diff options
| author | Simo Sorce <simo@redhat.com> | 2014-05-01 13:16:14 -0400 |
|---|---|---|
| committer | Simo Sorce <simo@redhat.com> | 2014-05-01 21:05:45 -0400 |
| commit | c6e97e93a61b02602f14606a60b6154880308123 (patch) | |
| tree | 697ee43a3976d8d305637a6d5dcabd22f271f059 /ipsilon/login/authpam.py | |
| parent | 2c888a62a0c21114b51fd79d5321d5fed39f0b6e (diff) | |
| download | ipsilon-c6e97e93a61b02602f14606a60b6154880308123.tar.gz ipsilon-c6e97e93a61b02602f14606a60b6154880308123.tar.xz ipsilon-c6e97e93a61b02602f14606a60b6154880308123.zip | |
Make SELinux happy
Add proper context to shared state directories so that httpd can write there.
Relax SElinux boolans to allow use of pam modules
This allows running Ipsilon in fully enforcing mode when pam auth
using the python-pam modules is used.
Signed-off-by: Simo Sorce <simo@redhat.com>
Diffstat (limited to 'ipsilon/login/authpam.py')
| -rwxr-xr-x | ipsilon/login/authpam.py | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/ipsilon/login/authpam.py b/ipsilon/login/authpam.py index db409f7..14ebae4 100755 --- a/ipsilon/login/authpam.py +++ b/ipsilon/login/authpam.py @@ -22,6 +22,7 @@ from ipsilon.login.common import FACILITY from ipsilon.util.plugin import PluginObject import cherrypy import pam +import subprocess class Pam(LoginPageBase): @@ -185,3 +186,11 @@ class Installer(object): globalconf['order'] = ','.join(order) po.set_config(globalconf) po.save_plugin_config(FACILITY) + + # for selinux enabled platfroms, ignore if it fails just report + try: + subprocess.call(['/usr/sbin/setsebool', '-P', + 'httpd_mod_auth_pam=on', + 'httpd_tmp_t=on']) + except Exception: # pylint: disable=broad-except + pass |