mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-10-24 14:17:41 -05:00
Alexander Bokovoy
b9579fe08c
ipa-dnskeysyncd daemon relies on both OpenDNSSEC and BIND accessing the same cryptographic token. We use SoftHSMv2 here and store token in DNSSEC_TOKENS_DIR, defined by the IPA platform. Configure ipa-dnskeysyncd service to update permissions of the token files using custom systemd-tmpfiles configuration. Extend SELinux policy to handle access to the token under a separate file context. Both token and its pin file need to be accessed by the BIND rndc tool. Fixes: https://pagure.io/freeipa/issue/9696 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
IPA SELinux policy
The ipa SELinux policy is used by IPA client and server. The
policy was forked off from Fedora upstream policy
at commit b1751347f4af99de8c88630e2f8d0a352d7f5937.
Some file locations are owned by other policies:
/var/lib/ipa/pki-ca/publish(/.*)?is owned by Dogtag PKI policy/usr/lib/ipa/certmonger(/.*)?is owned by certmonger policy/var/lib/ipa-client(/.*)?is owned by realmd policy