freeipa

#9654 Update SELinux policy to mark IPA log files as ipa_log_t file context
Closed: fixed by frenaud. Opened by abbra.

Closed: fixed
Reopen Issue

We have multiple log files that produced by IPA components. Some of them are written by the tools that run as root and inherit their file context from /var/log -> var_log_t. However, increasingly we get tools that were run through oddjob helpers. These supposed to be run within ipa_helper_t
SELinux context which has write permissions for ipa_log_t file context.

List of files can be found by running the following script:

$ git grep '_LOG = .*ipa.*\.log' ipaplatform/base/paths.py | cut -d= -f2 | \
      xargs -I% echo -e "%\t--\tgen_context(system_u:object_r:ipa_log_t,s0)"
/var/log/ipabackup.log  --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipaclient-install.log  --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipaclient-uninstall.log        --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipaclientsamba-install.log     --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipaclientsamba-uninstall.log   --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipareplica-ca-install.log      --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipareplica-conncheck.log       --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipareplica-install.log --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/iparestore.log --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipaserver-enable-sid.log       --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipaserver-install.log  --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipaserver-adtrust-install.log  --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipaserver-dns-install.log      --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipaserver-kra-install.log      --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipaserver-uninstall.log        --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipaupgrade.log --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipatrust-enable-agent.log      --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipaepn.log     --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipa-custodia.audit.log --      gen_context(system_u:object_r:ipa_log_t,s0)
/var/log/ipa-migrate.log        --      gen_context(system_u:object_r:ipa_log_t,s0)

Debian platform adoptation has one file different to this list. It should be dealt with by Debian maintainers if they want to use SELinux policies.

PR: https://github.com/freeipa/freeipa/pull/7505

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-40376, https://issues.redhat.com/browse/RHEL-47294

master:

  • 2959c989942a96ef93bffd5b308c36d3fec5542f selinux: add all IPA log files to ipa_log_t file context

ipa-4-12:

  • 42eb97ee6bd8011b590aef321d4386ea9352933d selinux: add all IPA log files to ipa_log_t file context

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.