Bug 826395 - Client credentials are cached in a world readable file
Client credentials are cached in a world readable file
Product: Pulp
Classification: Community
Component: z_other (Show other bugs)
All Linux
urgent Severity urgent
: ---
: 2.4.0
Assigned To: Sayli Karmarkar
Preethi Thomas
: Triaged
Depends On:
  Show dependency treegraph
Reported: 2012-05-30 02:29 EDT by Nick Coghlan
Modified: 2015-03-22 21:11 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2014-08-09 02:56:11 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Nick Coghlan 2012-05-30 02:29:32 EDT
Description of problem:

The cached pulp credentials (including the parent directory) are created as world readable.

$ ls -l ~/.pulp/
total 8
-rw-rw-r--. 1 ncoghlan ncoghlan  917 Aug  2  2011 client.log
-rw-rw-r--. 1 ncoghlan ncoghlan 1726 May 14 14:03 user-cert.pem

Version-Release number of selected component (if applicable):

Seen with Pulp 0.0.267, didn't see anything in the 1.1.0 changelog to suggest it had been fixed.

How reproducible:


Steps to Reproduce:
1. pulp-admin auth login -u <username>
3. enter password

Actual results:

Cached credentials are world readable

Expected results:

Cached credentials can only be read by the current user
Client refuses to run if cached credentials are world readable

Additional info:

A simple workaround for the problem is to run "chmod 0700 ~/.pulp" to restrict access to the containing directory
Comment 1 Randy Barlow 2014-01-02 16:52:39 EST
I believe this is resolved in master, but I do not know which version of Pulp it is fixed in (or if that version is released.)

Preethi, to verify this bug, please:

2) $ pulp-admin login…

3) $ ls -lah ~/.pulp/

Make sure the user-cert.pem file is only readable by the owner (should be 600).
Comment 2 Randy Barlow 2014-03-18 12:04:37 EDT
This was fixed in a prior release of Pulp, but we never put it through the QE process. Moving to ON_QA.
Comment 3 mkovacik 2014-05-06 08:42:01 EDT
Verified in pulp-admin-client-2.4.0-0.11.beta.fc20.noarch

# Screen log

[root@ec2-54-220-158-169 pulp]# ls -lahdZ /root/.pulp/                                                                                                                                                                                       
drwxr-xr-x. root root unconfined_u:object_r:admin_home_t:s0 /root/.pulp/
[root@ec2-54-220-158-169 pulp]# ls -lahZ /root/.pulp/                                                                                                                                                                                        
drwxr-xr-x. root root unconfined_u:object_r:admin_home_t:s0 .
dr-xr-x---. root root system_u:object_r:admin_home_t:s0 ..
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 admin.log
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 consumer.log
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 server_calls.log
-rw-------. root root unconfined_u:object_r:admin_home_t:s0 user-cert.pem
[root@ec2-54-220-158-169 pulp]# sudo -u apache cat /root/.pulp/admin.log
cat: /root/.pulp/admin.log: Permission denied
[root@ec2-54-220-158-169 pulp]# sudo -u apache cat /root/.pulp/user-cert.pem
cat: /root/.pulp/user-cert.pem: Permission denied
[root@ec2-54-220-158-169 pulp]#
Comment 4 Randy Barlow 2014-08-09 02:56:11 EDT
This has been fixed in Pulp 2.4.0-1.

Note You need to log in before you can comment on or make changes to this bug.