Merge pull request #165 from agrare/write_config_database_yml_messagi…

…ng_yml_as_manageiq_user

Chown database.yml as manageiq:manageiq

lib/manageiq/appliance_console/database_configuration.rb

@@ -5,9 +5,13 @@
 require 'pathname'
 require 'fileutils'
 
+require_relative './manageiq_user_mixin'
+
 module ManageIQ
 module ApplianceConsole
   class DatabaseConfiguration
+    include ManageIQ::ApplianceConsole::ManageiqUserMixin
+
     attr_accessor :adapter, :host, :username, :database, :port, :region
     attr_reader :password
 
@@ -275,7 +279,10 @@ def validate_encryption_key!
 
     def do_save(settings)
       require 'yaml'
-      File.write(DB_YML, YAML.dump(settings))
+      File.open(DB_YML, "w") do |f|
+        f.write(YAML.dump(settings))
+        f.chown(manageiq_uid, manageiq_gid)
+      end
     end
 
     def initialize_from_hash(hash)

lib/manageiq/appliance_console/key_configuration.rb

@@ -4,13 +4,17 @@
 require 'active_support/all'
 require 'manageiq-password'
 
+require_relative './manageiq_user_mixin'
+
 module ManageIQ
 module ApplianceConsole
   CERT_DIR = ENV['KEY_ROOT'] || ManageIQ::ApplianceConsole::RAILS_ROOT.join("certs")
   KEY_FILE = "#{CERT_DIR}/v2_key".freeze
   NEW_KEY_FILE = "#{KEY_FILE}.tmp".freeze
 
   class KeyConfiguration
+    include ManageIQ::ApplianceConsole::ManageiqUserMixin
+
     attr_accessor :host, :login, :password, :key_path, :action, :force
 
     def initialize(options = {})
@@ -89,14 +93,17 @@ def fetch_key?
     end
 
     def create_key
-      ManageIQ::Password.generate_symmetric(NEW_KEY_FILE) && true
+      return unless !!ManageIQ::Password.generate_symmetric(NEW_KEY_FILE)
+
+      File.chown(manageiq_uid, manageiq_gid, NEW_KEY_FILE)
     end
 
     def fetch_key
       # use :verbose => 1 (or :debug for later versions) to see actual errors
       Net::SCP.start(host, login, :password => password) do |scp|
         scp.download!(key_path, NEW_KEY_FILE)
       end
+      File.chown(manageiq_uid, manageiq_gid, NEW_KEY_FILE)
       File.exist?(NEW_KEY_FILE)
     rescue => e
       say("Failed to fetch key: #{e.message}")

lib/manageiq/appliance_console/manageiq_user_mixin.rb

@@ -0,0 +1,15 @@
+module ManageIQ
+  module ApplianceConsole
+    module ManageiqUserMixin
+      extend ActiveSupport::Concern
+
+      def manageiq_uid
+        @manageiq_uid ||= Process::UID.from_name("manageiq")
+      end
+
+      def manageiq_gid
+        @manageiq_gid ||= Process::GID.from_name("manageiq")
+      end
+    end
+  end
+end

lib/manageiq/appliance_console/message_configuration.rb

@@ -1,9 +1,13 @@
 require 'active_support/core_ext/module/delegation'
 require 'pathname'
 
+require_relative './manageiq_user_mixin'
+
 module ManageIQ
   module ApplianceConsole
     class MessageConfiguration
+      include ManageIQ::ApplianceConsole::ManageiqUserMixin
+
       attr_reader :message_keystore_username, :message_keystore_password,
                   :message_server_host, :message_server_port,
                   :miq_config_dir_path, :config_dir_path, :sample_config_dir_path,
@@ -116,7 +120,10 @@ def configure_messaging_yaml
           messaging_yaml["production"]["security.protocol"] = "PLAINTEXT"
         end
 
-        File.write(messaging_yaml_path, messaging_yaml.to_yaml)
+        File.open(messaging_yaml_path, "w") do |f|
+          f.write(messaging_yaml.to_yaml)
+          f.chown(manageiq_uid, manageiq_gid)
+        end
       end
 
       def remove_installed_files

spec/key_configuration_spec.rb

@@ -1,4 +1,9 @@
 describe ManageIQ::ApplianceConsole::KeyConfiguration do
+  before do
+    allow(Process::UID).to receive(:from_name).with("manageiq").and_return(Process.uid)
+    allow(Process::GID).to receive(:from_name).with("manageiq").and_return(Process.gid)
+  end
+
   context "#ask_questions" do
     subject { Class.new(described_class).tap { |c| c.include(ManageIQ::ApplianceConsole::Prompts) }.new }
 
@@ -63,6 +68,7 @@
           expect(Net::SCP).to receive(:start).with(host, "root", :password => password)
           expect(FileUtils).to receive(:mv).with(/v2_key\.tmp/, /v2_key$/, :force=>true).and_return(true)
           expect(FileUtils).to receive(:chmod).with(0o400, /v2_key/).and_return(["v2_key"])
+          expect(File).to receive(:chown).with(Process.uid, Process.gid, /v2_key\.tmp/)
           expect(subject.activate).to be_truthy
         end
 
@@ -72,6 +78,7 @@
           expect(ManageIQ::Password).to receive(:generate_symmetric).and_return(154)
           expect(FileUtils).to receive(:mv).with(/v2_key\.tmp/, /v2_key$/, :force=>true).and_return(true)
           expect(FileUtils).to receive(:chmod).with(0o400, /v2_key/).and_return(["v2_key"])
+          expect(File).to receive(:chown).with(Process.uid, Process.gid, /v2_key\.tmp/).and_return(0)
           expect(subject.activate).to be_truthy
         end
       end
@@ -86,6 +93,7 @@
           expect(Net::SCP).to receive(:start).with(host, "root", :password => password).and_yield(scp).and_return(true)
           expect(FileUtils).to receive(:mv).with(/v2_key\.tmp/, /v2_key$/, :force=>true).and_return(true)
           expect(FileUtils).to receive(:chmod).with(0o400, /v2_key/).and_return(["v2_key"])
+          expect(File).to receive(:chown).with(Process.uid, Process.gid, /v2_key\.tmp/)
           expect(subject.activate).to be_truthy
         end
 

spec/message_configuration_client_spec.rb

@@ -27,6 +27,9 @@
 
     FileUtils.mkdir_p("#{@tmp_base_dir}/config")
     FileUtils.mkdir_p("#{@tmp_base_dir}/config-sample")
+
+    allow(Process::UID).to receive(:from_name).with("manageiq").and_return(Process.uid)
+    allow(Process::GID).to receive(:from_name).with("manageiq").and_return(Process.gid)
   end
 
   after do
@@ -268,7 +271,7 @@
 
     shared_examples "messaging yaml file" do
       it "creates the messaging yaml file" do
-        expect(subject.send(:configure_messaging_yaml)).to be_positive
+        subject.send(:configure_messaging_yaml)
         expect(subject.messaging_yaml_path).to exist
       end
 
@@ -280,7 +283,12 @@
       end
 
       it "correctly populates the messaging yaml file" do
-        expect(File).to receive(:write).with(subject.messaging_yaml_path, content)
+        allow(File).to receive(:open).and_call_original
+
+        file_stub = double("File")
+        expect(File).to receive(:open).with(subject.messaging_yaml_path, "w").and_yield(file_stub)
+        expect(file_stub).to receive(:write).with(content)
+        expect(file_stub).to receive(:chown).with(Process.uid, Process.gid)
         expect(subject.send(:configure_messaging_yaml)).to be_nil
       end
     end