Bug 863018 - Lorax should set the right permission for initramfs
Lorax should set the right permission for initramfs
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: lorax (Show other bugs)
18
Unspecified Unspecified
unspecified Severity medium
: ---
: ---
Assigned To: Martin Gracik
Fedora Extras Quality Assurance
AcceptedBlocker
:
Depends On:
Blocks: 782468 F18Beta/F18BetaBlocker
  Show dependency treegraph
 
Reported: 2012-10-04 04:46 EDT by Martin Banas
Modified: 2013-09-19 09:10 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-10-30 18:18:53 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Martin Banas 2012-10-04 04:46:51 EDT
Description of problem:
New security feature in dracut changes the permissions to initrd.img, not to be world readable. This causes the installation to hang because of wrong permissions. When building new compose, lorax should create the file with right permissions.

Version-Release number of selected component (if applicable):
dracut-023-65.git20120927
lorax-18.20-1.fc18

How reproducible:
always

  
Actual results:
initrd.img file has a wrong permissions -rw-------

Expected results:
initrd.img file should be readable by apache and other services.
Comment 1 Martin Banas 2012-10-04 04:47:27 EDT
This is the dracut patch:

bd5b0179af91
commit e1b48995c26c4f06d1a718539cb1bd5b0179af91
Author: Harald Hoyer <harald@redhat.com>
Date:   Thu Sep 27 10:18:29 2012 +0200

    dracut.sh: create the initramfs non-world readable

diff --git a/dracut.sh b/dracut.sh
index 7148d0f..96faa06 100755
--- a/dracut.sh
+++ b/dracut.sh
@@ -1033,8 +1033,9 @@ if [[ $do_hardlink = yes ]] ; then
     }
 fi
 
+rm -f "$outfile"
 dinfo "*** Creating image file ***"
-if ! ( cd "$initdir"; find . |cpio -R 0:0 -H newc -o --quiet| \
+if ! ( umask 077; cd "$initdir"; find . |cpio -R 0:0 -H newc -o --quiet| \
     $compress > "$outfile"; ); then
     dfatal "dracut: creation of $outfile failed"
     exit 1
Comment 2 Brian Lane 2012-10-04 11:45:50 EDT
What do you mean by 'causes the installation to hang'? 0600 will not cause problems with the install. If other tools are copying the initrd, say to an apache server, they should set appropriate permissions for their needs. I don't think lorax should make any changes here.
Comment 3 Martin Gracik 2012-10-08 02:56:04 EDT
I agree with Brian here. The tools should not rely on lorax creatinf the exact permissions as they need. What if some other tool needs different permissions, will we need to have a permission flag in lorax then?
Comment 4 Daniel Mach 2012-10-08 03:16:25 EDT
The perms in dracut have changed due to strengthening security (e.g. embedded passwords in initrd), which doesn't apply to the installation images.
I think we generally want these images to be readable by anyone.
Keeping current state would mean changing all other tools using lorax.
If someone wants to run lorax and share the images via http now, he has to explicitly fix the perms.

Could you reconsider fixing it, please?
Comment 5 Martin Gracik 2012-10-08 06:38:41 EDT
Ok, you got a point.
Comment 6 Fedora Update System 2012-10-11 14:21:44 EDT
lorax-18.21-1.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/lorax-18.21-1.fc18
Comment 7 Fedora Update System 2012-10-12 13:52:21 EDT
Package lorax-18.21-1.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing lorax-18.21-1.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-15993/lorax-18.21-1.fc18
then log in and leave karma (feedback).
Comment 8 Dennis Gilmore 2012-10-29 16:40:31 EDT
proposing as a F18 Beta blocker, without this fixed we cant put together a working install tree as most install methods wont have access to the initrd.
Comment 9 Adam Williamson 2012-10-29 16:46:53 EDT
Clear +1 blocker if it blocks compose.
Comment 10 Kevin Fenzi 2012-10-29 16:51:16 EDT
+1 blocker. Breaks branched compose. ;)
Comment 11 Adam Williamson 2012-10-30 18:18:53 EDT
The update has been pushed stable, so closing. We had +3 for blocker anyway.

Note You need to log in before you can comment on or make changes to this bug.