diff options
| author | Simo Sorce <simo@redhat.com> | 2016-08-16 09:03:19 -0400 |
|---|---|---|
| committer | Jan Cholasta <jcholast@redhat.com> | 2017-02-15 07:13:37 +0100 |
| commit | 4fd89833ee5421b05c10329d627d0e0fc8496046 (patch) | |
| tree | f6b6eb3492859af483d3e9542253f0894ca11043 /ipaserver/install/server | |
| parent | c2b1b2a36200b50babfda1eca37fb4b51fefa9c6 (diff) | |
| download | freeipa-4fd89833ee5421b05c10329d627d0e0fc8496046.tar.gz freeipa-4fd89833ee5421b05c10329d627d0e0fc8496046.tar.xz freeipa-4fd89833ee5421b05c10329d627d0e0fc8496046.zip | |
Add a new user to run the framework code
Add the apache user the ipawebui group.
Make the ccaches directory owned by the ipawebui group and make
mod_auth_gssapi write the ccache files as r/w by the apache user and
the ipawebui group.
Fix tmpfiles creation ownership and permissions to allow the user to
access ccaches files.
The webui framework now works as a separate user than apache, so the certs
used to access the dogtag instance need to be usable by this new user as well.
Both apache and the webui user are in the ipawebui group, so use that.
https://fedorahosted.org/freeipa/ticket/5959
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Diffstat (limited to 'ipaserver/install/server')
| -rw-r--r-- | ipaserver/install/server/install.py | 3 | ||||
| -rw-r--r-- | ipaserver/install/server/replicainstall.py | 4 | ||||
| -rw-r--r-- | ipaserver/install/server/upgrade.py | 1 |
3 files changed, 6 insertions, 2 deletions
diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py index 666e2a536..0b3ea4786 100644 --- a/ipaserver/install/server/install.py +++ b/ipaserver/install/server/install.py @@ -38,7 +38,7 @@ from ipaserver.install import ( from ipaserver.install.installutils import ( IPA_MODULES, BadHostError, get_fqdn, get_server_ip_address, is_ipa_configured, load_pkcs12, read_password, verify_fqdn, - update_hosts_file) + update_hosts_file, create_ipaapi_user) if six.PY3: unicode = str @@ -710,6 +710,7 @@ def install(installer): update_hosts_file(ip_addresses, host_name, fstore) # Make sure tmpfiles dir exist before installing components + create_ipaapi_user() tasks.create_tmpfiles_dirs() # create NSS Databases diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py index f0b04523c..018cebcd9 100644 --- a/ipaserver/install/server/replicainstall.py +++ b/ipaserver/install/server/replicainstall.py @@ -40,7 +40,8 @@ from ipaserver.install import ( installutils, kra, krbinstance, ntpinstance, otpdinstance, custodiainstance, service) from ipaserver.install.installutils import ( - create_replica_config, ReplicaConfig, load_pkcs12, is_ipa_configured) + create_replica_config, ReplicaConfig, load_pkcs12, is_ipa_configured, + create_ipaapi_user) from ipaserver.install.replication import ( ReplicationManager, replica_conn_check) import SSSDConfig @@ -1305,6 +1306,7 @@ def install(installer): ccache = os.environ['KRB5CCNAME'] # Make sure tmpfiles dir exist before installing components + create_ipaapi_user() tasks.create_tmpfiles_dirs() if promote: diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py index f116e856a..509f19647 100644 --- a/ipaserver/install/server/upgrade.py +++ b/ipaserver/install/server/upgrade.py @@ -1807,6 +1807,7 @@ def upgrade_check(options): def upgrade(): # Do this early so that any code depending on these dirs will not fail + installutils.create_ipaapi_user() tasks.create_tmpfiles_dirs() tasks.configure_tmpfiles() |