<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 05/15/2013 11:40 AM, Ana Krivokapic
wrote:<br>
</div>
<blockquote cite="mid:519357F3.3080408@redhat.com" type="cite">
<pre wrap="">Hello,
See the commit message for details.
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/ticket/3594">https://fedorahosted.org/freeipa/ticket/3594</a>
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-devel@redhat.com">Freeipa-devel@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-devel">https://www.redhat.com/mailman/listinfo/freeipa-devel</a></pre>
</blockquote>
<br>
+ def regenerate_ca_file(self, ca_file):<br>
+ dm_pwd_fd, dm_pwd_fname = tempfile.mkstemp()<br>
+ keydb_pwd_fd, keydb_pwd_fname = tempfile.mkstemp()<br>
+<br>
+ os.write(dm_pwd_fd, self.dirman_password)<br>
+ os.close(dm_pwd_fd)<br>
+<br>
+ keydb_pwd = ''<br>
+ with open('/etc/pki/pki-tomcat/password.conf') as f:<br>
+ for line in f.readlines():<br>
+ key, value = line.strip().split('=')<br>
+ if key == 'internal':<br>
+ keydb_pwd = value<br>
+ break<br>
+<br>
+ os.write(keydb_pwd_fd, keydb_pwd)<br>
+ os.close(keydb_pwd_fd)<br>
+<br>
+ ipautil.run([<br>
+ '/usr/bin/PKCS12Export',<br>
+ '-d', '/etc/pki/pki-tomcat/alias/',<br>
+ '-p', keydb_pwd_fname,<br>
+ '-w', dm_pwd_fname,<br>
+ '-o', ca_file<br>
+ ])<br>
+<br>
<br>
If the PKCS12Export call fails (returns non-zero code), we raise
exception here, and the temporary files are never removed.<br>
<br>
+ os.remove(dm_pwd_fname)<br>
+ os.remove(keydb_pwd_fname)<br>
<br>
This might not be a big issue since mkstemp() call creates temporary
file readable and writable only be given user ID,<br>
however, we should not leave files with passwords in plaintext on
the disk if it is not necessary.<br>
<br>
This can be easily prevented by wrapping the call up with
try-chatch-finally block, or using raiseonerr=False options of run
method.<br>
<br>
Tomas<br>
</body>
</html>