Bug 1242914
| Summary: | Bump minimal selinux-policy and add booleans to allow calling out oddjobd-activated services | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Petr Vobornik <pvoborni> |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> |
| Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.2 | CC: | dpal, jcholast, ksiddiqu, rcritten, sumenon, tbabej |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.2.0-3.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-11-19 12:04:16 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1238163 | ||
| Bug Blocks: | |||
|
Description
Petr Vobornik
2015-07-14 11:52:11 UTC
Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/706c00361544a8255c4c05b253e5e9969187a68c/ ipa-4-2: https://fedorahosted.org/freeipa/changeset/5b9ea329cef4d976694794f1b1b91714f6ac07c2/ Pls add steps to verify To verify: 1. Run ipa-server-install on the server 2. Configure trust-related components by running ipa-adtrust-install 3. Make sure SELinux is set to enforcing 4. Add an one-way trust to an AD domain 5. The trust is established (setup will not fail due to SELinux denials) Tomas,
Can you please confirm if this what is expected from the fix.
Verified using RHEL7.2 and Windows 2012 R2
ipa-server-4.2.0-12.el7.x86_64
ipa-server-dns-4.2.0-12.el7.x86_64
ipa-server-trust-ad-4.2.0-12.el7.x86_64
sssd-1.13.0-36.el7.x86_64
[root@ipa01 ~]# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Max kernel policy version: 28
[root@ipa01 ~]# getsebool -a | grep httpd_run
httpd_run_ipa --> on
[root@ipa01 ~]# ipa trust-add
Realm name: TEST.IN
Active Directory domain administrator: administrator
Active Directory domain administrator's password:
------------------------------------------------
Added Active Directory trust for realm "test.in"
------------------------------------------------
Realm name: test.in
Domain NetBIOS name: TEST
Domain Security Identifier: S-1-5-21-742749997-2996825573-4184801258
SID blacklist incoming: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6, S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-17,
S-1-5-16, S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11, S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19,
S-1-5-18
SID blacklist outgoing: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6, S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-17,
S-1-5-16, S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11, S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19,
S-1-5-18
Trust direction: Trusting forest
Trust type: Active Directory domain
Trust status: Established and verified
This is sufficient as a verification provided IPA configured the SELinux httpd_run_ipa boolean. IPA configured the SELinux httpd_run_ipa boolean. Hence marking the bug as verified. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2362.html |