mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-11-03 04:40:31 -06:00
Alexander Bokovoy
b9579fe08c
ipa-dnskeysyncd daemon relies on both OpenDNSSEC and BIND accessing the same cryptographic token. We use SoftHSMv2 here and store token in DNSSEC_TOKENS_DIR, defined by the IPA platform. Configure ipa-dnskeysyncd service to update permissions of the token files using custom systemd-tmpfiles configuration. Extend SELinux policy to handle access to the token under a separate file context. Both token and its pin file need to be accessed by the BIND rndc tool. Fixes: https://pagure.io/freeipa/issue/9696 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
48 lines
1.2 KiB
Makefile
48 lines
1.2 KiB
Makefile
# This file will be processed with automake-1.7 to create Makefile.in
|
|
#
|
|
AUTOMAKE_OPTIONS = 1.7
|
|
|
|
appdir = $(libexecdir)/ipa/
|
|
nodist_app_SCRIPTS = \
|
|
ipa-dnskeysyncd \
|
|
ipa-dnskeysync-replica \
|
|
ipa-ods-exporter
|
|
|
|
dist_noinst_DATA = \
|
|
ipa-dnskeysyncd.service.in \
|
|
ipa-ods-exporter.service.in \
|
|
ipa-ods-exporter.socket.in \
|
|
ipa-dnskeysyncd.in \
|
|
ipa-dnskeysync-replica.in \
|
|
ipa-ods-exporter.in
|
|
|
|
|
|
systemdsystemunit_DATA = \
|
|
ipa-dnskeysyncd.service \
|
|
ipa-ods-exporter.service \
|
|
ipa-ods-exporter.socket
|
|
|
|
CLEANFILES = $(systemdsystemunit_DATA) $(nodist_app_SCRIPTS)
|
|
|
|
%: %.in Makefile
|
|
sed \
|
|
-e 's|@libexecdir[@]|$(libexecdir)|g' \
|
|
-e 's|@localstatedir[@]|$(localstatedir)|g' \
|
|
-e 's|@sysconfenvdir[@]|$(sysconfenvdir)|g' \
|
|
-e 's|@runstatedir[@]|$(runstatedir)|g' \
|
|
-e 's|@ODS_USER[@]|$(ODS_USER)|g' \
|
|
-e 's|@ODS_GROUP[@]|$(ODS_GROUP)|g' \
|
|
-e 's|@NAMED_GROUP[@]|$(NAMED_GROUP)|g' \
|
|
-e 's|@IPA_DATA_DIR[@]|$(IPA_DATA_DIR)|g' \
|
|
'$(srcdir)/$@.in' >$@
|
|
|
|
dnssecconfdir = $(IPA_SYSCONF_DIR)/dnssec
|
|
install-data-hook:
|
|
$(INSTALL) -d -m 755 $(DESTDIR)$(dnssecconfdir)
|
|
|
|
PYTHON_SHEBANG = \
|
|
$(nodist_app_SCRIPTS) \
|
|
$(NULL)
|
|
|
|
include $(top_srcdir)/Makefile.pythonscripts.am
|