Backport fixes for a couple more critical F27 Beta issues

473ddbdb66e563d93a30ac51b1ac559adbd18190.patch

@@ -0,0 +1,26 @@
+From 473ddbdb66e563d93a30ac51b1ac559adbd18190 Mon Sep 17 00:00:00 2001
+From: Alexander Bokovoy <abokovoy@redhat.com>
+Date: Sep 13 2017 14:53:32 +0000
+Subject: dsinstance: Restore context after changing dse.ldif
+
+
+Fixes https://pagure.io/freeipa/issue/7150
+
+Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
+Reviewed-By: Rob Crittenden <rcritten@redhat.com>
+
+---
+
+diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py
+index d823635..3eeb7f7 100644
+--- a/ipaserver/install/dsinstance.py
++++ b/ipaserver/install/dsinstance.py
+@@ -596,6 +596,7 @@ class DsInstance(service.Service):
+                 parser.parse()
+             new_dse_ldif.flush()
+         shutil.copy2(temp_filename, dse_filename)
++        tasks.restore_context(dse_filename)
+         try:
+             os.remove(temp_filename)
+         except OSError as e:
+

ba4386599331cf81d222687d658f5ce54e923478.patch

@@ -0,0 +1,29 @@
+From ba4386599331cf81d222687d658f5ce54e923478 Mon Sep 17 00:00:00 2001
+From: Stanislav Laznicka <slaznick@redhat.com>
+Date: Sep 13 2017 10:41:36 +0000
+Subject: client: fix retrieving certs from HTTP
+
+
+We're applying bytes regex on the result of a command but were
+using decoded stdout instead of raw.
+
+https://pagure.io/freeipa/issue/7131
+
+Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
+
+---
+
+diff --git a/ipaclient/install/client.py b/ipaclient/install/client.py
+index e971aea..8d70519 100644
+--- a/ipaclient/install/client.py
++++ b/ipaclient/install/client.py
+@@ -1615,7 +1615,7 @@ def get_ca_certs_from_http(url, warn=True):
+         result = run([paths.BIN_CURL, "-o", "-", url], capture_output=True)
+     except CalledProcessError:
+         raise errors.NoCertificateError(entry=url)
+-    stdout = result.output
++    stdout = result.raw_output
+ 
+     try:
+         certs = x509.load_certificate_list(stdout)
+

freeipa.spec

@@ -68,7 +68,7 @@
 
 Name:           freeipa
 Version:        %{VERSION}
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 Group:          System Environment/Base
@@ -83,6 +83,15 @@ Patch0001:      0001-Workarounds-for-SELinux-execmem-violations-in-crypto.patch
 # https://github.com/freeipa/freeipa/pull/1044
 # https://bugzilla.redhat.com/show_bug.cgi?id=1488640
 Patch0002:      1044.patch
+# Restore context after changing dse.ldif in ipa-server-install
+# https://github.com/freeipa/freeipa/pull/1062
+# https://pagure.io/freeipa/c/473ddbdb66e563d93a30ac51b1ac559adbd18190
+Patch0003:      473ddbdb66e563d93a30ac51b1ac559adbd18190.patch
+# Fix issue with CA cert retrieval via HTTP (kickstart client enrolment):
+# https://github.com/freeipa/freeipa/pull/1071
+# https://pagure.io/freeipa/c/ba4386599331cf81d222687d658f5ce54e923478
+# https://bugzilla.redhat.com/show_bug.cgi?id=1491056
+Patch0004:      ba4386599331cf81d222687d658f5ce54e923478.patch
 
 # For the timestamp trick in patch application
 BuildRequires:  diffstat
@@ -1717,6 +1726,10 @@ fi
 %endif # with_ipatests
 
 %changelog
+* Wed Sep 13 2017 Adam Williamson <awilliam@redhat.com> - 4.6.0-3
+- Fixes #1490762 Ipa-server-install update dse.ldif with wrong SELinux context
+- Fixes #1491056 FreeIPA enrolment via kickstart fails
+
 * Wed Sep 06 2017 Adam Williamson <awilliam@redhat.com> - 4.6.0-2
 - Fixes #1488640 "unknown command 'undefined'" error when changing password in web UI
 - BuildRequires diffstat (for the use in patch application)