Bug 845341 - /var/log/cluster/fenced.log created with insecure permissions
Summary: /var/log/cluster/fenced.log created with insecure permissions
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: cluster
Version: 6.3
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: rc
: ---
Assignee: David Teigland
QA Contact: Cluster QE
URL:
Whiteboard:
Depends On:
Blocks: 878373
TreeView+ depends on / blocked
 
Reported: 2012-08-02 17:41 UTC by Aron Parsons
Modified: 2018-11-30 20:54 UTC (History)
8 users (show)

Fixed In Version: cluster-3.0.12.1-33.el6
Doc Type: Bug Fix
Doc Text:
Previously, the fenced daemon was creating its log file with insecure permissions. Even though no sensitive data, such as passwords, usernames, or IP addresses were ever stored in the file, with this update, log files are created with correct permissions. Permissions of an existing log file is also automatically corrected if necessary.
Clone Of:
Environment:
Last Closed: 2013-02-21 07:42:46 UTC
Target Upstream Version:


Attachments (Terms of Use)
patch (2.03 KB, text/plain)
2012-08-03 15:14 UTC, David Teigland
no flags Details


Links
System ID Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 340183 None None None Never
Red Hat Product Errata RHBA-2013:0287 normal SHIPPED_LIVE cluster and gfs2-utils bug fix and enhancement update 2013-02-20 20:36:42 UTC

Description Aron Parsons 2012-08-02 17:41:13 UTC
Description of problem:
fenced creates its log file with permissions of 666.  It should create it with permissions of 644 or better, like the rest of the cluster-related logs.

The problem is at line 1042 in fence/fenced/main.c.

Version-Release number of selected component (if applicable):
cman-3.0.12.1-32.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1. configure cluster
2. start cluster
3. ls -l /var/log/cluster/fenced.log
  
Actual results:
666

Expected results:
644

Additional info:

Comment 3 David Teigland 2012-08-03 14:31:06 UTC
The problem is that the daemon is doing umask(0), causing the fopen() within liblogthread to use 666.  I'll remove umask(0), but that won't fix the 666 permission on existing files.  Any suggestions about whether I should also add a chmod("/var/log/cluster/fenced.log", 666) to fix the existing files?

Comment 4 David Teigland 2012-08-03 14:40:16 UTC
typo, we'd change it to 644.

Comment 5 David Teigland 2012-08-03 15:14:24 UTC
Created attachment 602152 [details]
patch

    Remove umask(0) which caused liblogthread's fopen to
    create fenced.log with mode 666.
    
    Check if existing fenced.log has mode 666 and if so,
    chmod to 644.

Comment 14 errata-xmlrpc 2013-02-21 07:42:46 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0287.html


Note You need to log in before you can comment on or make changes to this bug.