Injected authorized_keys file permissions are too permissive

[Yaniv Kaul]

when injecting SSH keys, the permissions set file the file are too permissive:
Tested on Folsom on Red Hat, the selinux labeling seems OK, I'm not happy with the permissions though:
-rw-r--r--. root root system_u:object_r:ssh_home_t:s0 authorized_keys

Why is it world readable?

[Thierry Carrez (ttx)]

Looks fine to me. That's what the RedHat doc asks you to do:

https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/s2-ssh-configuration-keypairs.html

Please reopen if you still disagree.

[Yaniv Kaul (ykaul)]

Re-opening, I suspect it's a documentation bug. Opened https://bugzilla.redhat.com/show_bug.cgi?id=905108 about it.
http://www.openssh.org/faq.html#3.14 makes much more sense to me.

[Yaniv Kaul (ykaul)]

Not sure how to re-open (for some reason can't pick a different status).

[Thierry Carrez (ttx)]

Re-opened for you.

Do you know what mechanism you are using to inject those keys ? Cloud-init (post-boot customization) ? Or File injection (preboot customization) ?

[Yaniv Kaul (ykaul)]

I've used file injection.

[Thierry Carrez (ttx)]

Confirm that we are certainly using default mask at nova/virt/disk/api.py

[Richard Jones (rjones-redhat)]

Right .. note that in libguestfs the default umask is defined as 022.
http://libguestfs.org/guestfs.3.html#umask

If you want to make files with other permissions you either have to change
this umask (ie. call self.handle.umask somewhere), or else call self.handle.chmod
on the file afterwards.
http://libguestfs.org/guestfs.3.html#guestfs_umask
http://libguestfs.org/guestfs.3.html#guestfs_chmod

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/20663

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/20663
Committed: http://github.com/openstack/nova/commit/f57b61de71b2eaa31d889f7147968f8db4892e47
Submitter: Jenkins
Branch: master

commit f57b61de71b2eaa31d889f7147968f8db4892e47
Author: Davanum Srinivas <email address hidden>
Date: Mon Jan 28 20:23:53 2013 -0500

    Fix authorized_keys file permissions

    Explicitly set the file permissions to be 0600

    Fixes LP# 1107908

    Change-Id: Ife44deff41959180d31e7e88c29233e9b8cb0af2