Move Custodia secrets handler to scripts

Implement the import and export handlers for Custodia keys as external
scripts. It's a prerequisite to drop DAC override permission and proper
SELinux rules for ipa-custodia.

Except for DMLDAP,  handlers no longer run as root but as handler
specific users with reduced privileges. The Dogtag-related handlers run
as pkiuser, which also help with HSM support.

The export and import handles are designed to be executed by sudo, too.
In the future, ipa-custodia could be executed as an unprivileged process
that runs the minimal helper scripts with higher privileges.

Fixes: https://pagure.io/freeipa/issue/6888
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

install/Makefile.am

@@ -6,6 +6,7 @@ NULL =
 
 SUBDIRS =			\
         certmonger		\
+        custodia		\
         html			\
         migration		\
         share			\

install/custodia/Makefile.am

@@ -0,0 +1,22 @@
+NULL =
+
+appdir = $(libexecdir)/ipa/custodia/
+nodist_app_SCRIPTS =					\
+	ipa-custodia-dmldap					\
+	ipa-custodia-pki-tomcat				\
+	ipa-custodia-pki-tomcat-wrapped		\
+	ipa-custodia-ra-agent				\
+	$(NULL)
+
+dist_noinst_DATA = 						\
+	ipa-custodia-dmldap.in				\
+	ipa-custodia-pki-tomcat.in			\
+	ipa-custodia-pki-tomcat-wrapped.in	\
+	ipa-custodia-ra-agent.in			\
+	$(NULL)
+
+PYTHON_SHEBANG = $(nodist_app_SCRIPTS)
+
+CLEANFILES = $(PYTHON_SHEBANG)
+
+include $(top_srcdir)/Makefile.pythonscripts.am

install/custodia/ipa-custodia-dmldap.in

@@ -0,0 +1,8 @@
+@PYTHONSHEBANG@
+#
+# Copyright (C) 2019  IPA Project Contributors, see COPYING for license
+#
+
+from ipaserver.secrets.handlers.dmldap import main
+
+main()

install/custodia/ipa-custodia-pki-tomcat-wrapped.in

@@ -0,0 +1,8 @@
+@PYTHONSHEBANG@
+#
+# Copyright (C) 2019  IPA Project Contributors, see COPYING for license
+#
+
+from ipaserver.secrets.handlers.nsswrappedcert import main, pki_tomcat_parser
+
+main(pki_tomcat_parser())

install/custodia/ipa-custodia-pki-tomcat.in

@@ -0,0 +1,8 @@
+@PYTHONSHEBANG@
+#
+# Copyright (C) 2019  IPA Project Contributors, see COPYING for license
+#
+
+from ipaserver.secrets.handlers.nsscert import main, pki_tomcat_parser
+
+main(pki_tomcat_parser())

install/custodia/ipa-custodia-ra-agent.in

@@ -0,0 +1,8 @@
+@PYTHONSHEBANG@
+#
+# Copyright (C) 2019  IPA Project Contributors, see COPYING for license
+#
+
+from ipaserver.secrets.handlers.pemfile import main, ra_agent_parser
+
+main(ra_agent_parser())