From 89b2137dc257dfe3db0ff097e6c797223c2b5664 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Fri, 22 Jun 2018 12:25:33 +0200 Subject: [PATCH] Make /etc/httpd/alias world readable & executable The directory /etc/httpd/alias contains public key material. It must be world readable and executable, so any client can read public certs. Note: executable for a directory means, that a process is allowed to traverse into the directory. Fixes: https://pagure.io/freeipa/issue/7594 Signed-off-by: Christian Heimes Reviewed-By: Tibor Dudlak Reviewed-By: Rob Crittenden --- ipaserver/install/httpinstance.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py index c1ce6ea42..3ab78697e 100644 --- a/ipaserver/install/httpinstance.py +++ b/ipaserver/install/httpinstance.py @@ -181,7 +181,8 @@ class HTTPInstance(service.Service): session_dir = os.path.dirname(self.sub_dict['GSSAPI_SESSION_KEY']) if not os.path.isdir(session_dir): os.makedirs(session_dir) - os.chmod(session_dir, 0o755) + # Must be world-readable / executable + os.chmod(session_dir, 0o755) target_fname = paths.HTTPD_IPA_CONF http_txt = ipautil.template_file(