

Steps to Reproduce:
1. yum install satellite
2. satellite-installer --scenario satellite
3. rpm -Va | grep '^.M'

For Reference of meaning:
       S file Size differs
       M Mode differs (includes permissions and file type)
       5 digest (formerly MD5 sum) differs
       D Device major/minor number mismatch
       L readLink(2) path mismatch
       U User ownership differs
       G Group ownership differs
       T mTime differs
       P caPabilities differ

Actual results:
User and group ownership or permissions are modified after RPM install.

Expected results:
User and group ownership / permissions should be set on file install from RPM.

Additional info:
This is an important request for secure customers and should also be a priority included with the plans for any other form of security compliance, such as FIPS.

Note You need to log in before you can comment on or make changes to this bug.