dogtagpki

#802 Fix instance file permissions
Closed: Fixed Opened by edewata.

Closed: Fixed
Reopen Issue

Deploying a subsystem using "nobody" as the user & group will cause Tomcat to run as "root". Here is the deployment config:

[DEFAULT]
pki_user=nobody
pki_group=nobody
...

Deploying using "pkiuser" will work, Tomcat will run as "pkiuser", but it will generate an AVC:

type=AVC msg=audit(1384880956.935:5443): avc:  denied  { write } for  pid=10798 comm="useradd" path="/var/log/pki/pki-ca-spawn.20131119120914.log" dev="vda3" ino=418643 scontext=system_u:unconfined_r:useradd_t:s0 tcontext=system_u:object_r:pki_log_t:s0 tclass=file

One alternative is to fix it such that Tomcat runs as the specified user & group, which in this case Tomcat should run as "nobody" instead of "root".

The other alternative is to disallow "nobody", but further research should be done to make sure the same problem doesn't happen with any other users & groups.

Split this into two tickets -- this ticket will address the "nobody" issue.

The other ticket (803) addresses the avc.

It turns out in Dogtag 10.0.6 Tomcat will run as root regardless of the user specified during deployment. Because of that, some files created by Tomcat (e.g. log files) will be owned by root. After upgrading to 10.1.0, Tomcat will correctly try to run as the proper user (e.g. pkiuser) but it will fail to start because it cannot access the existing Tomcat files owned by root.

A new upgrade script may be needed to fix the file ownership.

Per discussion with mharmsen and alee, since 10.0.x is no longer developed this ticket is moved into 10.2.3 to provide an upgrade script to fix file permission issues during upgrade.

Note that there's already a script called 04-FixLogFileOwnership in base/server/upgrade/10.0.99/. We need to check whether this is sufficient, or we still need an additional script to fix the permission on other files.

The following folder is still owned by root and should be changed to pkiuser:

  • /var/lib/pki//work/Catalina/localhost/pki

Fixed in:

  • master: 33bd7720dc151fd23d36f15888411ded6b1b7c08
  • 10.2 branch: 25a834e57b092f110380f9034f289535b77dad41

Metadata Update from @edewata:
- Issue assigned to edewata
- Issue set to the milestone: 10.2.3

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/1369

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Normal
defect
Packaging
Community
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.