From 1fbc4e01ea5be004f7c57cb71df2d37659271d68 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Tue, 10 Mar 2020 15:43:30 +0100 Subject: [PATCH] selinux policy: add the right context for org.freeipa.server.trust-enable-agent This commit sets the system_u:object_r:ipa_helper_exec_t:s0 context to the oddjob script org.freeipa.server.trust-enable-agent. Without this context, oddjob cannot launch the command /usr/libexec/ipa/oddjob/org.freeipa.server.trust-enable-agent when ipa-adtrust-install --add-agents is run with SElinux enforcing. Related: https://pagure.io/freeipa/issue/7600 Reviewed-By: Alexander Bokovoy Reviewed-By: Christian Heimes --- selinux/ipa.fc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux/ipa.fc b/selinux/ipa.fc index 61fd84f00..71098bb1e 100644 --- a/selinux/ipa.fc +++ b/selinux/ipa.fc @@ -18,6 +18,7 @@ /usr/libexec/ipa/com\.redhat\.idm\.trust-fetch-domains -- gen_context(system_u:object_r:ipa_helper_exec_t,s0) /usr/libexec/ipa/oddjob/com\.redhat\.idm\.trust-fetch-domains -- gen_context(system_u:object_r:ipa_helper_exec_t,s0) /usr/libexec/ipa/oddjob/org\.freeipa\.server\.conncheck -- gen_context(system_u:object_r:ipa_helper_exec_t,s0) +/usr/libexec/ipa/oddjob/org\.freeipa\.server\.trust-enable-agent -- gen_context(system_u:object_r:ipa_helper_exec_t,s0) /var/lib/ipa(/.*)? gen_context(system_u:object_r:ipa_var_lib_t,s0) @@ -26,4 +27,3 @@ /var/log/ipareplica-conncheck.log.* -- gen_context(system_u:object_r:ipa_log_t,s0) /var/run/ipa(/.*)? gen_context(system_u:object_r:ipa_var_run_t,s0) -