Fix webroot permissions

Take them from the parent directory where the webroot is.Should fix issue #1389

letsencrypt/plugins/webroot.py

@@ -41,6 +41,7 @@ and reload your daemon.
 import errno
 import logging
 import os
+import stat
 
 import zope.interface
 
@@ -98,6 +99,16 @@ to serve all files under specified web root ({0})."""
                          self.full_roots[name])
             try:
                 os.makedirs(self.full_roots[name])
+                # Set permissions as parent directory (GH #1389)
+                filemode = stat.S_IMODE(os.stat(path).st_mode)
+                os.chmod(self.full_roots[name])
+
+                # Make permissions valid for files, too
+                for root, dirs, files in os.walk(self.full_roots[name]):
+                    for filename in files:
+                    # No need for exec permissions
+                        os.chmod(filename, filemode & ~stat.S_IEXEC)
+
             except OSError as exception:
                 if exception.errno != errno.EEXIST:
                     raise errors.PluginError(

letsencrypt/plugins/webroot_test.py

@@ -3,6 +3,7 @@ import os
 import shutil
 import tempfile
 import unittest
+import stat
 
 import mock
 
@@ -69,6 +70,17 @@ class AuthenticatorTest(unittest.TestCase):
         self.assertRaises(errors.PluginError, self.auth.prepare)
         os.chmod(self.path, 0o700)
 
+    def test_prepare_permissions(self):
+
+        # Remove exec bit from permission check, so that it
+        # matches the file
+        parent_permissions = (stat.S_IMODE(os.stat(self.path)) &
+                              ~stat.S_IEXEC)
+
+        actual_permissions = stat.S_IMODE(os.stat(self.validation_path))
+
+        self.assertEqual(parent_permissions, actual_permissions)
+
     def test_perform_cleanup(self):
         responses = self.auth.perform([self.achall])
         self.assertEqual(1, len(responses))