selinux: allow Cockpit to use HTTP keytab on IPA servers

Cockpit can use GSSAPI authentication and has pretty good definition of
how to enable it: https://cockpit-project.org/guide/latest/sso.html.
These instructions work on IPA clients but they cannot be used on IPA
servers because IPA framework already owns HTTP/.. Kerberos service and
its keytab.

Luckily, there are two changes that need to be done to enable Cockpit
single sign-on with GSSAPI on IPA servers:

  - create a symlink /etc/cockpit/krb5.keytab to
    /var/lib/ipa/gssproxy/http.keytab

  - add SELinux policy to allow cockpit_session_t to operate on
    /var/lib/ipa/gssproxy/http.keytab file

For existing installation an upgrade process would restore SELinux
context of the http.keytab file to the new value.

Note that Cockpit documentation above also talks about Kerberos service
modifications to enable delegation.  These modifications should not be
done for IPA servers' HTTP services, as these services are already
enabled to handle delegation.

Fixes: https://pagure.io/freeipa/issue/9675

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>

ipaserver/install/server/upgrade.py

@@ -1124,6 +1124,7 @@ def update_http_keytab(http):
                 paths.OLD_IPA_KEYTAB, e
             )
     http.keytab_user.chown(http.keytab)
+    tasks.restore_context(http.keytab)
 
 
 def ds_enable_sidgen_extdom_plugins(ds):

selinux/ipa.fc

@@ -22,6 +22,8 @@
 
 /var/lib/ipa(/.*)?              gen_context(system_u:object_r:ipa_var_lib_t,s0)
 
+/var/lib/ipa/gssproxy/http.keytab -- gen_context(system_u:object_r:ipa_http_keytab_t,s0)
+
 /var/log/ipa(/.*)?              gen_context(system_u:object_r:ipa_log_t,s0)
 
 /var/log/ipabackup.log	--	gen_context(system_u:object_r:ipa_log_t,s0)

selinux/ipa.if

@@ -155,6 +155,7 @@ interface(`ipa_manage_log',`
 ########################################
 ## <summary>
 ##	Allow domain to manage ipa lib files/dirs.
+##      This includes reading ipa_http_keytab_t files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -164,10 +165,33 @@ interface(`ipa_manage_log',`
 #
 interface(`ipa_read_lib',`
 	gen_require(`
+		type ipa_http_keytab_t;
 		type ipa_var_lib_t;
 	')
 
     read_files_pattern($1, ipa_var_lib_t, ipa_var_lib_t)
+    read_files_pattern($1, ipa_http_keytab_t, ipa_http_keytab_t)
+    list_dirs_pattern($1, ipa_var_lib_t, ipa_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Allow domain to manage ipa HTTP keytab file.
+##      This includes reading ipa_var_lib_t directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ipa_read_http_keytab',`
+	gen_require(`
+		type ipa_http_keytab_t;
+		type ipa_var_lib_t;
+	')
+
+    read_files_pattern($1, ipa_http_keytab_t, ipa_http_keytab_t)
     list_dirs_pattern($1, ipa_var_lib_t, ipa_var_lib_t)
 ')
 

selinux/ipa.te

@@ -43,6 +43,9 @@ logging_log_file(ipa_log_t)
 type ipa_var_lib_t;
 files_type(ipa_var_lib_t)
 
+type ipa_http_keytab_t;
+files_type(ipa_http_keytab_t)
+
 type ipa_var_run_t;
 files_pid_file(ipa_var_run_t)
 
@@ -516,3 +519,19 @@ optional_policy(`
     ')
     allow certmonger_t pki_tomcat_etc_rw_t:file { getattr ioctl open read };
 ')
+
+# gssproxy needs to read http keytab
+optional_policy(`
+    gen_require(`
+        type gssproxy_t;
+    ')
+    ipa_read_http_keytab(gssproxy_t)
+')
+
+# Allow Cockpit to use HTTP keytab on IPA servers for GSSAPI authentication
+optional_policy(`
+    gen_require(`
+        type cockpit_session_t;
+    ')
+    ipa_read_http_keytab(cockpit_session_t)
+')