rpms
/
ipa
7
0
Fork 0
Code Issues Pull Requests Releases Activity
ipa/SOURCES/0019-SELinux-add-dedicated-...

550 lines
19 KiB
Diff
Raw Blame History

From 52929cbadf0252fcac1019b74663a2808061ea1b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
Date: Thu, 17 Sep 2020 11:30:45 +0200
Subject: [PATCH] ipatests: enhance TestSubCAkeyReplication
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
enhance the test suite so that it covers:
- deleting subCAs (disabling them first)
- checking what happens when creating a dozen+ subCAs at a time
- adding a subCA that already exists and expect failure
Related: https://pagure.io/freeipa/issue/8488
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
---
.../test_replica_promotion.py | 52 +++++++++++++++++--
1 file changed, 47 insertions(+), 5 deletions(-)
diff --git a/ipatests/test_integration/test_replica_promotion.py b/ipatests/test_integration/test_replica_promotion.py
index 82117054f..f0b72e1f8 100644
--- a/ipatests/test_integration/test_replica_promotion.py
+++ b/ipatests/test_integration/test_replica_promotion.py
@@ -474,17 +474,35 @@ class TestSubCAkeyReplication(IntegrationTest):
SERVER_CERT_NICK: 'u,u,u',
}
- def add_subca(self, host, name, subject):
+ def add_subca(self, host, name, subject, raiseonerr=True):
result = host.run_command([
'ipa', 'ca-add', name,
'--subject', subject,
- '--desc', self.SUBCA_DESC,
+ '--desc', self.SUBCA_DESC],
+ raiseonerr=raiseonerr
+ )
+ if raiseonerr:
+ assert "ipa: ERROR:" not in result.stderr_text
+ auth_id = "".join(re.findall(AUTH_ID_RE, result.stdout_text))
+ return '{} {}'.format(IPA_CA_NICKNAME, auth_id)
+ else:
+ assert "ipa: ERROR:" in result.stderr_text
+ assert result.returncode != 0
+ return result
+
+ def del_subca(self, host, name):
+ host.run_command([
+ 'ipa', 'ca-disable', name
])
- auth_id = "".join(re.findall(AUTH_ID_RE, result.stdout_text))
- return '{} {}'.format(IPA_CA_NICKNAME, auth_id)
+ result = host.run_command([
+ 'ipa', 'ca-del', name
+ ])
+ assert "Deleted CA \"{}\"".format(name) in result.stdout_text
def check_subca(self, host, name, cert_nick):
- host.run_command(['ipa', 'ca-show', name])
+ result = host.run_command(['ipa', 'ca-show', name])
+ # ipa ca-show returns 0 even if the cert cannot be found locally.
+ assert "ipa: ERROR:" not in result.stderr_text
tasks.run_certutil(
host, ['-L', '-n', cert_nick], paths.PKI_TOMCAT_ALIAS_DIR
)
@@ -627,6 +645,30 @@ class TestSubCAkeyReplication(IntegrationTest):
ssl = replica.run_command(ssl_cmd)
assert 'Issuer: CN = {}'.format(self.SUBCA_MASTER) in ssl.stdout_text
+ def test_del_subca_master_on_replica(self):
+ self.del_subca(self.replicas[0], self.SUBCA_MASTER)
+
+ def test_del_subca_replica(self):
+ self.del_subca(self.replicas[0], self.SUBCA_REPLICA)
+
+ def test_scale_add_subca(self):
+ master = self.master
+ replica = self.replicas[0]
+
+ subcas = {}
+ for i in range(0, 16):
+ name = "_".join((self.SUBCA_MASTER, str(i)))
+ cn = "_".join((self.SUBCA_MASTER_CN, str(i)))
+ subcas[name] = self.add_subca(master, name, cn)
+ self.add_subca(master, name, cn, raiseonerr=False)
+
+ # give replication some time
+ time.sleep(15)
+
+ for name in subcas:
+ self.check_subca(replica, name, subcas[name])
+ self.del_subca(replica, name)
+
class TestReplicaInstallCustodia(IntegrationTest):
"""
--
2.26.2
From 5a5962426d8174212f0b7efef1a9e53aaecb5901 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
Date: Fri, 18 Sep 2020 11:55:37 +0200
Subject: [PATCH] SELinux: Add dedicated policy for ipa-pki-retrieve-key
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Add proper labeling, transition and policy for ipa-pki-retrieve-key.
Make sure tomcat_t can execute ipa-pki-retrieve-key.
Fixes: https://pagure.io/freeipa/issue/8488
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
---
selinux/ipa.fc | 1 +
selinux/ipa.te | 28 ++++++++++++++++++++++++++++
2 files changed, 29 insertions(+)
diff --git a/selinux/ipa.fc b/selinux/ipa.fc
index a98cc4665..1176f383c 100644
--- a/selinux/ipa.fc
+++ b/selinux/ipa.fc
@@ -30,5 +30,6 @@
/usr/libexec/ipa/custodia/ipa-custodia-pki-tomcat -- gen_context(system_u:object_r:ipa_custodia_pki_tomcat_exec_t,s0)
/usr/libexec/ipa/custodia/ipa-custodia-pki-tomcat-wrapped -- gen_context(system_u:object_r:ipa_custodia_pki_tomcat_exec_t,s0)
/usr/libexec/ipa/custodia/ipa-custodia-ra-agent -- gen_context(system_u:object_r:ipa_custodia_ra_agent_exec_t,s0)
+/usr/libexec/ipa/ipa-pki-retrieve-key -- gen_context(system_u:object_r:ipa_pki_retrieve_key_exec_t,s0)
/var/log/ipa-custodia.audit.log(/.*)? -- gen_context(system_u:object_r:ipa_custodia_log_t,s0)
diff --git a/selinux/ipa.te b/selinux/ipa.te
index 3fa4ba980..26daed293 100644
--- a/selinux/ipa.te
+++ b/selinux/ipa.te
@@ -75,6 +75,9 @@ files_tmp_file(ipa_custodia_tmp_t)
type pki_tomcat_cert_t;
type node_t;
+type ipa_pki_retrieve_key_exec_t;
+init_script_file(ipa_pki_retrieve_key_exec_t)
+
########################################
#
# ipa_otpd local policy
@@ -412,3 +415,28 @@ optional_policy(`
optional_policy(`
systemd_private_tmp(ipa_custodia_tmp_t)
')
+
+optional_policy(`
+ gen_require(`
+ type tomcat_t;
+ ')
+ can_exec(tomcat_t, ipa_pki_retrieve_key_exec_t)
+ pki_manage_tomcat_etc_rw(ipa_pki_retrieve_key_exec_t)
+')
+
+optional_policy(`
+ gen_require(`
+ type devlog_t;
+ ')
+
+ dontaudit ipa_custodia_t devlog_t:lnk_file read_lnk_file_perms;
+')
+
+optional_policy(`
+ java_exec(ipa_custodia_pki_tomcat_exec_t)
+ # allow Java to read system status and RNG
+ dev_read_urand(ipa_custodia_t)
+ dev_read_rand(ipa_custodia_t)
+ kernel_read_network_state(ipa_custodia_t)
+ dev_read_sysfs(ipa_custodia_t)
+')
--
2.26.2
From c126610ea6605a1ff36cecf2e2f5b2cb97130831 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
Date: Fri, 18 Sep 2020 17:45:39 +0200
Subject: [PATCH] SELinux Policy: let custodia_t map custodia_tmp_t
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This is used by the JVM perf counters.
Related: https://pagure.io/freeipa/issue/8488
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
---
selinux/ipa.te | 1 +
1 file changed, 1 insertion(+)
diff --git a/selinux/ipa.te b/selinux/ipa.te
index 26daed293..0a9ccaf83 100644
--- a/selinux/ipa.te
+++ b/selinux/ipa.te
@@ -347,6 +347,7 @@ logging_log_filetrans(ipa_custodia_t, ipa_custodia_log_t, { dir file })
manage_dirs_pattern(ipa_custodia_t, ipa_custodia_tmp_t, ipa_custodia_tmp_t)
manage_files_pattern(ipa_custodia_t, ipa_custodia_tmp_t, ipa_custodia_tmp_t)
+mmap_exec_files_pattern(ipa_custodia_t, ipa_custodia_tmp_t, ipa_custodia_tmp_t)
files_tmp_filetrans(ipa_custodia_t, ipa_custodia_tmp_t, { dir file })
kernel_dgram_send(ipa_custodia_t)
--
2.26.2
From 310dbd6eec337f0747d73fa87363083a742fc5dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
Date: Mon, 21 Sep 2020 11:32:52 +0200
Subject: [PATCH] SELinux Policy: ipa_pki_retrieve_key_exec_t =>
ipa_pki_retrieve_key_t
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Grant pki_manage_tomcat_etc_rw to ipa_pki_retrieve_key_t instead of
ipa_pki_retrieve_key_exec_t.
As suggested by Ondrej Mosnáček.
Fixes: https://pagure.io/freeipa/issue/8488
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
---
selinux/ipa.te | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/selinux/ipa.te b/selinux/ipa.te
index 0a9ccaf83..92a3b2359 100644
--- a/selinux/ipa.te
+++ b/selinux/ipa.te
@@ -78,6 +78,8 @@ type node_t;
type ipa_pki_retrieve_key_exec_t;
init_script_file(ipa_pki_retrieve_key_exec_t)
+type ipa_pki_retrieve_key_t;
+
########################################
#
# ipa_otpd local policy
@@ -422,7 +424,7 @@ optional_policy(`
type tomcat_t;
')
can_exec(tomcat_t, ipa_pki_retrieve_key_exec_t)
- pki_manage_tomcat_etc_rw(ipa_pki_retrieve_key_exec_t)
+ pki_manage_tomcat_etc_rw(ipa_pki_retrieve_key_t)
')
optional_policy(`
--
2.26.2
From 0518c63768b50973f3d3129547f5b4b95335f4a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
Date: Mon, 21 Sep 2020 11:37:12 +0200
Subject: [PATCH] SELinux Policy: ipa_custodia_pki_tomcat_exec_t =>
ipa_custodia_pki_tomcat_t
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
ipa_custodia_pki_tomcat_exec_t was granted java_exec by mistake ; replace by
ipa_custodia_pki_tomcat_t.
As suggested by Ondrej Mosnáček.
Fixes: https://pagure.io/freeipa/issue/8488
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
---
selinux/ipa.te | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/selinux/ipa.te b/selinux/ipa.te
index 92a3b2359..b2c618a53 100644
--- a/selinux/ipa.te
+++ b/selinux/ipa.te
@@ -63,6 +63,8 @@ init_script_file(ipa_custodia_dmldap_exec_t)
type ipa_custodia_pki_tomcat_exec_t;
init_script_file(ipa_custodia_pki_tomcat_exec_t)
+type ipa_custodia_pki_tomcat_t;
+
type ipa_custodia_ra_agent_exec_t;
init_script_file(ipa_custodia_ra_agent_exec_t)
@@ -436,7 +438,7 @@ optional_policy(`
')
optional_policy(`
- java_exec(ipa_custodia_pki_tomcat_exec_t)
+ java_exec(ipa_custodia_pki_tomcat_t)
# allow Java to read system status and RNG
dev_read_urand(ipa_custodia_t)
dev_read_rand(ipa_custodia_t)
--
2.26.2
From 25cf7af0d41bbd34621f37c95802675b42baeae9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
Date: Tue, 22 Sep 2020 11:36:13 +0200
Subject: [PATCH] SELinux Policy: flag ipa_pki_retrieve_key_exec_t as
domain_type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixes: https://pagure.io/freeipa/issue/8488
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
---
selinux/ipa.te | 1 +
1 file changed, 1 insertion(+)
diff --git a/selinux/ipa.te b/selinux/ipa.te
index b2c618a53..42b010133 100644
--- a/selinux/ipa.te
+++ b/selinux/ipa.te
@@ -78,6 +78,7 @@ type pki_tomcat_cert_t;
type node_t;
type ipa_pki_retrieve_key_exec_t;
+domain_type(ipa_pki_retrieve_key_exec_t)
init_script_file(ipa_pki_retrieve_key_exec_t)
type ipa_pki_retrieve_key_t;
--
2.26.2
From 7ad04841245668e3126cb1718ef7ec1b744526e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
Date: Tue, 22 Sep 2020 13:12:05 +0200
Subject: [PATCH] SELinux Policy: make interfaces for kernel modules
non-optional
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Interfaces for kernel modules do not need to be in an optional module.
Also make sure ipa_custodia_t can log.
Suggested by Lukas Vrabec.
Fixes: https://pagure.io/freeipa/issue/8488
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
---
selinux/ipa.te | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/selinux/ipa.te b/selinux/ipa.te
index 42b010133..f984a0f94 100644
--- a/selinux/ipa.te
+++ b/selinux/ipa.te
@@ -78,10 +78,9 @@ type pki_tomcat_cert_t;
type node_t;
type ipa_pki_retrieve_key_exec_t;
-domain_type(ipa_pki_retrieve_key_exec_t)
-init_script_file(ipa_pki_retrieve_key_exec_t)
-
type ipa_pki_retrieve_key_t;
+domain_type(ipa_pki_retrieve_key_t)
+init_script_file(ipa_pki_retrieve_key_exec_t)
########################################
#
@@ -356,6 +355,7 @@ mmap_exec_files_pattern(ipa_custodia_t, ipa_custodia_tmp_t, ipa_custodia_tmp_t)
files_tmp_filetrans(ipa_custodia_t, ipa_custodia_tmp_t, { dir file })
kernel_dgram_send(ipa_custodia_t)
+kernel_read_network_state(ipa_custodia_t)
auth_read_passwd(ipa_custodia_t)
@@ -366,6 +366,10 @@ can_exec(ipa_custodia_t, ipa_custodia_ra_agent_exec_t)
corecmd_exec_bin(ipa_custodia_t)
corecmd_mmap_bin_files(ipa_custodia_t)
+dev_read_urand(ipa_custodia_t)
+dev_read_rand(ipa_custodia_t)
+dev_read_sysfs(ipa_custodia_t)
+
domain_use_interactive_fds(ipa_custodia_t)
files_mmap_usr_files(ipa_custodia_t)
@@ -377,6 +381,8 @@ files_read_etc_files(ipa_custodia_t)
libs_exec_ldconfig(ipa_custodia_t)
libs_ldconfig_exec_entry_type(ipa_custodia_t)
+logging_send_syslog_msg(ipa_custodia_t)
+
miscfiles_read_generic_certs(ipa_custodia_t)
miscfiles_read_localization(ipa_custodia_t)
@@ -441,8 +447,4 @@ optional_policy(`
optional_policy(`
java_exec(ipa_custodia_pki_tomcat_t)
# allow Java to read system status and RNG
- dev_read_urand(ipa_custodia_t)
- dev_read_rand(ipa_custodia_t)
- kernel_read_network_state(ipa_custodia_t)
- dev_read_sysfs(ipa_custodia_t)
')
--
2.26.2
From 6a31605c1d249416ed7627755bca23a1cc45a581 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
Date: Tue, 22 Sep 2020 13:34:40 +0200
Subject: [PATCH] SELinux Policy: Allow tomcat_t to read kerberos keytabs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This is required to fix:
avc: denied { search } for pid=1930 comm="ipa-pki-retriev" name="krb5" dev="dm-0" ino=8620822 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0
Macros suggested by: Ondrej Mosnacek
Fixes: https://pagure.io/freeipa/issue/8488
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
---
selinux/ipa.te | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/selinux/ipa.te b/selinux/ipa.te
index f984a0f94..fa577191c 100644
--- a/selinux/ipa.te
+++ b/selinux/ipa.te
@@ -448,3 +448,11 @@ optional_policy(`
java_exec(ipa_custodia_pki_tomcat_t)
# allow Java to read system status and RNG
')
+
+optional_policy(`
+ gen_require(`
+ type tomcat_t;
+ ')
+ kerberos_read_config(tomcat_t)
+ kerberos_read_keytab(tomcat_t)
+')
--
2.26.2
Reference in New Issue View Git Blame Copy Permalink