Bug 277513 - security/p5-openxpki - service script resets file permissions and ownership which breaks webui
Summary: security/p5-openxpki - service script resets file permissions and ownership w...
Status: New
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-ports-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-03-05 20:14 UTC by James B. Byrne
Modified: 2024-03-05 20:16 UTC (History)
1 user (show)

See Also:
bugzilla: maintainer-feedback? (svysh.fbsd)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description James B. Byrne 2024-03-05 20:14:06 UTC 
FreeBSd-13.2p9 (jail)

Name           : p5-openxpki
Version        : 3.24.2

Using the service command to restart the openxpkid daemon results in permission and ownership changes to files and directories that render the webui unusable:

example:
```
for F in \
  "/usr/local/etc/openxpki/webui/default.conf" \
  "/usr/local/etc/openxpki/webui/" \
  "/usr/local/etc/openxpki/" \
  "/usr/local/etc/openxpki/config.d" \
  "/usr/local/etc/openxpki/local/" \
  "/var/log/openxpki/webui.log"; 
do 
  ls -ld $F; 
done

-rw-r--r--  1 openxpki  openxpki  4781 Feb 23 09:51 /usr/local/etc/openxpki/webui/default.conf
drwxr-xr-x  2 openxpki  openxpki  3 Feb 23 09:51 /usr/local/etc/openxpki/webui/
drwxr-xr-x  13 openxpki  openxpki  21 Feb 23 12:37 /usr/local/etc/openxpki/
drwxr-x---  5 openxpki  openxpki  5 Feb  7 11:29 /usr/local/etc/openxpki/config.d
drwxr-x---  3 openxpki  openxpki  3 Feb  7 11:50 /usr/local/etc/openxpki/local/
-rw-rw----  1 www  www  16601 Mar  5 13:00 /var/log/openxpki/webui.log

 openxpkictl restart
Stopping OpenXPKI
Stopping gracefully, 3 (sub)processes remaining...
DONE.
Starting OpenXPKI Community Edition v3.24.2
try/catch is experimental at /usr/local/lib/perl5/site_perl/OpenXPKI/Server/Init.pm line 103.
try/catch is experimental at /usr/local/lib/perl5/site_perl/OpenXPKI/Server/Init.pm line 107.
OpenXPKI Server is running and accepting requests.
DONE.

for F in \
  "/usr/local/etc/openxpki/webui/default.conf" \
  "/usr/local/etc/openxpki/webui/" \
  "/usr/local/etc/openxpki/" \
  "/usr/local/etc/openxpki/config.d" \
  "/usr/local/etc/openxpki/local/" \
  "/var/log/openxpki/webui.log"; 
do 
  ls -ld $F; 
done

-rw-r--r--  1 openxpki  openxpki  4781 Feb 23 09:51 /usr/local/etc/openxpki/webui/default.conf
drwxr-xr-x  2 openxpki  openxpki  3 Feb 23 09:51 /usr/local/etc/openxpki/webui/
drwxr-xr-x  13 openxpki  openxpki  21 Feb 23 12:37 /usr/local/etc/openxpki/
drwxr-x---  5 openxpki  openxpki  5 Feb  7 11:29 /usr/local/etc/openxpki/config.d
drwxr-x---  3 openxpki  openxpki  3 Feb  7 11:50 /usr/local/etc/openxpki/local/
-rw-rw----  1 www  www  16601 Mar  5 13:00 /var/log/openxpki/webui.log

service openxpki onerestart
Service dirs recreated...
Executing: USER=openxpki /usr/local/bin/openxpkictl --config /usr/local/etc/openxpki/config.d restart
Stopping OpenXPKI
Stopping gracefully, 4 (sub)processes remaining...
DONE.
Starting OpenXPKI Community Edition v3.24.2
try/catch is experimental at /usr/local/lib/perl5/site_perl/OpenXPKI/Server/Init.pm line 103.
try/catch is experimental at /usr/local/lib/perl5/site_perl/OpenXPKI/Server/Init.pm line 107.
OpenXPKI Server is running and accepting requests.
DONE.

for F in \
  "/usr/local/etc/openxpki/webui/default.conf" \
  "/usr/local/etc/openxpki/webui/" \
  "/usr/local/etc/openxpki/" \
  "/usr/local/etc/openxpki/config.d" \
  "/usr/local/etc/openxpki/local/" \
  "/var/log/openxpki/webui.log"; 
do 
  ls -ld $F; 
done
-rwxr-xr--  1 openxpki  openxpki  4781 Feb 23 09:51 /usr/local/etc/openxpki/webui/default.conf
drwxr-xr--  2 openxpki  openxpki  3 Feb 23 09:51 /usr/local/etc/openxpki/webui/
drwxr-xr--  13 openxpki  openxpki  21 Feb 23 12:37 /usr/local/etc/openxpki/
drwxr-xr--  5 openxpki  openxpki  5 Feb  7 11:29 /usr/local/etc/openxpki/config.d
drwxr-xr--  3 openxpki  openxpki  3 Feb  7 11:50 /usr/local/etc/openxpki/local/
-rw-rw----  1 openxpki  openxpki  17010 Mar  5 14:57 /var/log/openxpki/webui.log

```

Using service instead of openxpkictl results in the permissions of directories losing the o+x capability and the owner of webui.log being changed to openxpki:openxpki from www:www.

When the permissions are changed the webui fails to start and the error logged is:

webui.fcgi: Can't open config file '/usr/local/etc/openxpki/webui/default.conf' (permission denied) 

When the owner of webui.log is changed webui also fails to start and the error logged is:

webui.fcgi: Can't sysopen /var/log/openxpki/webui.log (Permission denied)