freeipa

#7193 [RFE] Warn or adjust umask if it is too restrictive to break installation
Closed: fixed by fcami. Opened by pvoborni.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1485217

Description of problem:
If the umask used during the installation is "too restrictive", ie.0027 the
installer will complete the installation successfully but at the end it won't
work fine, please could you add in the ipa-*-install scripts the umask 0022 to
the argument of the command invocation?
Version-Release number of selected component (if applicable):
4.5 or older
How reproducible:
set the umask to something like 0027 and install a client or a server.
Steps to Reproduce:
1. umask 0027
2. ipa-*-install
3. after the installation has finished try to use it normally, certain parts
won't work as expected.
Actual results:
The installation claims it has succeeded but the setup doesn't work correctly
Expected results:
The installer sets internall a valid umask when it launches the commands.
Additional info:

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1485217

Metadata Update from @pvoborni:
- Issue priority set to: normal

https://github.com/freeipa/freeipa/pull/1262 addresses a similar issue with umask in ipa-restore. The ticket hasn't been backported to 4.6 yet.

As this could be a quite demanding development&testing work (including fixing and testing FreeIPA and all it's components like Dogtag), the latest suggestion was to only warn during installation if incompatible umask is set or to alternatively adjust to working value it for the installation itself.

Thus changing the title for this "cheap fix".

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/2872
- Issue assigned to fcami
- Issue set to the milestone: FreeIPA 4.6.5 (was: Future Releases)

master:

  • f2e7c3f68b691f180acd201a81fe10c7c1491071 ipatests: add too-restritive mask tests
  • f90a4b9554656c984c8ac47e3503d83fb52d0b1f ipa-{server,replica}-install: add too-restritive mask detection

Metadata Update from @fcami:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-6:

  • d37afbcd38a75bb4892c4ce2ef0836feaada23a2 ipatests: add too-restritive mask tests
  • c6e6a7afd3e14cecb3b9d993b4384e8ac301fe9a ipa-{server,replica}-install: add too-restritive mask detection

ipa-4-7:

  • 270ccca746c4818d4f324f0c166ed53012f87e83 ipatests: add too-restritive mask tests
  • d82388bc6e211b7cb98d629c925e84f06cfb4e71 ipa-{server,replica}-install: add too-restritive mask detection
Metadata
None
None
None
Normal
https://github.com/freeipa/freeipa/pull/2872
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.