mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00

Files

François Cami 68328299c8 SELinux Policy: let custodia replicate keys

Enhance the SELinux policy so that custodia can replicate sub-CA keys
and certificates:
allow ipa_custodia_t self:tcp_socket { bind create };
allow ipa_custodia_t node_t:tcp_socket node_bind;
allow ipa_custodia_t pki_tomcat_cert_t:dir remove_name;
allow ipa_custodia_t pki_tomcat_cert_t:file create;
allow ipa_custodia_t pki_tomcat_cert_t:file unlink;
allow ipa_custodia_t self:process execmem;

Found by: test_replica_promotion::TestSubCAkeyReplication

Fixes: https://pagure.io/freeipa/issue/8488
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>

2020-09-09 17:49:23 -04:00

ipa.fc

Use /run and /run/lock instead of /var

2020-04-15 18:48:50 +02:00

ipa.if

selinux: allow oddjobd to set up ipa_helper_t context for execution

2020-07-06 10:47:18 +03:00

ipa.te

SELinux Policy: let custodia replicate keys

2020-09-09 17:49:23 -04:00

Makefile.am

Integrate SELinux policy into build system

2020-03-05 09:57:00 +01:00

README.md

Move freeipa-selinux dependency to freeipa-common

2020-03-20 15:18:30 +01:00

README.md

IPA SELinux policy

The ipa SELinux policy is used by IPA client and server. The policy was forked off from Fedora upstream policy at commit b1751347f4af99de8c88630e2f8d0a352d7f5937.

Some file locations are owned by other policies:

/var/lib/ipa/pki-ca/publish(/.*)? is owned by Dogtag PKI policy
/usr/lib/ipa/certmonger(/.*)? is owned by certmonger policy
/var/lib/ipa-client(/.*)? is owned by realmd policy