IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-22 15:13:50 -06:00
Code Issues Packages Projects Releases Wiki Activity

docs: Add a section on SELinux modules to the HSM design

Browse Source 
Additional SELinux rules are necessary for the HSM to be
managed by IPA and certmonger. Given the infinite possible
naming combinations of library paths and modules this is
a best effort. A message is logged if a missing module
is detected.

Related: https://pagure.io/freeipa/issue/9273

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
This commit is contained in:
Rob Crittenden 2024-04-29 16:39:33 -04:00
parent c861ce5a16
commit 6af8577d58
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
doc/designs/hsm.md
View File

@ -43,6 +43,20 @@ There are a few basic rules:
### Installation
#### SELinux
The two supported hardware HSMs require additional SELinux permissions
so that IPA and certmonger have access to the tokens. There is a
separate module for each one: {free}ipa-selinux-nfast and
{free}ipa-selinux-luna. These are NOT installed by default and
the user must install the appropriate one manually.
During HSM validation early in the installation a check is made to
ensure that the correct module is installed but this is a best
effort and will not cause the installation to fail if the module
is not available.
#### CA
The token name, module name and shared library must be provided to the