From 768c7cd9c09dc3161490934d3b69ace9c72937af Mon Sep 17 00:00:00 2001
From: Luca Beltrame <lbeltrame@kde.org>
Date: Sun, 22 Nov 2015 15:16:50 +0100
Subject: [PATCH] Fix webroot permissions

Take them from the parent directory where the webroot is.Should fix issue #1389
---
 letsencrypt/plugins/webroot.py      | 11 +++++++++++
 letsencrypt/plugins/webroot_test.py | 12 ++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/letsencrypt/plugins/webroot.py b/letsencrypt/plugins/webroot.py
index 4e18f5ca2..4686360a7 100644
--- a/letsencrypt/plugins/webroot.py
+++ b/letsencrypt/plugins/webroot.py
@@ -41,6 +41,7 @@ and reload your daemon.
 import errno
 import logging
 import os
+import stat
 
 import zope.interface
 
@@ -98,6 +99,16 @@ to serve all files under specified web root ({0})."""
                          self.full_roots[name])
             try:
                 os.makedirs(self.full_roots[name])
+                # Set permissions as parent directory (GH #1389)
+                filemode = stat.S_IMODE(os.stat(path).st_mode)
+                os.chmod(self.full_roots[name])
+
+                # Make permissions valid for files, too
+                for root, dirs, files in os.walk(self.full_roots[name]):
+                    for filename in files:
+                    # No need for exec permissions
+                        os.chmod(filename, filemode & ~stat.S_IEXEC)
+
             except OSError as exception:
                 if exception.errno != errno.EEXIST:
                     raise errors.PluginError(
diff --git a/letsencrypt/plugins/webroot_test.py b/letsencrypt/plugins/webroot_test.py
index 902f74e9f..897c6993f 100644
--- a/letsencrypt/plugins/webroot_test.py
+++ b/letsencrypt/plugins/webroot_test.py
@@ -3,6 +3,7 @@ import os
 import shutil
 import tempfile
 import unittest
+import stat
 
 import mock
 
@@ -69,6 +70,17 @@ class AuthenticatorTest(unittest.TestCase):
         self.assertRaises(errors.PluginError, self.auth.prepare)
         os.chmod(self.path, 0o700)
 
+    def test_prepare_permissions(self):
+
+        # Remove exec bit from permission check, so that it
+        # matches the file
+        parent_permissions = (stat.S_IMODE(os.stat(self.path)) &
+                              ~stat.S_IEXEC)
+
+        actual_permissions = stat.S_IMODE(os.stat(self.validation_path))
+
+        self.assertEqual(parent_permissions, actual_permissions)
+
     def test_perform_cleanup(self):
         responses = self.auth.perform([self.achall])
         self.assertEqual(1, len(responses))