|
 |
5144c6 |
From c72ef1ed965aca79da4576d9579dec5459e14b99 Mon Sep 17 00:00:00 2001
|
|
|
5144c6 |
From: Christian Heimes <cheimes@redhat.com>
|
|
|
5144c6 |
Date: Fri, 8 May 2020 15:27:01 +0200
|
|
|
5144c6 |
Subject: [PATCH] SELinux: Backport dirsrv_systemctl interface
|
|
|
5144c6 |
|
|
|
5144c6 |
Signed-off-by: Christian Heimes <cheimes@redhat.com>
|
|
|
5144c6 |
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
|
|
|
5144c6 |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
5144c6 |
---
|
|
|
5144c6 |
selinux/ipa.if | 27 +++++++++++++++++++++++++++
|
|
|
5144c6 |
1 file changed, 27 insertions(+)
|
|
|
5144c6 |
|
|
|
5144c6 |
diff --git a/selinux/ipa.if b/selinux/ipa.if
|
|
|
5144c6 |
index cefae5d90..ea971b8fa 100644
|
|
|
5144c6 |
--- a/selinux/ipa.if
|
|
|
5144c6 |
+++ b/selinux/ipa.if
|
|
|
5144c6 |
@@ -392,3 +392,30 @@ ifndef(`apache_manage_pid_files',`
|
|
|
5144c6 |
manage_sock_files_pattern($1, httpd_var_run_t, httpd_var_run_t)
|
|
|
5144c6 |
')
|
|
|
5144c6 |
')
|
|
|
5144c6 |
+
|
|
|
5144c6 |
+########################################
|
|
|
5144c6 |
+## <summary>
|
|
|
5144c6 |
+## Execute dirsrv server in the dirsrv domain.
|
|
|
5144c6 |
+## Backport from https://github.com/fedora-selinux/selinux-policy-contrib/pull/241
|
|
|
5144c6 |
+## </summary>
|
|
|
5144c6 |
+## <param name="domain">
|
|
|
5144c6 |
+## <summary>
|
|
|
5144c6 |
+## Domain allowed to transition.
|
|
|
5144c6 |
+## </summary>
|
|
|
5144c6 |
+## </param>
|
|
|
5144c6 |
+#
|
|
|
5144c6 |
+ifndef(`dirsrv_systemctl',`
|
|
|
5144c6 |
+ interface(`dirsrv_systemctl',`
|
|
|
5144c6 |
+ gen_require(`
|
|
|
5144c6 |
+ type dirsrv_unit_file_t;
|
|
|
5144c6 |
+ type dirsrv_t;
|
|
|
5144c6 |
+ ')
|
|
|
5144c6 |
+
|
|
|
5144c6 |
+ systemd_exec_systemctl($1)
|
|
|
5144c6 |
+ init_reload_services($1)
|
|
|
5144c6 |
+ allow $1 dirsrv_unit_file_t:file read_file_perms;
|
|
|
5144c6 |
+ allow $1 dirsrv_unit_file_t:service manage_service_perms;
|
|
|
5144c6 |
+
|
|
|
5144c6 |
+ ps_process_pattern($1, dirsrv_t)
|
|
|
5144c6 |
+ ')
|
|
|
5144c6 |
+')
|
|
|
5144c6 |
--
|
|
|
5144c6 |
2.26.2
|
|
|
5144c6 |
|
|
|
5144c6 |
From f76c56c6072418c78f138678b1c4dd917fea6ee1 Mon Sep 17 00:00:00 2001
|
|
|
5144c6 |
From: Zdenek Pytela <zpytela@redhat.com>
|
|
|
5144c6 |
Date: Thu, 7 May 2020 16:17:12 +0200
|
|
|
5144c6 |
Subject: [PATCH] Allow ipa-adtrust-install restart sssd and dirsrv services
|
|
|
5144c6 |
|
|
|
5144c6 |
Allow ipa_helper_t connect to init using /run/systemd/private socket.
|
|
|
5144c6 |
Allow ipa_helper_t read init process state.
|
|
|
5144c6 |
Allow ipa_helper_t manage sssd and dirsrv units.
|
|
|
5144c6 |
|
|
|
5144c6 |
See: https://bugzilla.redhat.com/show_bug.cgi?id=1820298
|
|
|
5144c6 |
See: https://github.com/fedora-selinux/selinux-policy-contrib/pull/241
|
|
|
5144c6 |
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
|
|
|
5144c6 |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
5144c6 |
---
|
|
|
5144c6 |
selinux/ipa.te | 8 ++++++++
|
|
|
5144c6 |
1 file changed, 8 insertions(+)
|
|
|
5144c6 |
|
|
|
5144c6 |
diff --git a/selinux/ipa.te b/selinux/ipa.te
|
|
|
5144c6 |
index b1e29c8e2..587e5e585 100644
|
|
|
5144c6 |
--- a/selinux/ipa.te
|
|
|
5144c6 |
+++ b/selinux/ipa.te
|
|
|
5144c6 |
@@ -147,6 +147,9 @@ auth_use_nsswitch(ipa_helper_t)
|
|
|
5144c6 |
|
|
|
5144c6 |
files_list_tmp(ipa_helper_t)
|
|
|
5144c6 |
|
|
|
5144c6 |
+init_read_state(ipa_helper_t)
|
|
|
5144c6 |
+init_stream_connect(ipa_helper_t)
|
|
|
5144c6 |
+
|
|
|
5144c6 |
ipa_manage_pid_files(ipa_helper_t)
|
|
|
5144c6 |
ipa_read_lib(ipa_helper_t)
|
|
|
5144c6 |
|
|
|
5144c6 |
@@ -156,6 +159,10 @@ optional_policy(`
|
|
|
5144c6 |
dirsrv_stream_connect(ipa_helper_t)
|
|
|
5144c6 |
')
|
|
|
5144c6 |
|
|
|
5144c6 |
+optional_policy(`
|
|
|
5144c6 |
+ dirsrv_systemctl(ipa_helper_t)
|
|
|
5144c6 |
+')
|
|
|
5144c6 |
+
|
|
|
5144c6 |
optional_policy(`
|
|
|
5144c6 |
ldap_stream_connect(ipa_helper_t)
|
|
|
5144c6 |
')
|
|
|
5144c6 |
@@ -182,6 +189,7 @@ optional_policy(`
|
|
|
5144c6 |
|
|
|
5144c6 |
optional_policy(`
|
|
|
5144c6 |
sssd_manage_lib_files(ipa_helper_t)
|
|
|
5144c6 |
+ sssd_systemctl(ipa_helper_t)
|
|
|
5144c6 |
')
|
|
|
5144c6 |
|
|
|
5144c6 |
########################################
|
|
|
5144c6 |
--
|
|
|
5144c6 |
2.26.2
|
|
|
5144c6 |
|