From 7651d335b3fe7c644ae9b8de2590b315303375cf Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Wed, 23 Sep 2020 07:45:37 +0200
Subject: [PATCH] Add ipa_pki_retrieve_key_exec() interface

The ipa_pki_retrieve_key_exec() interface is needed to allow other
domains execute ipa-pki-retrieve-key.

Related: https://pagure.io/freeipa/issue/8488
Signed-off-by: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
---
 selinux/ipa.if | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/selinux/ipa.if b/selinux/ipa.if
index 783db8b78..8c47e7963 100644
--- a/selinux/ipa.if
+++ b/selinux/ipa.if
@@ -328,6 +328,25 @@ interface(`ipa_custodia_domtrans',`
 	domtrans_pattern($1, ipa_custodia_exec_t, ipa_custodia_t)
 ')
 
+######################################
+## <summary>
+##	Execute ipa-pki-retrieve-key in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ipa_pki_retrieve_key_exec',`
+	gen_require(`
+		type ipa_pki_retrieve_key_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, ipa_pki_retrieve_key_exec_t)
+')
+
 ######################################
 ## <summary>
 ##	Execute ipa_custodia in the caller domain.