mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-10-26 07:00:07 -05:00
Alexander Bokovoy
b9579fe08c
ipa-dnskeysyncd daemon relies on both OpenDNSSEC and BIND accessing the same cryptographic token. We use SoftHSMv2 here and store token in DNSSEC_TOKENS_DIR, defined by the IPA platform. Configure ipa-dnskeysyncd service to update permissions of the token files using custom systemd-tmpfiles configuration. Extend SELinux policy to handle access to the token under a separate file context. Both token and its pin file need to be accessed by the BIND rndc tool. Fixes: https://pagure.io/freeipa/issue/9696 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
5 lines
211 B
Plaintext
5 lines
211 B
Plaintext
d @DNSSEC_TOKENS_DIR@ 2770 @ODS_USER@ @NAMED_GROUP@
|
|
A+ @DNSSEC_TOKENS_DIR@ - - - - group:@NAMED_GROUP@:rw,user:@ODS_USER@:rw
|
|
Z @DNSSEC_TOKENS_DIR@ - - - - -
|
|
z @DNSSEC_SOFTHSM_PIN@ - @ODS_USER@ @NAMED_GROUP@ - -
|