File permissions of ca/CS.cfg differ if random serial numbers are enabled

[flo-renaud]

The installation of an IPA server with / without random serial numbers creates the file /var/lib/pki/pki-tomcat/conf/ca/CS.cfg with different file permissions:

• if random serial numbers are enabled: -rw-rw-r--. 1 pkiuser pkiuser 64262 Nov 25 11:07 /var/lib/pki/pki-tomcat/conf/ca/CS.cfg
• if sequential serial numbers are used: -rw-rw----. 1 pkiuser pkiuser 66148 Nov 25 11:00 /var/lib/pki/pki-tomcat/conf/ca/CS.cfg

This difference triggers a ipa-healthcheck warning when ipa server is installed with RSNv3:

  {
    "source": "ipahealthcheck.ipa.files",
    "check": "TomcatFileCheck",
    "result": "WARNING",
    "uuid": "2c476ea0-2469-4162-b572-be442c069c1d",
    "when": "20241125160214Z",
    "duration": "0.001460",
    "kw": {
      "key": "_var_lib_pki_pki-tomcat_conf_ca_CS.cfg_mode",
      "path": "/var/lib/pki/pki-tomcat/conf/ca/CS.cfg",
      "type": "mode",
      "expected": "0660",
      "got": "0664",
      "msg": "Permissions of /var/lib/pki/pki-tomcat/conf/ca/CS.cfg are too permissive: 0664 and should be 0660"
    }
  }

Reproduced with the following packages on fedora 41:
dogtag-pki-server-11.5.0-3.fc41.2.noarch
freeipa-server-4.12.2-4.fc41.x86_64
freeipa-healthcheck-0.17-4.fc41.noarch