On 10.08.2011 14:57, Alexander Bokovoy wrote:
> Ensure network configuration file has proper permissions
> 
> As network configuration file is created as temporary file, it has
> stricter permissions than we need for the target system configuration
> file. Ensure permissions are properly reset before installing file.
> 
> If permissions are not reset, system may have no networking enabled
> after reboot.
One more fix: relabel SELinux label after copying file.
-- 
/ Alexander Bokovoy
From 3cdc4a2eaa6691be4660cb1239ca271cd620ecf5 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <aboko...@redhat.com>
Date: Wed, 10 Aug 2011 15:15:01 +0300
Subject: [PATCH] Ensure network configuration file has proper permissions

As network configuration file is created as temporary file, it has stricter 
permissions than
we need for the target system configuration file. Ensure permissions are 
properly reset before
installing file.

If permissions are not re-set, system may have no networking enabled after 
reboot.
---
 ipa-client/ipa-install/ipa-client-install |   10 ++++++++++
 1 files changed, 10 insertions(+), 0 deletions(-)

diff --git a/ipa-client/ipa-install/ipa-client-install 
b/ipa-client/ipa-install/ipa-client-install
index 
e3b9dfbab5975aade08ee36e98fc9a048df76784..1caf9c1ee4d0c30d1267f5bc028291a56f02e7c8
 100755
--- a/ipa-client/ipa-install/ipa-client-install
+++ b/ipa-client/ipa-install/ipa-client-install
@@ -23,6 +23,7 @@ try:
     import sys
 
     import os
+    import stat
     import time
     import socket
     import logging
@@ -564,6 +565,9 @@ $)''', re.VERBOSE)
                             statestore.backup_state('network', 'hostname', 
value)
                 new_config.write(new_line)
         new_config.flush()
+        # Make sure the resulting file is readable by others before installing 
it
+        os.fchmod(new_config.fileno(), stat.S_IRUSR | stat.S_IWUSR | 
stat.S_IRGRP | stat.S_IROTH)
+        os.fchown(new_config.fileno(), 0, 0)
 
     # At this point new_config is closed but not removed due to 'delete=False' 
above
     # Now, install the temporary file as configuration and ensure old version 
is available as .orig
@@ -574,6 +578,12 @@ $)''', re.VERBOSE)
     except CalledProcessError, e:
         print >>sys.stderr, "Failed to set this machine hostname to %s (%s)." 
% (hostname, str(e))
 
+    # For SE Linux environments it is important to reset SE labels to the 
expected ones
+    try:
+        ipautil.run(['/sbin/restorecon', network_filename])
+    except CalledProcessError, e:
+        print >>sys.stderr, "Failed to set permissions for %s (%s)." % 
(network_filename, str(e))
+
 def configure_sssd_conf(fstore, cli_realm, cli_domain, cli_server, options):
     sssdconfig = SSSDConfig.SSSDConfig()
     sssdconfig.new_config()
-- 
1.7.6

_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Reply via email to