Fix IPA install for secure umask

Make sure that IPA can be installed with root umask set to secure
value 077. ipa-server-install was failing in DS configuration phase
when dirsrv tried to read boot.ldif created during installation.

https://fedorahosted.org/freeipa/ticket/1282

1 files changed, 16 insertions, 12 deletions

diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install
index 7c81dbec6..019dfb1aa 100755
--- a/install/tools/ipa-server-install
+++ b/install/tools/ipa-server-install
@@ -676,18 +676,22 @@ def main():
     logging.debug("will use dns_forwarders: %s\n" % str(dns_forwarders))
 
     # Create the management framework config file and finalize api
-    fd = open("/etc/ipa/default.conf", "w")
-    fd.write("[global]\n")
-    fd.write("basedn=" + util.realm_to_suffix(realm_name) + "\n")
-    fd.write("realm=" + realm_name + "\n")
-    fd.write("domain=" + domain_name + "\n")
-    fd.write("xmlrpc_uri=https://%s/ipa/xml\n" % host_name)
-    fd.write("ldap_uri=ldapi://%%2fvar%%2frun%%2fslapd-%s.socket\n" % dsinstance.realm_to_serverid(realm_name))
-    fd.write("enable_ra=True\n")
-    if not options.selfsign:
-        fd.write("ra_plugin=dogtag\n")
-    fd.write("mode=production\n")
-    fd.close()
+    old_umask = os.umask(022)   # must be readable for httpd
+    try:
+        fd = open("/etc/ipa/default.conf", "w")
+        fd.write("[global]\n")
+        fd.write("basedn=" + util.realm_to_suffix(realm_name) + "\n")
+        fd.write("realm=" + realm_name + "\n")
+        fd.write("domain=" + domain_name + "\n")
+        fd.write("xmlrpc_uri=https://%s/ipa/xml\n" % host_name)
+        fd.write("ldap_uri=ldapi://%%2fvar%%2frun%%2fslapd-%s.socket\n" % dsinstance.realm_to_serverid(realm_name))
+        fd.write("enable_ra=True\n")
+        if not options.selfsign:
+            fd.write("ra_plugin=dogtag\n")
+        fd.write("mode=production\n")
+        fd.close()
+    finally:
+        os.umask(old_umask)
 
     api.bootstrap(**cfg)
     api.finalize()