IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-25 16:31:08 -06:00
Code Issues Packages Projects Releases Wiki Activity
94f7d31d2d
freeipa/selinux/ipa.fc

36 lines
2.1 KiB
Plaintext
Raw Normal View History

Add freeipa-selinux subpackage Add freeipa-selinux subpackage containing selinux policy for FreeIPA server. This policy module will override the distribution policy. Policy files where extracted from https://github.com/fedora-selinux/selinux-policy See Independent policy project guidelines for more details about shipping custom SELinux policy. https://fedoraproject.org/wiki/SELinux/IndependentPolicy Reviewed-By: Christian Heimes <cheimes@redhat.com>
2020-02-14 10:43:36 -06:00
/etc/httpd/alias/ipasession.key -- gen_context(system_u:object_r:ipa_cert_t,s0)
/usr/lib/systemd/system/ipa-otpd.* -- gen_context(system_u:object_r:ipa_otpd_unit_file_t,s0)
/usr/lib/systemd/system/ipa-dnskeysyncd.* -- gen_context(system_u:object_r:ipa_dnskey_unit_file_t,s0)
/usr/lib/systemd/system/ipa-ods-exporter.* -- gen_context(system_u:object_r:ipa_ods_exporter_unit_file_t,s0)
/usr/libexec/ipa-otpd -- gen_context(system_u:object_r:ipa_otpd_exec_t,s0)
/usr/libexec/ipa/ipa-otpd -- gen_context(system_u:object_r:ipa_otpd_exec_t,s0)
/usr/libexec/ipa/ipa-ods-exporter -- gen_context(system_u:object_r:ipa_ods_exporter_exec_t,s0)
/usr/libexec/ipa/ipa-dnskeysyncd -- gen_context(system_u:object_r:ipa_dnskey_exec_t,s0)
/usr/libexec/ipa/ipa-dnskeysync-replica -- gen_context(system_u:object_r:ipa_dnskey_exec_t,s0)
Cleanup SELinux policy * Remove FC for /usr/libexec/ipa/com.redhat.idm.trust-fetch-domains. The file has been moved to oddjobs/ subdirectory a long time ago. * Simplify FC for oddjob scripts. All com.redhat.idm.* and org.freeipa.* scripts are labeled as ipa_helper_exec_t. * use miscfiles_read_generic_certs() instead of deprecated miscfiles_read_certs() to address the warning: ``` Warning: miscfiles_read_certs() has been deprecated, please use miscfiles_read_generic_certs() instead. ``` (Also add org.freeipa.server.trust-enable-agent to .gitignore) Related: https://pagure.io/freeipa/issue/6891 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
2020-03-11 07:30:44 -05:00
/usr/libexec/ipa/oddjob/com\.redhat\.idm.* -- gen_context(system_u:object_r:ipa_helper_exec_t,s0)
/usr/libexec/ipa/oddjob/org\.freeipa.* -- gen_context(system_u:object_r:ipa_helper_exec_t,s0)
Add freeipa-selinux subpackage Add freeipa-selinux subpackage containing selinux policy for FreeIPA server. This policy module will override the distribution policy. Policy files where extracted from https://github.com/fedora-selinux/selinux-policy See Independent policy project guidelines for more details about shipping custom SELinux policy. https://fedoraproject.org/wiki/SELinux/IndependentPolicy Reviewed-By: Christian Heimes <cheimes@redhat.com>
2020-02-14 10:43:36 -06:00
/var/lib/ipa(/.*)? gen_context(system_u:object_r:ipa_var_lib_t,s0)
/var/log/ipa(/.*)? gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipareplica-conncheck.log.* -- gen_context(system_u:object_r:ipa_log_t,s0)
selinux: Fix file context definition for /var/run There is a file context equivalence rule assigning /run the same contexts as /var/run. Because of it it's necessary to use /var/run instead of /run in file context definitions. See: https://fedoraproject.org/wiki/SELinux/IndependentPolicy#File_contexts_and_equivalency_rules Signed-off-by: Vit Mojzis <vmojzis@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
2021-09-22 06:48:07 -05:00
/var/run/ipa(/.*)? gen_context(system_u:object_r:ipa_var_run_t,s0)
Integrate ipa_custodia policy ipa-custodia is an internal service for IPA. The upstream SELinux policy has a separate module for ipa_custodia. Fold the current policy from Fedora rawhide into ipa's SELinux policy. Related: https://pagure.io/freeipa/issue/6891 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-03-20 04:08:07 -05:00
/usr/libexec/ipa/ipa-custodia -- gen_context(system_u:object_r:ipa_custodia_exec_t,s0)
/usr/libexec/ipa/custodia/ipa-custodia-dmldap -- gen_context(system_u:object_r:ipa_custodia_dmldap_exec_t,s0)
/usr/libexec/ipa/custodia/ipa-custodia-pki-tomcat -- gen_context(system_u:object_r:ipa_custodia_pki_tomcat_exec_t,s0)
/usr/libexec/ipa/custodia/ipa-custodia-pki-tomcat-wrapped -- gen_context(system_u:object_r:ipa_custodia_pki_tomcat_exec_t,s0)
/usr/libexec/ipa/custodia/ipa-custodia-ra-agent -- gen_context(system_u:object_r:ipa_custodia_ra_agent_exec_t,s0)
SELinux: Add dedicated policy for ipa-pki-retrieve-key Add proper labeling, transition and policy for ipa-pki-retrieve-key. Make sure tomcat_t can execute ipa-pki-retrieve-key. Fixes: https://pagure.io/freeipa/issue/8488 Signed-off-by: Christian Heimes <cheimes@redhat.com> Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com> Reviewed-By: Lukas Vrabec <lvrabec@redhat.com> Reviewed-By: Zdenek Pytela <zpytela@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
2020-09-18 04:55:37 -05:00
/usr/libexec/ipa/ipa-pki-retrieve-key -- gen_context(system_u:object_r:ipa_pki_retrieve_key_exec_t,s0)
Integrate ipa_custodia policy ipa-custodia is an internal service for IPA. The upstream SELinux policy has a separate module for ipa_custodia. Fold the current policy from Fedora rawhide into ipa's SELinux policy. Related: https://pagure.io/freeipa/issue/6891 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-03-20 04:08:07 -05:00
/var/log/ipa-custodia.audit.log(/.*)? -- gen_context(system_u:object_r:ipa_custodia_log_t,s0)
Reference in New Issue Copy Permalink