1. umask is set to 027 in /etc/login.defs

2. ipa-healthcheck keeps reverting to the wrong permissions at each ipa stop/start:

ERROR: ipahealthcheck.ipa.files.IPAFileCheck._run_ipa_services.list_mode: Permissions of /run/ipa/services.list are too restrictive: 0640 and should be 0644 

We noticed that this happened after the patching to ipa-server-4.11.0-15.el9_4.x86_64. It seems ipa-healthcheck understand 0640 to be an error but it’s what “ipactl start” wants it to be, from the strace:

openat(AT_FDCWD, "/run/ipa/services.list", O_RDONLY|O_CLOEXEC) = 5
fstat(5, {st_mode=S_IFREG|0640, st_size=89, ...}) = 0