|
 |
5144c6 |
From 438285470610dee4aa6a56523df22307840ede87 Mon Sep 17 00:00:00 2001
|
|
|
5144c6 |
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
|
|
|
5144c6 |
Date: Mon, 7 Sep 2020 11:07:21 +0200
|
|
|
5144c6 |
Subject: [PATCH] SELinux Policy: let custodia replicate keys
|
|
|
5144c6 |
MIME-Version: 1.0
|
|
|
5144c6 |
Content-Type: text/plain; charset=UTF-8
|
|
|
5144c6 |
Content-Transfer-Encoding: 8bit
|
|
|
5144c6 |
|
|
|
5144c6 |
Enhance the SELinux policy so that custodia can replicate sub-CA keys
|
|
|
5144c6 |
and certificates:
|
|
|
5144c6 |
allow ipa_custodia_t self:tcp_socket { bind create };
|
|
|
5144c6 |
allow ipa_custodia_t node_t:tcp_socket node_bind;
|
|
|
5144c6 |
allow ipa_custodia_t pki_tomcat_cert_t:dir remove_name;
|
|
|
5144c6 |
allow ipa_custodia_t pki_tomcat_cert_t:file create;
|
|
|
5144c6 |
allow ipa_custodia_t pki_tomcat_cert_t:file unlink;
|
|
|
5144c6 |
allow ipa_custodia_t self:process execmem;
|
|
|
5144c6 |
|
|
|
5144c6 |
Found by: test_replica_promotion::TestSubCAkeyReplication
|
|
|
5144c6 |
|
|
|
5144c6 |
Fixes: https://pagure.io/freeipa/issue/8488
|
|
|
5144c6 |
Signed-off-by: François Cami <fcami@redhat.com>
|
|
|
5144c6 |
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
|
|
|
5144c6 |
---
|
|
|
5144c6 |
selinux/ipa.te | 11 +++++++++++
|
|
|
5144c6 |
1 file changed, 11 insertions(+)
|
|
|
5144c6 |
|
|
|
5144c6 |
diff --git a/selinux/ipa.te b/selinux/ipa.te
|
|
|
5144c6 |
index c4c3fa805..3fa4ba980 100644
|
|
|
5144c6 |
--- a/selinux/ipa.te
|
|
|
5144c6 |
+++ b/selinux/ipa.te
|
|
|
5144c6 |
@@ -72,6 +72,9 @@ logging_log_file(ipa_custodia_log_t)
|
|
|
5144c6 |
type ipa_custodia_tmp_t;
|
|
|
5144c6 |
files_tmp_file(ipa_custodia_tmp_t)
|
|
|
5144c6 |
|
|
|
5144c6 |
+type pki_tomcat_cert_t;
|
|
|
5144c6 |
+type node_t;
|
|
|
5144c6 |
+
|
|
|
5144c6 |
########################################
|
|
|
5144c6 |
#
|
|
|
5144c6 |
# ipa_otpd local policy
|
|
|
5144c6 |
@@ -323,10 +326,18 @@ optional_policy(`
|
|
|
5144c6 |
allow ipa_custodia_t self:capability { setgid setuid };
|
|
|
5144c6 |
allow ipa_custodia_t self:fifo_file rw_fifo_file_perms;
|
|
|
5144c6 |
allow ipa_custodia_t self:netlink_route_socket { create_socket_perms nlmsg_read };
|
|
|
5144c6 |
+allow ipa_custodia_t self:process execmem;
|
|
|
5144c6 |
allow ipa_custodia_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
5144c6 |
allow ipa_custodia_t self:unix_dgram_socket create_socket_perms;
|
|
|
5144c6 |
+allow ipa_custodia_t self:tcp_socket { bind create };
|
|
|
5144c6 |
allow ipa_custodia_t self:udp_socket create_socket_perms;
|
|
|
5144c6 |
|
|
|
5144c6 |
+allow ipa_custodia_t node_t:tcp_socket node_bind;
|
|
|
5144c6 |
+
|
|
|
5144c6 |
+allow ipa_custodia_t pki_tomcat_cert_t:dir remove_name;
|
|
|
5144c6 |
+allow ipa_custodia_t pki_tomcat_cert_t:file create;
|
|
|
5144c6 |
+allow ipa_custodia_t pki_tomcat_cert_t:file unlink;
|
|
|
5144c6 |
+
|
|
|
5144c6 |
manage_dirs_pattern(ipa_custodia_t,ipa_custodia_log_t,ipa_custodia_log_t)
|
|
|
5144c6 |
manage_files_pattern(ipa_custodia_t, ipa_custodia_log_t, ipa_custodia_log_t)
|
|
|
5144c6 |
logging_log_filetrans(ipa_custodia_t, ipa_custodia_log_t, { dir file })
|
|
|
5144c6 |
--
|
|
|
5144c6 |
2.26.2
|
|
|
5144c6 |
|