From 4b97d5773cf58617f178d1a1206656e0ee8a6d37 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Mon, 22 Dec 2025 17:21:27 +0100 Subject: [PATCH] Fix issue with restoring SELinux file label Resolves: RHEL-78631 --- ...fix-issues-if-default-keytab-is-used.patch | 117 ++++++++++++++++++ adcli.spec | 7 +- 2 files changed, 123 insertions(+), 1 deletion(-) create mode 100644 0001-enroll-fix-issues-if-default-keytab-is-used.patch diff --git a/0001-enroll-fix-issues-if-default-keytab-is-used.patch b/0001-enroll-fix-issues-if-default-keytab-is-used.patch new file mode 100644 index 0000000..953b97a --- /dev/null +++ b/0001-enroll-fix-issues-if-default-keytab-is-used.patch @@ -0,0 +1,117 @@ +From 9c31bb06590f2d96a2d6d8ce87dc3273c283a671 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Fri, 19 Dec 2025 14:48:13 +0100 +Subject: [PATCH] enroll: fix issues if default keytab is used + +librkb5 returns the default keytab with a 'FILE:' prefix which must be +removed before calling libselinux functions to operate on the keytab +file. + +Resolves: https://issues.redhat.com/browse/RHEL-78631 +--- + library/adenroll.c | 32 ++++++++++++++++++++------------ + library/adenroll.h | 3 +-- + tools/computer.c | 6 +++--- + 3 files changed, 24 insertions(+), 17 deletions(-) + +diff --git a/library/adenroll.c b/library/adenroll.c +index 20ad198..9484cbf 100644 +--- a/library/adenroll.c ++++ b/library/adenroll.c +@@ -2116,30 +2116,38 @@ ensure_host_keytab (adcli_result res, + return ADCLI_SUCCESS; + } + +-adcli_result +-ensure_host_keytab_selinux_context (adcli_result res, +- adcli_enroll *enroll) ++void ++restore_host_keytab_selinux_context (adcli_enroll *enroll) + { + #ifdef BUILD_SELINUX_POLICY + int ret; +- +- if (res != ADCLI_SUCCESS) +- return res; ++ krb5_context k5; ++ const char *name_start; + + if (enroll->keytab_name == NULL) { + _adcli_info ("No keytab name available, skipping SELinux restorecon."); +- return ADCLI_SUCCESS; ++ return; ++ } ++ ++ name_start = enroll->keytab_name; ++ if (strncmp (name_start, "FILE:", 5) == 0) { ++ name_start = enroll->keytab_name + 5; + } + +- ret = selinux_restorecon (adcli_enroll_get_keytab_name (enroll), 0); ++ if (enroll->keytab != NULL) { ++ k5 = adcli_conn_get_krb5_context (enroll->conn); ++ krb5_kt_close (k5, enroll->keytab); ++ enroll->keytab = NULL; ++ } ++ ++ ret = selinux_restorecon (name_start, 0); + if (ret != 0) { +- _adcli_err ("Failed to set SELinux context for %s with error %d: %s", +- enroll->keytab_name, ret, strerror (ret)); +- return ADCLI_ERR_FAIL; ++ _adcli_err ("Failed to set SELinux context for %s with error %d: %s, ignored", ++ name_start, ret, strerror (errno)); + } + #endif + +- return ADCLI_SUCCESS; ++ return; + } + + +diff --git a/library/adenroll.h b/library/adenroll.h +index 79eb7a8..5aba81b 100644 +--- a/library/adenroll.h ++++ b/library/adenroll.h +@@ -192,6 +192,5 @@ void adcli_enroll_set_samba_data_tool (adcli_enroll *enroll, + + const char * adcli_enroll_get_samba_data_tool (adcli_enroll *enroll); + +-adcli_result ensure_host_keytab_selinux_context (adcli_result res, +- adcli_enroll *enroll); ++void restore_host_keytab_selinux_context (adcli_enroll *enroll); + #endif /* ADENROLL_H_ */ +diff --git a/tools/computer.c b/tools/computer.c +index ee027dc..f056366 100644 +--- a/tools/computer.c ++++ b/tools/computer.c +@@ -520,7 +520,7 @@ adcli_tool_computer_join (adcli_conn *conn, + else if (show_password) + dump_password (conn, enroll); + +- ensure_host_keytab_selinux_context (ADCLI_SUCCESS, enroll); ++ restore_host_keytab_selinux_context (enroll); + + adcli_enroll_unref (enroll); + +@@ -655,7 +655,7 @@ adcli_tool_computer_update (adcli_conn *conn, + else if (show_password) + dump_password (conn, enroll); + +- ensure_host_keytab_selinux_context (ADCLI_SUCCESS, enroll); ++ restore_host_keytab_selinux_context (enroll); + + adcli_enroll_unref (enroll); + +@@ -1275,7 +1275,7 @@ adcli_tool_computer_managed_service_account (adcli_conn *conn, + else if (show_password) + dump_password (conn, enroll); + +- ensure_host_keytab_selinux_context (ADCLI_SUCCESS, enroll); ++ restore_host_keytab_selinux_context (enroll); + + adcli_enroll_unref (enroll); + +-- +2.52.0 + diff --git a/adcli.spec b/adcli.spec index d0ccac5..f1db682 100644 --- a/adcli.spec +++ b/adcli.spec @@ -4,12 +4,14 @@ Name: adcli Version: 0.9.3.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Active Directory enrollment License: LGPL-2.1-or-later URL: https://gitlab.freedesktop.org/realmd/adcli Source0: https://gitlab.freedesktop.org/-/project/1196/uploads/5a1c55410c0965835b81fbd28d820d46/adcli-%{version}.tar.gz +Patch1: 0001-enroll-fix-issues-if-default-keytab-is-used.patch + BuildRequires: gcc BuildRequires: intltool pkgconfig BuildRequires: libtool @@ -126,6 +128,9 @@ documentation. %endif %changelog +* Mon Dec 22 2025 Sumit Bose - 0.9.3.1-3 +- Fix issue with restoring SELinux file label + * Wed Dec 17 2025 Sumit Bose - 0.9.3.1-2 - Use selinux_requires_min to avoid policycoreutils-python-utils dependency Resolves: RHEL-78631