mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-10-24 22:27:41 -05:00
Florence Blanc-Renaud
c2aae876f0
During the DNS server installation in SELinux enforcing mode,
ipa-dnskeysyncd.service fails to restart because of the AVC:
avc: denied { relabelto } for pid=29955 comm="systemd-tmpfile" name="softhsm_pin" dev="vda4" ino=38440 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:ipa_dnskey_t:s0 tclass=file permissive=0
Add the missing policies
allow systemd_tmpfiles_t ipa_dnskey_t:file relabelto;
allow ipa_dnskey_t fs_t:filesystem associate;
allow ipa_ods_exporter_t ipa_dnskey_t:file { getattr ioctl open read };
allow named_t ipa_dnskey_t:file { getattr open read };
Fixes: https://pagure.io/freeipa/issue/9782
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
IPA SELinux policy
The ipa SELinux policy is used by IPA client and server. The
policy was forked off from Fedora upstream policy
at commit b1751347f4af99de8c88630e2f8d0a352d7f5937.
Some file locations are owned by other policies:
/var/lib/ipa/pki-ca/publish(/.*)?is owned by Dogtag PKI policy/usr/lib/ipa/certmonger(/.*)?is owned by certmonger policy/var/lib/ipa-client(/.*)?is owned by realmd policy