Dominic Cleal reports 

Description of problem:
katello-configure generates a bootstrap RPM for installation on clients to be 
connected to the Katello server.  This contains a CA certificate for Candlepin
which has a mode set of 0666, permitting other users on a client system to 
modify the CA used to trust the remote Katello server.

The RPM is named after the FQDN of the Katello server, e.g.
candlepin-cert-consumer-$FQDN

# ll /etc/rhsm/ca/candlepin-local.pem 
-rw-rw-rw-. 1 root root 5385 Nov 12 16:21 /etc/rhsm/ca/candlepin-local.pem

# rpm -qalv candlepin-cert-consumer-\*
-rw-rw-rw-    1 root    root  5385 Nov 12 16:21 /etc/rhsm/ca/candlepin-local.pem

Version-Release number of selected component (if applicable):
Tested on 1.1 release, verified code present in git master.

How reproducible:
Always.

Steps to Reproduce:
1. install Katello (https://fedorahosted.org/katello/wiki/Install)
2. run: katello-configure
3. run: rpm -qplv /var/www/html/pub/candlepin-cert-consumer-*noarch.rpm

Actual results:
-rw-rw-rw-    1 root    root  5385 Nov 12 16:21 /etc/rhsm/ca/candlepin-local.pem

Expected results:
-rw-r--r--    1 root    root  5385 Nov 12 16:21 /etc/rhsm/ca/candlepin-local.pem

Additional info:
katello-configure generates the RPM from within the certs::config puppet class:

  exec { "generate-candlepin-consumer-certificate":
    cwd       => "${katello_www_pub_dir}",
    command   => "gen-rpm.sh --name '${candlepin_consumer_name}' --version 1.0 --release 1 --packager None --vendor None --group 'Applications/System' --summary '${candlepin_consumer_summary}' --description '${candlepin_consumer_description}' --requires subscription-manager --post ${ssl_build_path}/rhsm-katello-reconfigure /etc/rhsm/ca/candlepin-local.pem:666=${ssl_build_path}/$candlepin_cert_name.crt 2>>${katello::params::configure_log_base}/certificates.log && /sbin/restorecon ./*rpm",
    path      => "/usr/share/katello/certs:/usr/bin:/bin",
    creates   => "${katello_www_pub_dir}/${candlepin_consumer_name}-1.0-1.noarch.rpm",
    require   => [Exec["generate-candlepin-certificate"], File["${ssl_build_path}/rhsm-katello-reconfigure"], File["${katello::params::configure_log_base}"]]
  }

In the middle of this command it passes in the permissions "666" to the gen-rpm.sh script, which get put into the RPM spec as the %attr for the CA cert file.

The gen-rpm.sh script is also used by katello-ssl-tool, but a quick test shows that this doesn't explicitly set the mode when it generates a CA RPM, so the RPM is generated with the file having default 644 permissions.