freeipa

#8441 File permissions of /etc/ipa/ca.crt differ between CA-ful and CA-less
Closed: fixed by rcritten. Opened by rcritten.

Closed: fixed
Reopen Issue

Issue

On a CA-ful installation /etc/ipa/ca.crt has mode 0644. On a CA-less installation it is 0444.

This inconsistency raises a false positive for freeipa-healthcheck.

In a CA-less environment the CA certificate is created at https://pagure.io/freeipa/blob/master/f/ipaserver/install/server/install.py#_909 prior to DS installation but then overwritten at the end of init_from_pkcs12 in export_ca_cert https://pagure.io/freeipa/blob/master/f/ipaserver/install/certs.py#_325 The original creation is probably not necessary at all. The cert is created in both cases 0444.

In a CA-ful environment the CA certificate is created by the pkispawn as 0644.

I don't have strong feelings either way which one is correct. The file is owned by root so the write mode is a no-op. I'm inclined to make it 0644 since there are more existing CA-ful installations.

It is TBD whether the initial creation is needed or not. If it isn't needed then those lines should be removed.

I don't see a need for an upgrader to fix existing perms. It is just a warning from healthcheck in any case.

Even root needs DAC_OVERRIDE capability to write to a 0o444 file. The capability may not be available in restricted environments (SELinux, container). Please give the file 0o644.

Metadata Update from @rcritten:
- Issue assigned to rcritten

https://github.com/freeipa/freeipa/pull/4989

master:

  • ec367aa4792fb14ee21ebd5a8593ed287b598229 Set mode of /etc/ipa/ca.crt to 0644 in CA-less installations
  • 7e37b45e029d33ebd865724e7d690a29b30a8ef4 ipatests: Check permissions of /etc/ipa/ca.crt new installations

ipa-4-8:

  • 4a97145c3a76a4d9ebf52b3905410a0bd7bec856 Set mode of /etc/ipa/ca.crt to 0644 in CA-less installations
  • da2079ce2cc841aec56da872131112eb24326f81 ipatests: Check permissions of /etc/ipa/ca.crt new installations

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1870202

Issue linked to Bugzilla: Bug 1870202
Metadata
None
None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.