389-ds-base

#50272 Ticket 49899 - fix pin.txt and pwdfile permissions
Closed by spichugi. Opened by firstyear.
firstyear/389-ds-base 49899-improve-permissions-nss  into  master

Download 50272.patch

Bug Description: On unix, user and group permissions are basically
the same, because users always have a primary group. However, best
practice ignores this, and states everything should be user
owned only if security sensitive.

Fix Description: Make pin.txt and pwdfile user only owned to prevent
disclosure (in limited circumstances, this is little more than
a compliance step).

https://pagure.io/389-ds-base/issue/49899

Author: William Brown william@blackhats.net.au

Review by: ???

The fix looks good, but I have not been able to verify (tests are failing from others changes in mater).

Maybe make it (and similarly the change below as well) into something like the following, so that we don't mess up expectations for any follow-up parts of the runtime:

prv_mask = ...
try:
    with ...:
        f.write(...
finally:
    prv_mask = os.umask(prv_mask)

@mhonek Yes, that is a good point, I'll add that. It would be nice if there was a "with umask:" syntax ....

rebased onto 7822b7a4c6f6d181d67a21b7897aa6bff662a94a

@mhonek I have updated this some time ago, sorry I didn't notify you. Do you mind checking again?

Sorry for the delay. Works great, thanks! :thumbsup:

rebased onto 018c8364280669acc0d420b4c7eea392958c178d

Pull-Request has been merged by firstyear

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3331

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.