From 706c00361544a8255c4c05b253e5e9969187a68c Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 14 Jul 2015 11:11:36 +0000 Subject: selinux: enable httpd_run_ipa to allow communicating with oddjobd services A new SELinux policy allows communication between IPA framework running under Apache with oddjobd-based services via DBus. This communication is crucial for one-way trust support and also is required for any out of band tools which may be executed by IPA framework. Details of out of band communication and SELinux policy can be found in a bug https://bugzilla.redhat.com/show_bug.cgi?id=1238165 Reviewed-By: Tomas Babej --- freeipa.spec.in | 2 +- ipaserver/install/httpinstance.py | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/freeipa.spec.in b/freeipa.spec.in index d9ed9c3f6..bfc021618 100644 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -8,7 +8,7 @@ %global selinux_policy_version 3.12.1-153 %else %global samba_version 2:4.0.5-1 -%global selinux_policy_version 3.12.1-179 +%global selinux_policy_version 3.13.1-128.6 %endif %define krb5_base_version %(LC_ALL=C rpm -q --qf '%%{VERSION}' krb5-devel | grep -Eo '^[^.]+\.[^.]+') diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py index f5f2a86fc..792825621 100644 --- a/ipaserver/install/httpinstance.py +++ b/ipaserver/install/httpinstance.py @@ -46,6 +46,7 @@ from ipaplatform import services SELINUX_BOOLEAN_SETTINGS = dict( httpd_can_network_connect='on', httpd_manage_ipa='on', + httpd_run_ipa='on', ) -- cgit