URL: https://github.com/freeipa/freeipa/pull/755 Author: MartinBasti Title: #755: Use proper SELinux context with http.keytab Action: opened
PR body: """ During upgrade keytab is moved to a new location using "move" operation. This commit replaces move operation with "copy" and "remove" that ensures a proper selinux context. https://pagure.io/freeipa/issue/6924 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/755/head:pr755 git checkout pr755
From ad8792f3c841ae859c1e0abcc953be96224e55ff Mon Sep 17 00:00:00 2001 From: Martin Basti <mba...@redhat.com> Date: Wed, 3 May 2017 13:51:02 +0200 Subject: [PATCH] Use proper SELinux context with http.keytab During upgrade keytab is moved to a new location using "move" operation. This commit replaces move operation with "copy" and "remove" that ensures a proper selinux context. https://pagure.io/freeipa/issue/6924 --- ipaserver/install/server/upgrade.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py index 0f27428..21ecb15 100644 --- a/ipaserver/install/server/upgrade.py +++ b/ipaserver/install/server/upgrade.py @@ -1427,7 +1427,14 @@ def update_ipa_httpd_service_conf(http): def update_http_keytab(http): root_logger.info('[Moving HTTPD service keytab to gssproxy]') if os.path.exists(paths.OLD_IPA_KEYTAB): - shutil.move(paths.OLD_IPA_KEYTAB, http.keytab) + shutil.copy(paths.OLD_IPA_KEYTAB, http.keytab) # SELINUX + try: + os.remove(paths.OLD_IPA_KEYTAB) + except OSError as e: + root_logger.error( + 'Cannot remove file %s (%s). Please remove file manually.', + paths.OLD_IPA_KEYTAB, e + ) pent = pwd.getpwnam(http.keytab_user) os.chown(http.keytab, pent.pw_uid, pent.pw_gid)
-- Manage your subscription for the Freeipa-devel mailing list: https://www.redhat.com/mailman/listinfo/freeipa-devel Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code
