freeipa/install/custodia/ipa-custodia-ra-agent.in

#!/usr/bin/python3
#
# Copyright (C) 2019  IPA Project Contributors, see COPYING for license
#

from ipaserver.secrets.handlers.pemfile import main, ra_agent_parser

main(ra_agent_parser())
Replace PYTHONSHEBANG with valid shebang Replace the @PYTHONSHEBANG@ substitution with a valid #!/usr/bin/python3 shebang. This turns Python .in files into valid Python files. The files can now be checked with pylint and IDEs recognize the files as Python files. The shebang is still replaced with "#!$(PYTHON) -E" to support platform-python. Related: https://pagure.io/freeipa/issue/7984 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> 2019-06-21 05:05:19 -05:00			`#!/usr/bin/python3`
Move Custodia secrets handler to scripts Implement the import and export handlers for Custodia keys as external scripts. It's a prerequisite to drop DAC override permission and proper SELinux rules for ipa-custodia. Except for DMLDAP, handlers no longer run as root but as handler specific users with reduced privileges. The Dogtag-related handlers run as pkiuser, which also help with HSM support. The export and import handles are designed to be executed by sudo, too. In the future, ipa-custodia could be executed as an unprivileged process that runs the minimal helper scripts with higher privileges. Fixes: https://pagure.io/freeipa/issue/6888 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> 2019-01-30 07:08:38 -06:00			`#`
			`# Copyright (C) 2019 IPA Project Contributors, see COPYING for license`
			`#`

			`from ipaserver.secrets.handlers.pemfile import main, ra_agent_parser`

			`main(ra_agent_parser())`