freeipa

#7288 set_directive can overwrite wrong directives
Closed: fixed Opened by ftweedal.

Closed: fixed
Reopen Issue

Issue

set_directive only checks that a lines startswith the given directive (key) before
writing the new directive. This means that any key that starts with the given key
will be clobbered and no longer exist.

This causes real problems like, e.g. the removal from Dogtag CS.cfg of the
ca.sslserver.certreq parameter when the ca.sslserver.cert directive gets
updated during Dogtag Server-Cert renewal. This causes subsequent KRA
installation failure.

Steps to Reproduce

  1. observe that the ca.sslserver.certreq key exists in CS.cfg
  2. renew the Server-Cert cert-pki-ca certificate via certmonger.
  3. observe that the ca.sslserver.certreq key no longer appears in CS.cfg.

The routine should leave alone keys that are not exactly the key to be replaced.

Metadata Update from @ftweedal:
- Issue assigned to ftweedal

Metadata Update from @ftweedal:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/1347

master:

  • 2546ef6eb0c6321da810f42d0311b7053be43d62 Prevent set_directive from clobbering other keys
  • 1b04718b3c57eed2131db018b9d4e46c8d7f7345 pep8: reduce line lengths in CAInstance.__enable_crl_publish
  • c77f3a50d7a8d4b2f1e6fb7c95115a36a4ec6daa installutils: refactor set_directive
  • f688b5d8a7ff340a4f358e99bfe219167832359e Add tests for installutils.set_directive
  • f4001e1c53a263aa6c7f62385ed394631345a34c Add safe DirectiveSetter context manager

ipa-4-6:

  • fd316b94648c9df758e7bdbe741ac84248e6987c Prevent set_directive from clobbering other keys
  • 7a29a5dc9bcabcc1683dc80f1b613e742b7d7315 pep8: reduce line lengths in CAInstance.__enable_crl_publish
  • 241b83ded0a9e6368262e3ddce2beb602685017a installutils: refactor set_directive
  • 808b14351c1a39d287690f43be344b13c4944442 Add tests for installutils.set_directive
  • 342a141225cc51d31f78810f799511d6fe310864 Add safe DirectiveSetter context manager

ipa-4-5:

  • c60fcac09fe8a6050330f2c1e0a2662896e07708 Prevent set_directive from clobbering other keys
  • 929491d75d27ad365b1c22b7ce4803dfe8364b43 pep8: reduce line lengths in CAInstance.__enable_crl_publish
  • a1a58539c9b2ff33ad90391354db03b343fc9bd5 installutils: refactor set_directive
  • d3af8f69d7ed35a87f9547e4c9fa2ffc95df5591 Add tests for installutils.set_directive
  • a70ce13da6668e14ebc113fd00fea21eb460bf56 Add safe DirectiveSetter context manager
  • 1b8710109e4729b93fd2a4ea39969fc4ed1e336f Old pylint doesn't support bad python3 option

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1512482

Issue linked to bug 1512482

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.5.5

master:

  • b7ae9f7a3f577a61c97953da7e65d09349053380 Test KRA installtion after ca agent cert renewal

ipa-4-7:

  • f3822726a630b77508801c00e59dfc1afaec549d Test KRA installtion after ca agent cert renewal
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/1347
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.