From f7df7c49eaae413b6426b81d4b4840db99688d28 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Tue, 27 May 2025 14:48:10 -0400 Subject: [PATCH] Warn in ipa-healthcheck if umask is not 022 IPA currently only supports a umask of 022 and sets that during installation. Resolves: RHEL-85561 --- 0017-Warn-about-unexpected-umask.patch | 103 +++++++++++++++++++++++++ freeipa-healthcheck.spec | 6 +- 2 files changed, 108 insertions(+), 1 deletion(-) create mode 100644 0017-Warn-about-unexpected-umask.patch diff --git a/0017-Warn-about-unexpected-umask.patch b/0017-Warn-about-unexpected-umask.patch new file mode 100644 index 0000000..055ca2b --- /dev/null +++ b/0017-Warn-about-unexpected-umask.patch @@ -0,0 +1,103 @@ +From 1607150d30a6f7da4dc4661b4e946d037da513e3 Mon Sep 17 00:00:00 2001 +From: David Hanina +Date: Wed, 26 Mar 2025 09:26:39 +0100 +Subject: [PATCH] Warn about unexpected umask + +We should let users know, that their umask set wrong to +an unsupported value, it does not make much sense to check file +permissions when wrong umask is set. + +Fixes: https://github.com/freeipa/freeipa-healthcheck/issues/353 +Signed-off-by: David Hanina +--- + src/ipahealthcheck/core/files.py | 25 ++++++++++++++++++++++++- + tests/test_core_files.py | 19 ++++++++++++++++++- + 2 files changed, 42 insertions(+), 2 deletions(-) + +diff --git a/src/ipahealthcheck/core/files.py b/src/ipahealthcheck/core/files.py +index 32bc5b2..6749d26 100644 +--- a/src/ipahealthcheck/core/files.py ++++ b/src/ipahealthcheck/core/files.py +@@ -12,6 +12,19 @@ from ipahealthcheck.core.plugin import Result, duration + + logger = logging.getLogger() + ++EXPECTED_UMASK = 0o022 ++ ++ ++def current_umask(): ++ """ ++ Retrieves current umask by setting it temporarily ++ ++ :returns: int umask ++ """ ++ umask = os.umask(EXPECTED_UMASK) ++ os.umask(umask) ++ return umask ++ + + class FileCheck: + """Generic check to validate permission and ownership of files +@@ -41,6 +54,16 @@ class FileCheck: + yield Result(self, constants.ERROR, key=file, + msg='Code format is incorrect for file') + ++ umask = current_umask() ++ correct_umask = umask == EXPECTED_UMASK ++ if not correct_umask: ++ yield Result(self, constants.WARNING, type='umask', ++ expected=oct(EXPECTED_UMASK), got=oct(umask), ++ msg='Unexpected umask %s expected %s, ' ++ 'skipping file permissions.' % ++ ('0o' + format(umask, 'o').zfill(3), ++ '0o' + format(EXPECTED_UMASK, 'o').zfill(3))) ++ + for (path, owner, group, mode) in process_files: + if not isinstance(owner, tuple): + owner = tuple((owner,)) +@@ -58,7 +81,7 @@ class FileCheck: + stat = os.stat(path) + fmode = str(oct(stat.st_mode)[-4:]) + key = '%s_mode' % path.replace('/', '_') +- if fmode not in mode: ++ if correct_umask and fmode not in mode: + if len(mode) == 1: + modes = mode[0] + else: +diff --git a/tests/test_core_files.py b/tests/test_core_files.py +index d308410..094305a 100644 +--- a/tests/test_core_files.py ++++ b/tests/test_core_files.py +@@ -9,7 +9,7 @@ from util import m_api + from util import capture_results + + from ipahealthcheck.core import config +-from ipahealthcheck.core.files import FileCheck ++from ipahealthcheck.core.files import EXPECTED_UMASK, FileCheck + from ipahealthcheck.core import constants + from ipahealthcheck.core.plugin import Results + from ipahealthcheck.ipa.files import IPAFileCheck +@@ -303,3 +303,20 @@ def test_ipa_files_format(mock_pkinit): + + for result in results.results: + assert result.result in (constants.SUCCESS, constants.WARNING) ++ ++ ++@patch('os.umask') ++def test_bad_umask(mock_umask): ++ mock_umask.return_value = 0o027 ++ ++ f = FileCheck() ++ f.files = files ++ ++ results = capture_results(f) ++ my_results = get_results(results, 'umask') ++ assert my_results.results[0].result == constants.WARNING ++ assert my_results.results[0].kw.get('got') == oct(0o027) ++ assert my_results.results[0].kw.get('expected') == oct(EXPECTED_UMASK) ++ assert my_results.results[0].kw.get('type') == 'umask' ++ assert my_results.results[0].kw.get('msg') == \ ++ 'Unexpected umask 0o027 expected 0o022, skipping file permissions.' +-- +2.49.0 + diff --git a/freeipa-healthcheck.spec b/freeipa-healthcheck.spec index 973aca9..9751aff 100644 --- a/freeipa-healthcheck.spec +++ b/freeipa-healthcheck.spec @@ -17,7 +17,7 @@ Name: %{prefix}-healthcheck Version: 0.16 -Release: 9%{?dist} +Release: 10%{?dist} Summary: Health check tool for %{productname} BuildArch: noarch License: GPL-3.0-or-later @@ -41,6 +41,7 @@ Patch0013: 0013-Warn-missing-fips-file.patch Patch0014: 0014-Remove-unnecessary-timeout.patch Patch0015: 0015-Remove-unnecessary-check.patch Patch0016: 0016-Warn-if-krbLastSuccessfulAuth-replication-is-enabled.patch +Patch0017: 0017-Warn-about-unexpected-umask.patch Requires: %{name}-core = %{version}-%{release} Requires: %{prefix}-server @@ -170,6 +171,9 @@ PYTHONPATH=src PATH=$PATH:$RPM_BUILD_ROOT/usr/bin pytest-3 tests/test_* %changelog +* Tue May 27 2025 Rob Crittenden - 0.16-10 +- Warn in ipa-healthcheck if umask is not 022 (RHEL-85561) + * Mon Mar 10 2025 Rob Crittenden - 0.16-9 - Don't require fips-mode-setup for FIPS status (RHEL-67635) - Check for krbLastSuccessfulAuth being enabled (RHEL-84771)