Alexander Bokovoy b9579fe08c ipa-dnskeysyncd: use systemd-tmpfiles to handle tokens ...

ipa-dnskeysyncd daemon relies on both OpenDNSSEC and BIND accessing the
same cryptographic token. We use SoftHSMv2 here and store token in
DNSSEC_TOKENS_DIR, defined by the IPA platform.

Configure ipa-dnskeysyncd service to update permissions of the token
files using custom systemd-tmpfiles configuration.

Extend SELinux policy to handle access to the token under a separate
file context. Both token and its pin file need to be accessed by the BIND
rndc tool.

Fixes: https://pagure.io/freeipa/issue/9696

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>

2025-05-06 13:48:35 +02:00

..

systemd

frontend: add systemd journal audit of executed API commands

2024-05-22 17:06:23 -04:00

tmpfilesd

ipa-dnskeysyncd: use systemd-tmpfiles to handle tokens

2025-05-06 13:48:35 +02:00

ipa-dnskeysyncd

Build: integrate init and init/systemd into build system

2016-11-09 13:08:32 +01:00

ipa-ods-exporter

Build: integrate init and init/systemd into build system

2016-11-09 13:08:32 +01:00

Makefile.am

Move tmpfiles.d configuration handling back to spec file

2017-08-30 13:05:23 +02:00