From d83b760d1f76a3ba8e527dd27551e51a600b22c0 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Wed, 15 Jul 2020 10:23:35 +0200 Subject: [PATCH] Add missing SELinux rule for ipa-custodia.sock A SELinux rule for ipa_custodia_stream_connect(httpd_t) was not copied from upstream rules. It breaks installations on systems that don't have ipa_custodia_stream_connect in SELinux domain for apache, e.g. RHEL 8.3. Fixes: https://pagure.io/freeipa/issue/8412 Signed-off-by: Christian Heimes Reviewed-By: Thomas Woerner --- selinux/ipa.te | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/selinux/ipa.te b/selinux/ipa.te index a3381217a4..c4c3fa805e 100644 --- a/selinux/ipa.te +++ b/selinux/ipa.te @@ -378,6 +378,13 @@ optional_policy(` ipa_search_lib(ipa_custodia_t) ') +optional_policy(` + gen_require(` + type httpd_t; + ') + ipa_custodia_stream_connect(httpd_t) +') + optional_policy(` pki_manage_tomcat_etc_rw(ipa_custodia_t) pki_read_tomcat_cert(ipa_custodia_t)