Bug 1839894 (OCPRHV-81-4.5) - Docs: Add chmod/perm information for CA cert
Summary: Docs: Add chmod/perm information for CA cert
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: OCPRHV-81-4.5
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer
Version: 4.5
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: 4.4.z
Assignee: Rolfe Dlugy-Hegwer
QA Contact: Guilherme Santos
URL: https://issues.redhat.com/browse/OCPR...
Whiteboard:
: OCPRHV-81-4.6 (view as bug list)
Depends On: OCPRHV-81-4.6, OCPRHV-81-4.6
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-05-25 21:05 UTC by Douglas Schilling Landgraf
Modified: 2020-06-05 15:53 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of:
: OCPRHV-81-4.6 (view as bug list)
Environment:
Last Closed: 2020-06-05 15:53:07 UTC
Target Upstream Version:
Embargoed:
rdlugyhe: needinfo-
rdlugyhe: needinfo-


Attachments (Terms of Use)

Description Douglas Schilling Landgraf 2020-05-25 21:05:02 UTC
Description of problem:
------------------------------
The OCP on RHV can be executed by rootless user. However, we must make sure the CA file contain the right permissions. 


Bad scenario example:
--------------------------
    User imported the CA /etc/pki/ca-trust/source/anchors/${MYCA}.pem and kept only owner as read/write. 

Example:
    rw-------. root:root  /etc/pki/ca-trust/source/anchors/ca.pem


In that case, root can read the list of CA trusted with command trust list but ordinary can't read ca.pem.


What's expected ?
--------------------------

In OCP RHV documentation, we should recommend or make a note about the right permissions.


$ sudo chmod 0644 /etc/pki/ca-trust/source/anchors/ca.pem       


Example:
-------------
# cd /etc/pki/ca-trust/source/anchors
# ls -la engine-medogz-home.pem 
-rw-------. 1 root root 1355 May 25 13:24 engine-medogz-home.pem

# trust list | grep engine
    label: engine.medogz.home.52705

^^^^^^^ as root - all good

# sudo su douglas
$ trust list | grep engine
$                             <--------- None, bad



How to fix?
---------------------
$ sudo su -
# cd /etc/pki/ca-trust/source/anchors
# chmod 0644 engine-medogz-home.pem 


How can affect the OCP installer RHV?
---------------------------------------
If CA cert file perm is wrong... rootless user won't be able to use it to communicate with Engine.

Comment 9 Rolfe Dlugy-Hegwer 2020-06-05 14:35:36 UTC
*** Bug 1841384 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.