Bug 444602 - permission problems on mod_nss database in Fedora 9
permission problems on mod_nss database in Fedora 9
Status: CLOSED ERRATA
Product: freeIPA
Classification: Community
Component: ipa-server (Show other bugs)
1.0
All Linux
high Severity high
: ---
: ---
Assigned To: Rob Crittenden
Chandrasekar Kannan
:
Depends On:
Blocks: 453489
  Show dependency treegraph
 
Reported: 2008-04-29 10:37 EDT by Rob Crittenden
Modified: 2015-01-04 18:32 EST (History)
2 users (show)

See Also:
Fixed In Version: freeipa-2.0.0-1.fc15
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-03-27 03:13:50 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
set permissions on mod_nss database (1.50 KB, patch)
2008-04-29 10:38 EDT, Rob Crittenden
no flags Details | Diff

  None (edit)
Description Rob Crittenden 2008-04-29 10:37:35 EDT
The version of NSS in Fedora 9 required changes to mod_nss to do the
NSS_Initialize() in the children. This means that the apache user needs to be
able to read the database.

The solution was to set the database mode to 640 root:apache.

IPA creates its own database and sets the mode to 600 root:root

The installer needs to accommodate this change.
Comment 1 Rob Crittenden 2008-04-29 10:38:16 EDT
Created attachment 304123 [details]
set permissions on mod_nss database
Comment 2 Rob Crittenden 2008-04-30 09:45:23 EDT
ipa-1-0: 3bbad0704d747b64ba69e0076f21e1aaba80963e
master: 274eb708c28abf25087c3656ec93370c2000efd3
Comment 4 Jenny Galipeau 2008-11-21 14:27:16 EST
I am verifying this bug...

Assuming the correct location for the files is:
[root@jennyv3 alias]# pwd
/etc/httpd/alias

It appears this bug is fixed.
[root@jennyv3 alias]# ls -al
total 272
drwxr-xr-x 2 root root    4096 Nov 17 05:19 .
drwxr-xr-x 5 root root    4096 Nov 17 05:15 ..
-rw-r----- 1 root apache 65536 Nov 17 05:19 cert8.db
-rw------- 1 root root   65536 Nov 17 05:15 cert8.db.orig
-rw------- 1 root root    4395 Nov 17 05:15 install.log
-rw-r----- 1 root apache 16384 Nov 17 05:19 key3.db
-rw------- 1 root root   16384 Nov 17 05:15 key3.db.orig
lrwxrwxrwx 1 root root      30 Nov 17 05:15 libnssckbi.so -> ../../../usr/lib/libnssckbi.so
-r-------- 1 root root      40 Nov 17 05:19 noise.txt
-rw------- 1 root root       1 Nov 17 05:19 pwdfile.txt
-rw-r----- 1 root apache 16384 Nov 17 05:19 secmod.db
-rw------- 1 root root   16384 Nov 17 05:15 secmod.db.orig

Can someone please confirm?

Thanks
Jenny
Comment 5 Chandrasekar Kannan 2008-11-21 14:33:12 EST
yes. looks good to me.
Comment 6 Jenny Galipeau 2008-11-21 14:42:15 EST
Done .. Fix verified.

Note You need to log in before you can comment on or make changes to this bug.