Bug 1443557

Summary:	Store GSSAPI session key in /var/run/httpd directory instead of /etc/httpd/alias
Product:	Red Hat Enterprise Linux 7	Reporter:	Lukas Vrabec <lvrabec>
Component:	selinux-policy	Assignee:	Lukas Vrabec <lvrabec>
Status:	CLOSED DUPLICATE	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	7.4	CC:	cheimes, jpazdziora, ksiddiqu, lvrabec, mbabinsk, mbasti, mgrepl, mmalik, mreznik, mvarun, ndehadra, plautrba, ppicka, pvoborni, pvrabec, rcritten, slaznick, spoore, ssekidde, ssorce, sumenon, tscherf
Target Milestone:	rc	Keywords:	Regression, TestBlocker
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1436689	Environment:
Last Closed:	2017-05-09 12:14:34 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1436689
Bug Blocks:

Comment 3 Martin Babinsky 2017-04-27 10:37:21 UTC

Fixed upstream
master:
https://pagure.io/freeipa/c/2bab2d4963daa99742875f3633a99966bc56f5a3
ipa-4-5:
https://pagure.io/freeipa/c/b2aa3ed0bc9f5385ab6e8b1720d9f1d33136e5dc

Comment 4 Simo Sorce 2017-04-27 12:32:58 UTC

Nack

Comment 5 Petr Vobornik 2017-04-27 13:22:47 UTC

The patch in comment 3 is wrong, moving to ASSIGNED. 

https://www.redhat.com/archives/freeipa-devel/2017-April/msg00643.html

Comment 6 Martin Bašti 2017-04-28 11:00:08 UTC

Lukas, in current situation the most feasible for us is the second solution:

"""
Second solution is to create SELinux filename transition, where we allow to create file with specific name "ipasession.key" in /etc/httpd/alias with some new SELinux context. So httpd_t domain gets write access just to this new type instead of writing to cert_t. 
"""

could you please do it in Selinux policy?

Comment 10 Lukas Vrabec 2017-05-09 12:14:34 UTC


*** This bug has been marked as a duplicate of bug 1436689 ***