Bug 845341 - /var/log/cluster/fenced.log created with insecure permissions
/var/log/cluster/fenced.log created with insecure permissions
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: cluster (Show other bugs)
6.3
All Linux
urgent Severity urgent
: rc
: ---
Assigned To: David Teigland
Cluster QE
: ZStream
Depends On:
Blocks: 878373
  Show dependency treegraph
 
Reported: 2012-08-02 13:41 EDT by Aron Parsons
Modified: 2013-03-28 09:34 EDT (History)
8 users (show)

See Also:
Fixed In Version: cluster-3.0.12.1-33.el6
Doc Type: Bug Fix
Doc Text:
Previously, the fenced daemon was creating its log file with insecure permissions. Even though no sensitive data, such as passwords, usernames, or IP addresses were ever stored in the file, with this update, log files are created with correct permissions. Permissions of an existing log file is also automatically corrected if necessary.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-02-21 02:42:46 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
patch (2.03 KB, text/plain)
2012-08-03 11:14 EDT, David Teigland
no flags Details


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 340183 None None None Never

  None (edit)
Description Aron Parsons 2012-08-02 13:41:13 EDT
Description of problem:
fenced creates its log file with permissions of 666.  It should create it with permissions of 644 or better, like the rest of the cluster-related logs.

The problem is at line 1042 in fence/fenced/main.c.

Version-Release number of selected component (if applicable):
cman-3.0.12.1-32.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1. configure cluster
2. start cluster
3. ls -l /var/log/cluster/fenced.log
  
Actual results:
666

Expected results:
644

Additional info:
Comment 3 David Teigland 2012-08-03 10:31:06 EDT
The problem is that the daemon is doing umask(0), causing the fopen() within liblogthread to use 666.  I'll remove umask(0), but that won't fix the 666 permission on existing files.  Any suggestions about whether I should also add a chmod("/var/log/cluster/fenced.log", 666) to fix the existing files?
Comment 4 David Teigland 2012-08-03 10:40:16 EDT
typo, we'd change it to 644.
Comment 5 David Teigland 2012-08-03 11:14:24 EDT
Created attachment 602152 [details]
patch

    Remove umask(0) which caused liblogthread's fopen to
    create fenced.log with mode 666.
    
    Check if existing fenced.log has mode 666 and if so,
    chmod to 644.
Comment 14 errata-xmlrpc 2013-02-21 02:42:46 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0287.html

Note You need to log in before you can comment on or make changes to this bug.