Warn in ipa-healthcheck if umask is not 022
IPA currently only supports a umask of 022 and sets that during installation. Resolves: RHEL-85561
This commit is contained in:
Rob Crittenden
parent
3da0d65e9a
commit
f7df7c49ea
103
0017-Warn-about-unexpected-umask.patch
Normal file
103
0017-Warn-about-unexpected-umask.patch
Normal file
@ -0,0 +1,103 @@
|
||||
From 1607150d30a6f7da4dc4661b4e946d037da513e3 Mon Sep 17 00:00:00 2001
|
||||
From: David Hanina <dhanina@redhat.com>
|
||||
Date: Wed, 26 Mar 2025 09:26:39 +0100
|
||||
Subject: [PATCH] Warn about unexpected umask
|
||||
|
||||
We should let users know, that their umask set wrong to
|
||||
an unsupported value, it does not make much sense to check file
|
||||
permissions when wrong umask is set.
|
||||
|
||||
Fixes: https://github.com/freeipa/freeipa-healthcheck/issues/353
|
||||
Signed-off-by: David Hanina <dhanina@redhat.com>
|
||||
---
|
||||
src/ipahealthcheck/core/files.py | 25 ++++++++++++++++++++++++-
|
||||
tests/test_core_files.py | 19 ++++++++++++++++++-
|
||||
2 files changed, 42 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/ipahealthcheck/core/files.py b/src/ipahealthcheck/core/files.py
|
||||
index 32bc5b2..6749d26 100644
|
||||
--- a/src/ipahealthcheck/core/files.py
|
||||
+++ b/src/ipahealthcheck/core/files.py
|
||||
@@ -12,6 +12,19 @@ from ipahealthcheck.core.plugin import Result, duration
|
||||
|
||||
logger = logging.getLogger()
|
||||
|
||||
+EXPECTED_UMASK = 0o022
|
||||
+
|
||||
+
|
||||
+def current_umask():
|
||||
+ """
|
||||
+ Retrieves current umask by setting it temporarily
|
||||
+
|
||||
+ :returns: int umask
|
||||
+ """
|
||||
+ umask = os.umask(EXPECTED_UMASK)
|
||||
+ os.umask(umask)
|
||||
+ return umask
|
||||
+
|
||||
|
||||
class FileCheck:
|
||||
"""Generic check to validate permission and ownership of files
|
||||
@@ -41,6 +54,16 @@ class FileCheck:
|
||||
yield Result(self, constants.ERROR, key=file,
|
||||
msg='Code format is incorrect for file')
|
||||
|
||||
+ umask = current_umask()
|
||||
+ correct_umask = umask == EXPECTED_UMASK
|
||||
+ if not correct_umask:
|
||||
+ yield Result(self, constants.WARNING, type='umask',
|
||||
+ expected=oct(EXPECTED_UMASK), got=oct(umask),
|
||||
+ msg='Unexpected umask %s expected %s, '
|
||||
+ 'skipping file permissions.' %
|
||||
+ ('0o' + format(umask, 'o').zfill(3),
|
||||
+ '0o' + format(EXPECTED_UMASK, 'o').zfill(3)))
|
||||
+
|
||||
for (path, owner, group, mode) in process_files:
|
||||
if not isinstance(owner, tuple):
|
||||
owner = tuple((owner,))
|
||||
@@ -58,7 +81,7 @@ class FileCheck:
|
||||
stat = os.stat(path)
|
||||
fmode = str(oct(stat.st_mode)[-4:])
|
||||
key = '%s_mode' % path.replace('/', '_')
|
||||
- if fmode not in mode:
|
||||
+ if correct_umask and fmode not in mode:
|
||||
if len(mode) == 1:
|
||||
modes = mode[0]
|
||||
else:
|
||||
diff --git a/tests/test_core_files.py b/tests/test_core_files.py
|
||||
index d308410..094305a 100644
|
||||
--- a/tests/test_core_files.py
|
||||
+++ b/tests/test_core_files.py
|
||||
@@ -9,7 +9,7 @@ from util import m_api
|
||||
from util import capture_results
|
||||
|
||||
from ipahealthcheck.core import config
|
||||
-from ipahealthcheck.core.files import FileCheck
|
||||
+from ipahealthcheck.core.files import EXPECTED_UMASK, FileCheck
|
||||
from ipahealthcheck.core import constants
|
||||
from ipahealthcheck.core.plugin import Results
|
||||
from ipahealthcheck.ipa.files import IPAFileCheck
|
||||
@@ -303,3 +303,20 @@ def test_ipa_files_format(mock_pkinit):
|
||||
|
||||
for result in results.results:
|
||||
assert result.result in (constants.SUCCESS, constants.WARNING)
|
||||
+
|
||||
+
|
||||
+@patch('os.umask')
|
||||
+def test_bad_umask(mock_umask):
|
||||
+ mock_umask.return_value = 0o027
|
||||
+
|
||||
+ f = FileCheck()
|
||||
+ f.files = files
|
||||
+
|
||||
+ results = capture_results(f)
|
||||
+ my_results = get_results(results, 'umask')
|
||||
+ assert my_results.results[0].result == constants.WARNING
|
||||
+ assert my_results.results[0].kw.get('got') == oct(0o027)
|
||||
+ assert my_results.results[0].kw.get('expected') == oct(EXPECTED_UMASK)
|
||||
+ assert my_results.results[0].kw.get('type') == 'umask'
|
||||
+ assert my_results.results[0].kw.get('msg') == \
|
||||
+ 'Unexpected umask 0o027 expected 0o022, skipping file permissions.'
|
||||
--
|
||||
2.49.0
|
||||
|
||||
@ -17,7 +17,7 @@
|
||||
|
||||
Name: %{prefix}-healthcheck
|
||||
Version: 0.16
|
||||
Release: 9%{?dist}
|
||||
Release: 10%{?dist}
|
||||
Summary: Health check tool for %{productname}
|
||||
BuildArch: noarch
|
||||
License: GPL-3.0-or-later
|
||||
@ -41,6 +41,7 @@ Patch0013: 0013-Warn-missing-fips-file.patch
|
||||
Patch0014: 0014-Remove-unnecessary-timeout.patch
|
||||
Patch0015: 0015-Remove-unnecessary-check.patch
|
||||
Patch0016: 0016-Warn-if-krbLastSuccessfulAuth-replication-is-enabled.patch
|
||||
Patch0017: 0017-Warn-about-unexpected-umask.patch
|
||||
|
||||
Requires: %{name}-core = %{version}-%{release}
|
||||
Requires: %{prefix}-server
|
||||
@ -170,6 +171,9 @@ PYTHONPATH=src PATH=$PATH:$RPM_BUILD_ROOT/usr/bin pytest-3 tests/test_*
|
||||
|
||||
|
||||
%changelog
|
||||
* Tue May 27 2025 Rob Crittenden <rcritten@redhat.com> - 0.16-10
|
||||
- Warn in ipa-healthcheck if umask is not 022 (RHEL-85561)
|
||||
|
||||
* Mon Mar 10 2025 Rob Crittenden <rcritten@redhat.com> - 0.16-9
|
||||
- Don't require fips-mode-setup for FIPS status (RHEL-67635)
|
||||
- Check for krbLastSuccessfulAuth being enabled (RHEL-84771)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user