fix: Create consumer cert & key, when chown failed

[jirihnidek]

• When it wasn't possible to change group of consumer key.pem, due to missing SELinux rule, then consumer cert.pem was not created. rhsm.service should write only error log message to rhsm.log in this case

[github-actions]

Coverage (computed on Fedora latest) •

File	Stmts	Miss	Cover	Missing
subscription_manager
identity.py	155	72	53%	31, 57–61, 69–76, 79, 82–83, 86–87, 91, 95, 98, 106–107, 115, 117–121, 123, 125–126, 129, 133–137, 139–140, 143–148, 151–156, 159–161, 164, 187–190, 194–195, 197, 212, 221–223, 238–240, 247
managerlib.py	406	116	71%	61–67, 98–104, 109, 113, 116, 142–147, 149–154, 212–216, 278, 280–284, 400, 408, 431, 465, 566–567, 569–573, 576–577, 581–582, 588–590, 592, 596, 598–601, 623, 625, 658, 691–693, 697–699, 702–703, 706, 729–731, 739–742, 744–747, 759–761, 763, 774, 799, 804–809, 811, 813–816, 822–823, 825, 828, 831–832, 838–839, 849–852
TOTAL	17373	4483	74%

Tests	Skipped	Failures	Errors	Time
2413	14 💤	0 ❌	0 🔥	30.726s ⏱️

[ptoscano]

Should the same checks be added to managerlib.check_identity_cert_perms() as well?

[DuckBoss]

@jirihnidek I have the same question as Pino.
I see there's cert group permissions being set in check_identity_cert_perms function.

subscription-manager/src/subscription_manager/managerlib.py

Lines 804 to 812 in 268f390

	statinfo: os.stat_result = os.stat(cert)
	if statinfo[stat.ST_UID] != 0 or statinfo[stat.ST_GID] != cert_guid:
	os.chown(cert, 0, cert_guid)
	log.warning("Corrected incorrect ownership of %s." % cert)
	mode: int = stat.S_IMODE(statinfo[stat.ST_MODE])
	if mode != ID_CERT_PERMS:
	os.chmod(cert, ID_CERT_PERMS)
	log.warning("Corrected incorrect permissions on %s." % cert)

Is this something that needs to also be updated? Otherwise, LGTM.

[jirihnidek]

@jirihnidek I have the same question as Pino. I see there's cert group permissions being set in check_identity_cert_perms function.

The permission of cert.pem and key.pem have always been set in ConsumerIdentity.write() and check_identity_cert_perms() regardless who is group owner of these files. I do not see any reason, why we should change this behavior now. The group should be able to only read the cert.pem and key.pem and it does not matter who is group owner.

subscription-manager/src/subscription_manager/managerlib.py

Lines 804 to 812 in 268f390

	statinfo: os.stat_result = os.stat(cert)
	if statinfo[stat.ST_UID] != 0 or statinfo[stat.ST_GID] != cert_guid:
	os.chown(cert, 0, cert_guid)
	log.warning("Corrected incorrect ownership of %s." % cert)
	mode: int = stat.S_IMODE(statinfo[stat.ST_MODE])
	if mode != ID_CERT_PERMS:
	os.chmod(cert, ID_CERT_PERMS)
	log.warning("Corrected incorrect permissions on %s." % cert)

Is this something that needs to also be updated? Otherwise, LGTM.

You are right that we should try to catch exception in managerlib.py. Good catch. Thanks. PR updated.

[DuckBoss]

LGTM, thanks!