|
 |
483b06 |
From 488c433c369bfcd13e95d910b500c455a01715b6 Mon Sep 17 00:00:00 2001
|
|
|
483b06 |
From: Martin Basti <mbasti@redhat.com>
|
|
|
483b06 |
Date: Wed, 3 May 2017 13:51:02 +0200
|
|
|
483b06 |
Subject: [PATCH] Use proper SELinux context with http.keytab
|
|
|
483b06 |
|
|
|
483b06 |
During upgrade keytab is moved to a new location using "move" operation.
|
|
|
483b06 |
This commit replaces move operation with "copy" and "remove" that
|
|
|
483b06 |
ensures a proper selinux context.
|
|
|
483b06 |
|
|
|
483b06 |
https://pagure.io/freeipa/issue/6924
|
|
|
483b06 |
|
|
|
483b06 |
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
|
|
|
483b06 |
---
|
|
|
483b06 |
ipaserver/install/server/upgrade.py | 10 +++++++++-
|
|
|
483b06 |
1 file changed, 9 insertions(+), 1 deletion(-)
|
|
|
483b06 |
|
|
|
483b06 |
diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
|
|
|
483b06 |
index 0f27428dd492bb44dd8c69a7e7f47abb531843f5..4d8fd666dfd4e918103b449d4c31bb7661727115 100644
|
|
|
483b06 |
--- a/ipaserver/install/server/upgrade.py
|
|
|
483b06 |
+++ b/ipaserver/install/server/upgrade.py
|
|
|
483b06 |
@@ -1427,7 +1427,15 @@ def update_ipa_httpd_service_conf(http):
|
|
|
483b06 |
def update_http_keytab(http):
|
|
|
483b06 |
root_logger.info('[Moving HTTPD service keytab to gssproxy]')
|
|
|
483b06 |
if os.path.exists(paths.OLD_IPA_KEYTAB):
|
|
|
483b06 |
- shutil.move(paths.OLD_IPA_KEYTAB, http.keytab)
|
|
|
483b06 |
+ # ensure proper SELinux context by using copy operation
|
|
|
483b06 |
+ shutil.copy(paths.OLD_IPA_KEYTAB, http.keytab)
|
|
|
483b06 |
+ try:
|
|
|
483b06 |
+ os.remove(paths.OLD_IPA_KEYTAB)
|
|
|
483b06 |
+ except OSError as e:
|
|
|
483b06 |
+ root_logger.error(
|
|
|
483b06 |
+ 'Cannot remove file %s (%s). Please remove the file manually.',
|
|
|
483b06 |
+ paths.OLD_IPA_KEYTAB, e
|
|
|
483b06 |
+ )
|
|
|
483b06 |
pent = pwd.getpwnam(http.keytab_user)
|
|
|
483b06 |
os.chown(http.keytab, pent.pw_uid, pent.pw_gid)
|
|
|
483b06 |
|
|
|
483b06 |
--
|
|
|
483b06 |
2.12.2
|
|
|
483b06 |
|