From 2f2bce43108db5f1fa651a63eea38b33242495cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
Date: Tue, 22 Sep 2020 13:34:40 +0200
Subject: [PATCH] SELinux Policy: Allow tomcat_t to read kerberos keytabs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is required to fix:
avc: denied  { search } for  pid=1930 comm="ipa-pki-retriev" name="krb5" dev="dm-0" ino=8620822 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0

Macros suggested by: Ondrej Mosnacek

Fixes: https://pagure.io/freeipa/issue/8488
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
---
 selinux/ipa.te | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/selinux/ipa.te b/selinux/ipa.te
index f984a0f94..fa577191c 100644
--- a/selinux/ipa.te
+++ b/selinux/ipa.te
@@ -448,3 +448,11 @@ optional_policy(`
     java_exec(ipa_custodia_pki_tomcat_t)
     # allow Java to read system status and RNG
 ')
+
+optional_policy(`
+    gen_require(`
+        type tomcat_t;
+    ')
+    kerberos_read_config(tomcat_t)
+    kerberos_read_keytab(tomcat_t)
+')