Bug 1809463 - engine-setup should set the permissions of private key files more restrictive
Summary: engine-setup should set the permissions of private key files more restrictive
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: ovirt-engine
Classification: oVirt
Component: Setup.Engine.OVN
Version: 4.3.9.1
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ovirt-4.5.0
: 4.5.0
Assignee: Ales Musil
QA Contact: Michael Burman
URL:
Whiteboard:
Depends On:
Blocks: 1940824
TreeView+ depends on / blocked
 
Reported: 2020-03-03 07:59 UTC by Dominik Holler
Modified: 2022-04-20 06:33 UTC (History)
6 users (show)

Fixed In Version: ovirt-engine-4.5.0
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-04-20 06:33:59 UTC
oVirt Team: Network
Embargoed:
mperina: ovirt-4.5+

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1806276 0 urgent CLOSED [HE] ovirt-provider-ovn is non-functional on 4.3.9 Hosted-Engine 2021-02-22 00:41:40 UTC
Red Hat Bugzilla 1809458 0 medium CLOSED [FDP 20.B] ovn-northd must be able to read files with permissions of a private group 2023-10-05 15:06:04 UTC
Red Hat Issue Tracker RHV-37688 0 None None None 2021-08-10 11:06:03 UTC
oVirt gerrit 115208 0 None MERGED packaging: Update OVN certificate permissions 2021-11-29 12:53:22 UTC

Description Dominik Holler 2020-03-03 07:59:34 UTC 
Description of problem:
Because of bug 1809458 and bug 1806276 engine-setup sets the private key files for OVN readable by hugetlbfs groups. This enables members of hugetlbfs other than OVN to read these files, too.

Actual results:
The OVN's private key files can be read by other memebers of hugetlbfs.

Expected results:
The OVN's private key files cannot be read by other memebers of hugetlbfs.
Comment 1 Dominik Holler 2020-03-10 10:42:13 UTC 
This bug could be backported to 4.4, as soon as OVS/OVN allows this.
Comment 2 Michael Burman 2022-03-22 07:48:44 UTC 
Verified on - rhvm-4.5.0-0.237.el8ev.noarch
Comment 3 Sandro Bonazzola 2022-04-20 06:33:59 UTC 
This bugzilla is included in oVirt 4.5.0 release, published on April 20th 2022.

Since the problem described in this bug report should be resolved in oVirt 4.5.0 release, it has been closed with a resolution of CURRENT RELEASE.

If the solution does not work for you, please open a new bug report.
Note You need to log in before you can comment on or make changes to this bug.