Merge lp:~jtv/maas/pkg-bug-1059485 into lp:~maas-maintainers/maas/packaging

[Jeroen T. Vermeulen]

Make maas_local_celery_config.py non-readable to the world at large; it contains RabbitMQ credentials. The "maas" group (under which the application should run) can still read it. Only root can write it.

Pre-imped by means of a quick sanity check on IRC. Discovered in the process that we were accidentally running the region worker as root. Julian is fixing that.

Jeroen

[Julian Edwards (julian-edwards)]

wrong target branch!

review: Needs Resubmitting

[Julian Edwards (julian-edwards)]

review: Approve

[Julian Edwards (julian-edwards)]

Oh actually this is the wrong file
You want /etc/maas/maas_local_celeryconfig_cluster.py

review: Needs Fixing

[Julian Edwards (julian-edwards)]

Argh no it's not.

review: Approve

[Raphaël Badin (rvb)]

/etc/maas/maas_local_celeryconfig_cluster.py contains the cluster UUID with is used as a key to identify the cluster controller so I think we should do the same to /etc/maas/maas_local_celeryconfig_cluster.py.

=== modified file 'debian/maas-region-controller.postinst'
--- debian/maas-region-controller.postinst	2012-09-28 21:06:45 +0000
+++ debian/maas-region-controller.postinst	2012-10-01 10:49:34 +0000
@@ -137,6 +137,11 @@
 	mkdir -p /var/lib/maas/media/storage
 	chown -R maas:maas /var/lib/maas/
 
+	# Local celery config may contain credentials, so should be readable
+	# by the application but nobody else.
+	chown root:maas /etc/maas/maas_local_celeryconfig.py
+	chmod 0640 /etc/maas/maas_local_celeryconfig.py
+
 	#########################################################
 	################  Configure Apache2  ####################
 	#########################################################