[PDB-2590] /sbin/puppetdb ssl-setup breaks file permissions on /etc/puppetdb/conf.d/jetty.ini - Puppet Jira Server

XML

Word

Printable

Type: Bug
Status: Resolved
Priority: Normal
Resolution: Fixed
Affects Version/s: PDB 2.3.8
Fix Version/s: PDB 7.4.0, PDB 6.17.0
Component/s: PuppetDB
Labels:
None
Environment:

[rbhe@puppet ~]$ rpm -qa | grep puppetdb
puppetdb-terminus-2.3.8-1.el7.noarch
puppetdb-2.3.8-1.el7.noarch

Release Notes:
Security Fix
Release Notes Summary:

Hide
The ssl-setup command (which is also invoked by the PuppetDB package installation scripts) should handle ssl-related filesystem permissions more carefully. Previously it might reset them when it shouldn't have, and/or leave them briefly with incorrect, potentially overly permissive values.

Show
The ssl-setup command (which is also invoked by the PuppetDB package installation scripts) should handle ssl-related filesystem permissions more carefully. Previously it might reset them when it shouldn't have, and/or leave them briefly with incorrect, potentially overly permissive values.

The package "puppetdb" creates template /etc/puppetdb/conf.d/jetty.ini with proper permissions of puppetdb:puppetdb.

When running /sbin/puppetdb ssl-setup the file permissions change to "root" "root". If your umask is restrictive (e.g. 027) puppetdb start failes.

The attached fix keeps the original file permissions initially set via rpm.

Another note: commands should be chained with && to avoid creating "broken" config files.