mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-25 16:31:08 -06:00
2ef6e14c5a
authselect changed pam_systemd session from optional to required. When the HBAC rule allow_all is disabled and replaced with more fine grained rules, loginsi now to fail, because systemd's user@.service is able to create a systemd session. Add systemd-user HBAC service and a HBAC rule that allows systemd-user to run on all hosts for all users by default. ipa-server-upgrade creates the service and rule, too. In case the service already exists, no attempt is made to create the rule. This allows admins to delete the rule permanently. See: https://bugzilla.redhat.com/show_bug.cgi?id=1643928 Fixes: https://pagure.io/freeipa/issue/7831 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
28 lines
772 B
Plaintext
28 lines
772 B
Plaintext
# default HBAC policy that grants permission to all services
|
|
dn: ipauniqueid=autogenerate,cn=hbac,$SUFFIX
|
|
changetype: add
|
|
objectclass: ipaassociation
|
|
objectclass: ipahbacrule
|
|
cn: allow_all
|
|
accessruletype: allow
|
|
usercategory: all
|
|
hostcategory: all
|
|
servicecategory: all
|
|
ipaenabledflag: TRUE
|
|
description: Allow all users to access any host from any host
|
|
ipauniqueid: autogenerate
|
|
|
|
# default HBAC policy for pam_systemd
|
|
dn: ipauniqueid=autogenerate,cn=hbac,$SUFFIX
|
|
changetype: add
|
|
objectclass: ipaassociation
|
|
objectclass: ipahbacrule
|
|
cn: allow_systemd-user
|
|
accessruletype: allow
|
|
usercategory: all
|
|
hostcategory: all
|
|
servicecategory: systemd-user
|
|
ipaenabledflag: TRUE
|
|
description: Allow pam_systemd to run user@.service to create a system user session
|
|
ipauniqueid: autogenerate
|