Bug 863018 - Lorax should set the right permission for initramfs
Summary: Lorax should set the right permission for initramfs
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: lorax
Version: 18
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
Assignee: Martin Gracik
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: AcceptedBlocker
Depends On:
Blocks: 782468 F18Beta, F18BetaBlocker
TreeView+ depends on / blocked
 
Reported: 2012-10-04 08:46 UTC by Martin Banas
Modified: 2013-09-19 13:10 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-10-30 22:18:53 UTC


Attachments (Terms of Use)

Description Martin Banas 2012-10-04 08:46:51 UTC
Description of problem:
New security feature in dracut changes the permissions to initrd.img, not to be world readable. This causes the installation to hang because of wrong permissions. When building new compose, lorax should create the file with right permissions.

Version-Release number of selected component (if applicable):
dracut-023-65.git20120927
lorax-18.20-1.fc18

How reproducible:
always

  
Actual results:
initrd.img file has a wrong permissions -rw-------

Expected results:
initrd.img file should be readable by apache and other services.

Comment 1 Martin Banas 2012-10-04 08:47:27 UTC
This is the dracut patch:

bd5b0179af91
commit e1b48995c26c4f06d1a718539cb1bd5b0179af91
Author: Harald Hoyer <harald@redhat.com>
Date:   Thu Sep 27 10:18:29 2012 +0200

    dracut.sh: create the initramfs non-world readable

diff --git a/dracut.sh b/dracut.sh
index 7148d0f..96faa06 100755
--- a/dracut.sh
+++ b/dracut.sh
@@ -1033,8 +1033,9 @@ if [[ $do_hardlink = yes ]] ; then
     }
 fi
 
+rm -f "$outfile"
 dinfo "*** Creating image file ***"
-if ! ( cd "$initdir"; find . |cpio -R 0:0 -H newc -o --quiet| \
+if ! ( umask 077; cd "$initdir"; find . |cpio -R 0:0 -H newc -o --quiet| \
     $compress > "$outfile"; ); then
     dfatal "dracut: creation of $outfile failed"
     exit 1

Comment 2 Brian Lane 2012-10-04 15:45:50 UTC
What do you mean by 'causes the installation to hang'? 0600 will not cause problems with the install. If other tools are copying the initrd, say to an apache server, they should set appropriate permissions for their needs. I don't think lorax should make any changes here.

Comment 3 Martin Gracik 2012-10-08 06:56:04 UTC
I agree with Brian here. The tools should not rely on lorax creatinf the exact permissions as they need. What if some other tool needs different permissions, will we need to have a permission flag in lorax then?

Comment 4 Daniel Mach 2012-10-08 07:16:25 UTC
The perms in dracut have changed due to strengthening security (e.g. embedded passwords in initrd), which doesn't apply to the installation images.
I think we generally want these images to be readable by anyone.
Keeping current state would mean changing all other tools using lorax.
If someone wants to run lorax and share the images via http now, he has to explicitly fix the perms.

Could you reconsider fixing it, please?

Comment 5 Martin Gracik 2012-10-08 10:38:41 UTC
Ok, you got a point.

Comment 6 Fedora Update System 2012-10-11 18:21:44 UTC
lorax-18.21-1.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/lorax-18.21-1.fc18

Comment 7 Fedora Update System 2012-10-12 17:52:21 UTC
Package lorax-18.21-1.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing lorax-18.21-1.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-15993/lorax-18.21-1.fc18
then log in and leave karma (feedback).

Comment 8 Dennis Gilmore 2012-10-29 20:40:31 UTC
proposing as a F18 Beta blocker, without this fixed we cant put together a working install tree as most install methods wont have access to the initrd.

Comment 9 Adam Williamson 2012-10-29 20:46:53 UTC
Clear +1 blocker if it blocks compose.

Comment 10 Kevin Fenzi 2012-10-29 20:51:16 UTC
+1 blocker. Breaks branched compose. ;)

Comment 11 Adam Williamson 2012-10-30 22:18:53 UTC
The update has been pushed stable, so closing. We had +3 for blocker anyway.


Note You need to log in before you can comment on or make changes to this bug.