Bug 826395 - Client credentials are cached in a world readable file
Summary: Client credentials are cached in a world readable file
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Pulp
Classification: Retired
Component: z_other
Version: Master
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
: 2.4.0
Assignee: Sayli Karmarkar
QA Contact: Preethi Thomas
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-05-30 06:29 UTC by Nick Coghlan
Modified: 2015-03-23 01:11 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2014-08-09 06:56:11 UTC
Embargoed:


Attachments (Terms of Use)

Description Nick Coghlan 2012-05-30 06:29:32 UTC
Description of problem:

The cached pulp credentials (including the parent directory) are created as world readable.

$ ls -l ~/.pulp/
total 8
-rw-rw-r--. 1 ncoghlan ncoghlan  917 Aug  2  2011 client.log
-rw-rw-r--. 1 ncoghlan ncoghlan 1726 May 14 14:03 user-cert.pem

Version-Release number of selected component (if applicable):

Seen with Pulp 0.0.267, didn't see anything in the 1.1.0 changelog to suggest it had been fixed.

How reproducible:

Always

Steps to Reproduce:
1. pulp-admin auth login -u <username>
3. enter password

  
Actual results:

Cached credentials are world readable

Expected results:

Cached credentials can only be read by the current user
Client refuses to run if cached credentials are world readable

Additional info:

A simple workaround for the problem is to run "chmod 0700 ~/.pulp" to restrict access to the containing directory

Comment 1 Randy Barlow 2014-01-02 21:52:39 UTC
I believe this is resolved in master, but I do not know which version of Pulp it is fixed in (or if that version is released.)

Preethi, to verify this bug, please:

2) $ pulp-admin login…

3) $ ls -lah ~/.pulp/

Make sure the user-cert.pem file is only readable by the owner (should be 600).

Comment 2 Randy Barlow 2014-03-18 16:04:37 UTC
This was fixed in a prior release of Pulp, but we never put it through the QE process. Moving to ON_QA.

Comment 3 mkovacik 2014-05-06 12:42:01 UTC
Verified in pulp-admin-client-2.4.0-0.11.beta.fc20.noarch

# Screen log

[root@ec2-54-220-158-169 pulp]# ls -lahdZ /root/.pulp/                                                                                                                                                                                       
drwxr-xr-x. root root unconfined_u:object_r:admin_home_t:s0 /root/.pulp/
[root@ec2-54-220-158-169 pulp]# ls -lahZ /root/.pulp/                                                                                                                                                                                        
drwxr-xr-x. root root unconfined_u:object_r:admin_home_t:s0 .
dr-xr-x---. root root system_u:object_r:admin_home_t:s0 ..
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 admin.log
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 consumer.log
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 server_calls.log
-rw-------. root root unconfined_u:object_r:admin_home_t:s0 user-cert.pem
[root@ec2-54-220-158-169 pulp]# sudo -u apache cat /root/.pulp/admin.log
cat: /root/.pulp/admin.log: Permission denied
[root@ec2-54-220-158-169 pulp]# sudo -u apache cat /root/.pulp/user-cert.pem
cat: /root/.pulp/user-cert.pem: Permission denied
[root@ec2-54-220-158-169 pulp]#

Comment 4 Randy Barlow 2014-08-09 06:56:11 UTC
This has been fixed in Pulp 2.4.0-1.


Note You need to log in before you can comment on or make changes to this bug.