Broker keyfile world-readable

[linsomniac]

For Confluent Enterprise Support customers, we would strongly advise you to open a Support ticket which will be addressed within your Support contract SLA at https://support.confluent.io

Describe the issue
After an install of Confluent Platform 7.5.3, the /var/lib/private/kafka_broker.key file is world-readable. Looks like the 7.6 branch also has the same issue.

To Reproduce

• Enable mutual TLS auth (specifically ssl_mutual_auth_enabled)
• Install kafka broker.
• See /var/ssl/private/kafka_broker.key permissions

Expected behaviour
It would be nice if the private key file were more restricted.

Inventory File
N/A

Logs
N/A

Environment (please complete the following information):

• OS: Ubuntu 20.04
• CP-Ansible Branch: 7.5.3-post
• Ansible Version ~2.16.0

Additional context
Permissions on the /var/ssl/private/kafka_broker.key file are
publicly readable. Upon further investigation it looks to be
conditional, dependent on
ssl_provided_keystore_and_truststore_remote_src, and if that is
set to false, the keystore is protected.

It seems like in any case you'd want it to be protected.

Specifically, this looks like in 7.5.3 it is related to the setting ssl_mutual_auth_enabled and in 7.6.1 the ssl_provided_keystore_and_trustore_remote_src setting. The block in question is, in 7.6.1-post:

- name: Set Truststore and Keystore File Permissions
  file:
    path: "{{item}}"
    owner: "{{user}}"
    group: "{{group}}"
    mode: '640'
  loop:
    - "{{keystore_path}}"
    - "{{truststore_path}}"
  when: not ( ssl_provided_keystore_and_truststore_remote_src|bool )

In reading the git history (and checking back in 6.2.15-post where the 640 permission was last changed from int to string), I'm under the impression that the "when" condition was blanket applied to the tasks in this role, when it probably shouldn't have been applied to this permission setting. In 7.5.3, this when condition was when: export_certs|bool where export_certs: "{{ssl_mutual_auth_enabled}}"