Bug 1609477

The directory /etc/httpd/alias/ does not exist after installation of freeIPA server related packages and it is not owned by any package. I assume it was created by freeIPA but with wrong SELinux context.

sh# rpm -qf /etc/httpd/alias/
file /etc/httpd/alias is not owned by any package

sh# ls -ldZ /etc/httpd/alias/
drwxr-xr-x. 2 root root system_u:object_r:httpd_config_t:s0 6 Jul 28 04:29 /etc/httpd/alias/
sh# matchpathcon /etc/httpd/alias/
/etc/httpd/alias        system_u:object_r:cert_t:s0

I assume you see this on an install?

I wonder if it is seeing if there are certs/keys to migrate.

It was clean installation. So I have no idea what should be migrated. You should know code better :-)

We need a place to store a session key used by mod_auth_gssapi. Previously we stored it in /etc/httpd/alias and it was allowed by SELinux rules. As we no longer install mod_nss, we create /etc/httpd/alias ourselves, as per ticket https://pagure.io/freeipa/issue/7529. 

However, I think we aren't restoring SELinux context on it.

The commit message for a fix of issue 7529 says:

commit 49b4a057f1b0459331bcec2c8d760627d00e4571
Author: Christian Heimes <cheimes>
Date:   Fri May 4 10:47:00 2018 +0200

    Create missing /etc/httpd/alias for ipasession.key
    
    The director /etc/httpd/alias was created by mod_nss. Since FreeIPA no
    longer depends on mod_nss, the directory is no longer created on fresh
    systems.
    
    Note: At first I wanted to move the file to /var/lib/ipa/private/ or
    /var/lib/httpd/. SELinux prevents write of httpd_t to ipa_var_lib_t. I'm
    going to move the file after a new SELinux policy is available.
    
    See: https://pagure.io/freeipa/issue/7529
    Signed-off-by: Christian Heimes <cheimes>
    Reviewed-By: Rob Crittenden <rcritten>


So first we need a new policy that allows httpd_t to write to ipa_var_lib_t to drop alias part completely.

(In reply to Alexander Bokovoy from comment #4)
> So first we need a new policy that allows httpd_t to write to ipa_var_lib_t
> to drop alias part completely.

NO,

ipa_var_lib_t is very general.
And it already works for for /etc/httpd/alias with right selinux context (cert_t instead of httpd_config_t). And there are already many places which has label cert_t if you do not want /etc/httpd/alias

sh# semanage fcontext -l | grep system_u:object_r:cert_t
/etc/(letsencrypt|certbot)/(live|archive)(/.*)?    all files          system_u:object_r:cert_t:s0 
/etc/docker/certs\.d(/.*)?                         all files          system_u:object_r:cert_t:s0 
/etc/httpd/alias(/.*)?                             all files          system_u:object_r:cert_t:s0 
/etc/ipa/nssdb(/.*)?                               all files          system_u:object_r:cert_t:s0 
/etc/pki(/.*)?                                     all files          system_u:object_r:cert_t:s0 
/etc/ssl(/.*)?                                     all files          system_u:object_r:cert_t:s0 
/usr/share/ca-certificates(/.*)?                   all files          system_u:object_r:cert_t:s0 
/usr/share/pki/ca-certificates(/.*)?               all files          system_u:object_r:cert_t:s0 
/usr/share/pki/ca-trust-source(/.*)?               all files          system_u:object_r:cert_t:s0 
/usr/share/ssl/certs(/.*)?                         all files          system_u:object_r:cert_t:s0 
/usr/share/ssl/private(/.*)?                       all files          system_u:object_r:cert_t:s0 
/var/lib/letsencrypt(/.*)?                         all files          system_u:object_r:cert_t:s0 
/var/named/chroot/etc/pki(/.*)?                    all files          system_u:object_r:cert_t:s0

Can we have freeipa restore the context on /etc/httpd/alias when it creates it, then, for now? These AVCs show up on every deployment test, I think.

(In reply to Adam Williamson from comment #6)
> Can we have freeipa restore the context on /etc/httpd/alias when it creates
> it, then, for now? These AVCs show up on every deployment test, I think.

BTW, installation of master, replica and client passed for me even with dontaudit rules. But running restorecon is propee quickfix.

Upstream ticket:
https://pagure.io/freeipa/issue/7662

master:

    f751697 httpinstance: Restore SELinux context of session_dir /etc/httpd/alias
    354d729 ipa_restore: Restore SELinux context of template_dir /var/log/dirsrv/slapd-X

(In reply to Rob Crittenden from comment #9)
> master:
> 
>     f751697 httpinstance: Restore SELinux context of session_dir
> /etc/httpd/alias
>     354d729 ipa_restore: Restore SELinux context of template_dir
> /var/log/dirsrv/slapd-X

Is there an ETA for fixing this in fedora? It would be good to reduce unnecessary AVC noise?

freeipa 4.7.1 has just been released and contains the fix:
https://www.freeipa.org/page/Releases/4.7.1

(In reply to Florence Blanc-Renaud from comment #11)
> freeipa 4.7.1 has just been released and contains the fix:
> https://www.freeipa.org/page/Releases/4.7.1

I would say it was fixed also in freeipa-4.7.0-3.fc28

https://bodhi.fedoraproject.org/updates/FEDORA-2018-e407241b53

Just nobody added this BZ to that bodhi update.

Indeed, I just checked the logs from a recent F28 FreeIPA deployment test in openQA and don't see these denials any more. Thanks.