From 820beca4ac2aaa00a713e0bf5e50ecf79fe89dfc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
Date: Mon, 21 Sep 2020 11:32:52 +0200
Subject: [PATCH] SELinux Policy: ipa_pki_retrieve_key_exec_t =>
 ipa_pki_retrieve_key_t
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Grant pki_manage_tomcat_etc_rw to ipa_pki_retrieve_key_t instead of
ipa_pki_retrieve_key_exec_t.
As suggested by Ondrej Mosnáček.

Fixes: https://pagure.io/freeipa/issue/8488
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
---
 selinux/ipa.te | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/selinux/ipa.te b/selinux/ipa.te
index 0a9ccaf83..92a3b2359 100644
--- a/selinux/ipa.te
+++ b/selinux/ipa.te
@@ -78,6 +78,8 @@ type node_t;
 type ipa_pki_retrieve_key_exec_t;
 init_script_file(ipa_pki_retrieve_key_exec_t)
 
+type ipa_pki_retrieve_key_t;
+
 ########################################
 #
 # ipa_otpd local policy
@@ -422,7 +424,7 @@ optional_policy(`
         type tomcat_t;
     ')
     can_exec(tomcat_t, ipa_pki_retrieve_key_exec_t)
-    pki_manage_tomcat_etc_rw(ipa_pki_retrieve_key_exec_t)
+    pki_manage_tomcat_etc_rw(ipa_pki_retrieve_key_t)
 ')
 
 optional_policy(`