Add SELinux policy for CRL file publishing.

This policy should really be provided by dogtag. We don't want
to grant read/write access to everything dogtag can handle so we
change the context to cert_t instead. But we have to let dogtag
read/write that too hence this policy.

To top it off we can't load this policy unless dogtag is also loaded
so we insert it in the IPA installer

2 files changed, 30 insertions, 0 deletions

diff --git a/selinux/ipa_dogtag/ipa_dogtag.fc b/selinux/ipa_dogtag/ipa_dogtag.fc
new file mode 100644
index 000000000..58a4b3e82
--- /dev/null
+++ b/selinux/ipa_dogtag/ipa_dogtag.fc
@@ -0,0 +1 @@
+/var/lib/pki-ca/publish(/.*)?	gen_context(system_u:object_r:cert_t,s0)
diff --git a/selinux/ipa_dogtag/ipa_dogtag.te b/selinux/ipa_dogtag/ipa_dogtag.te
new file mode 100644
index 000000000..b3fce00da
--- /dev/null
+++ b/selinux/ipa_dogtag/ipa_dogtag.te
@@ -0,0 +1,29 @@
+module ipa_dogtag 1.2;
+
+require {
+	type httpd_t;
+	type cert_t;
+	type pki_ca_t;
+	class dir write;
+	class dir add_name;
+	class dir remove_name;
+	class file create;
+	class file write;
+	class file rename;
+	class lnk_file create;
+	class lnk_file rename;
+}
+
+# Let dogtag write to cert_t directories
+allow pki_ca_t cert_t:dir write;
+allow pki_ca_t cert_t:dir add_name;
+allow pki_ca_t cert_t:dir remove_name;
+
+# Let dogtag write cert_t files
+allow pki_ca_t cert_t:file create;
+allow pki_ca_t cert_t:file write;
+allow pki_ca_t cert_t:file rename;
+
+# Let dogtag manage cert_t symbolic links
+allow pki_ca_t cert_t:lnk_file create;
+allow pki_ca_t cert_t:lnk_file rename;