freeipa

#9948 Extend SELinux policy to allow use of SSSD authentication helpers on non-enrolled hosts
Closed: fixed by frenaud. Opened by abbra.

Closed: fixed
Reopen Issue

Right now SELinux policy provided by FreeIPA only allows to run SSSD helpers oidc_child and passkey_child within ipa_otpd_t context. This assumes that they are launched by ipa-otpd daemon as part of the Kerberos TGT processing on IPA domain controller.

SSSD allows to authenticate with oidc_child and passkey_child on standalone deployments as well. We need to extend the SELinux policy to permit these usages.

Additionally, MIT Kerberos 1.22 in Fedora provides automated FAST channel acquisition on IPA enrolled clients. This requires any application using libkrb5 to get access to publicly available certificate data stored by IPA client. Extend SELinux policy to allow this access.

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/8096

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-151578, https://issues.redhat.com/browse/RHEL-151581

master:

  • b426af86eac187743ea9be84571d55e198c71b77 SELinux: expand policy coverage for Kerberos usage
  • c71c9b1aa57a7de802b51485a3ef8163c66a1833 ipa-sam: use internal Samba method to populate in-memory keytab

Hi, after upgrading freeipa packages on my Fedora Silverblue 43 to version 4.13.1-5 (which I think contain this patch), some AVC appears preventing rpm-ostree to update or add new packages.

----
time->Sat Feb 28 00:34:31 2026
type=AVC msg=audit(1772213671.642:313): avc:  denied  { getattr } for  pid=12004 comm="ls" name="oidc_child" dev="erofs" ino=58065 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=0
----
time->Sat Feb 28 00:34:31 2026
type=AVC msg=audit(1772213671.643:314): avc:  denied  { getattr } for  pid=12004 comm="ls" name="passkey_child" dev="erofs" ino=58075 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=0
----
time->Sat Feb 28 00:35:32 2026
type=AVC msg=audit(1772213732.992:657): avc:  denied  { getattr } for  pid=8188 comm="pool-2" path="/sysroot/ostree/repo/objects/b4/d5d0043441967922c4eedd55d7fd4ff3c601a3f2579d17f6059dd99d017f10.file" dev="nvme0n1p6" ino=29524058 scontext=system_u:system_r:install_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=0

Relevant journal logs:

Feb 28 00:34:51 evangeline rpm-ostree[8188]: Regenerating rpmdb for target
Feb 28 00:35:20 evangeline systemd[1]: Starting systemd-tmpfiles-clean.service - Cleanup of Temporary Directories...
Feb 28 00:35:20 evangeline systemd-tmpfiles[12772]: /usr/lib/tmpfiles.d/var.conf:21: Duplicate line for path "/var/lib", ignoring.
Feb 28 00:35:20 evangeline systemd[1]: systemd-tmpfiles-clean.service: Deactivated successfully.
Feb 28 00:35:20 evangeline systemd[1]: Finished systemd-tmpfiles-clean.service - Cleanup of Temporary Directories.
Feb 28 00:35:20 evangeline audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-tmpfiles-clean comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Feb 28 00:35:20 evangeline audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-tmpfiles-clean comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Feb 28 00:35:32 evangeline audit[8188]: AVC avc:  denied  { getattr } for  pid=8188 comm="pool-2" path="/sysroot/ostree/repo/objects/b4/d5d0043441967922c4eedd55d7fd4ff3c601a3f2579d17f6059dd99d017f10.file" dev="nvme0n1p6" ino=29524058 scontext=system_u:system_r:install_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=0
Feb 28 00:35:33 evangeline rpm-ostree[8188]: Txn UpdateDeployment on /org/projectatomic/rpmostree1/fedora failed: Committing: Writing content object: fstatat(b4/d5d0043441967922c4eedd55d7fd4ff3c601a3f2579d17f6059dd99d017f10.file): Permission denied

Can you please open this as a bug in Fedora bugzilla against the main selinux policy?
I'm hesitant to add anything for kernel_t -> sssd_mfa_exec_t, this should be solved by the main selinux policy instead.

Sure. I think the kernel_t AVCs are from my attempt to do ls -lsaZ. The rpm-ostree one is install_t. I think I will need some time to reset my ostree overlay first and do rpm-ostree operations in permissive mode too. Thanks.

ipa-4-13:

  • fd2ca1c099d4c95868c740e1957252300b9d4019 SELinux: expand policy coverage for Kerberos usage
  • b06460bddd16dea69fe941bf1e2656de0c7e0c27 ipa-sam: use internal Samba method to populate in-memory keytab

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

A regression is seen in test_idp.py, reopening.

Metadata Update from @frenaud:
- Issue status updated to: Open (was: Closed)

master:

  • fcbed45f61cbadb3029d57440a364368b8f2428b SELinux: transition ipa_otpd_t to sssd_mfa_t when executing MFA helpers
  • 5ba65221fa8c857cee59fc112f09e1bbb3160b22 SELinux: wrap bare gen_require blocks in optional_policy in dnskey section
  • cc4a4839c2dcd28db318d13739b779dab0d76db6 SELinux: expand policy coverage for sssd_mfa_t domain

ipa-4-13:

  • 3bef9cbdbe154c06b9b253d7d7bd005c28df3f39 SELinux: transition ipa_otpd_t to sssd_mfa_t when executing MFA helpers
  • 8932b7894027dc2c7927f15d801c69e1bb9b14d6 SELinux: wrap bare gen_require blocks in optional_policy in dnskey section
  • 509b93d7a1bc316a6919c4d5c36ab30433c2d27a SELinux: expand policy coverage for sssd_mfa_t domain

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/8096
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.