RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1242914 - Bump minimal selinux-policy and add booleans to allow calling out oddjobd-activated services
Summary: Bump minimal selinux-policy and add booleans to allow calling out oddjobd-act...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.2
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Namita Soman
URL:
Whiteboard:
Depends On: 1238163
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-07-14 11:52 UTC by Petr Vobornik
Modified: 2015-11-19 12:04 UTC (History)
6 users (show)

Fixed In Version: ipa-4.2.0-3.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-11-19 12:04:16 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:2362 0 normal SHIPPED_LIVE ipa bug fix and enhancement update 2015-11-19 10:40:46 UTC

Description Petr Vobornik 2015-07-14 11:52:11 UTC 
Description of problem:
Bug 1238163 adds SELinux policy for oddjob activated service required for one way trust.

IPA needs to require this policy and set SELinux boolean httpd_run_ipa='on'

Version-Release number of selected component (if applicable):
ipa-4.2.x
Comment 2 Jan Cholasta 2015-07-23 14:03:50 UTC 
Fixed upstream:
master:
https://fedorahosted.org/freeipa/changeset/706c00361544a8255c4c05b253e5e9969187a68c/
ipa-4-2:
https://fedorahosted.org/freeipa/changeset/5b9ea329cef4d976694794f1b1b91714f6ac07c2/
Comment 3 Namita Soman 2015-07-23 19:03:29 UTC 
Pls add steps to verify
Comment 5 Tomas Babej 2015-08-04 10:10:23 UTC 
To verify:

1. Run ipa-server-install on the server
2. Configure trust-related components by running ipa-adtrust-install
3. Make sure SELinux is set to enforcing
4. Add an one-way trust to an AD domain
5. The trust is established (setup will not fail due to SELinux denials)
Comment 6 Sudhir Menon 2015-10-07 13:13:57 UTC 
Tomas,

Can you please confirm if this what is expected from the fix.

Verified using RHEL7.2 and Windows 2012 R2
ipa-server-4.2.0-12.el7.x86_64
ipa-server-dns-4.2.0-12.el7.x86_64
ipa-server-trust-ad-4.2.0-12.el7.x86_64
sssd-1.13.0-36.el7.x86_64

[root@ipa01 ~]# sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28

[root@ipa01 ~]# getsebool -a | grep httpd_run
httpd_run_ipa --> on

[root@ipa01 ~]# ipa trust-add 
Realm name: TEST.IN
Active Directory domain administrator: administrator
Active Directory domain administrator's password: 
------------------------------------------------
Added Active Directory trust for realm "test.in"
------------------------------------------------
  Realm name: test.in
  Domain NetBIOS name: TEST
  Domain Security Identifier: S-1-5-21-742749997-2996825573-4184801258
  SID blacklist incoming: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6, S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-17,
                          S-1-5-16, S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11, S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19,
                          S-1-5-18
  SID blacklist outgoing: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6, S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-17,
                          S-1-5-16, S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11, S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19,
                          S-1-5-18
  Trust direction: Trusting forest
  Trust type: Active Directory domain
  Trust status: Established and verified
Comment 7 Tomas Babej 2015-10-07 14:05:30 UTC 
This is sufficient as a verification provided IPA configured the SELinux httpd_run_ipa boolean.
Comment 8 Sudhir Menon 2015-10-07 14:34:24 UTC 
IPA configured the SELinux httpd_run_ipa boolean.
Hence marking the bug as verified.
Comment 9 errata-xmlrpc 2015-11-19 12:04:16 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2362.html
Note You need to log in before you can comment on or make changes to this bug.