diff options
author | Simo Sorce <simo@redhat.com> | 2014-05-01 13:16:14 -0400 |
---|---|---|
committer | Simo Sorce <simo@redhat.com> | 2014-05-01 21:05:45 -0400 |
commit | c6e97e93a61b02602f14606a60b6154880308123 (patch) | |
tree | 697ee43a3976d8d305637a6d5dcabd22f271f059 /ipsilon | |
parent | 2c888a62a0c21114b51fd79d5321d5fed39f0b6e (diff) | |
download | ipsilon-c6e97e93a61b02602f14606a60b6154880308123.tar.gz ipsilon-c6e97e93a61b02602f14606a60b6154880308123.tar.xz ipsilon-c6e97e93a61b02602f14606a60b6154880308123.zip |
Make SELinux happy
Add proper context to shared state directories so that httpd can write there.
Relax SElinux boolans to allow use of pam modules
This allows running Ipsilon in fully enforcing mode when pam auth
using the python-pam modules is used.
Signed-off-by: Simo Sorce <simo@redhat.com>
Diffstat (limited to 'ipsilon')
-rwxr-xr-x | ipsilon/install/ipsilon-server-install | 5 | ||||
-rwxr-xr-x | ipsilon/login/authpam.py | 9 |
2 files changed, 14 insertions, 0 deletions
diff --git a/ipsilon/install/ipsilon-server-install b/ipsilon/install/ipsilon-server-install index b5a6371..d9e4585 100755 --- a/ipsilon/install/ipsilon-server-install +++ b/ipsilon/install/ipsilon-server-install @@ -28,6 +28,7 @@ import os import pwd import shutil import socket +import subprocess import sys import time @@ -137,6 +138,10 @@ def install(plugins, args): # Fixup permissions so only the ipsilon user can read these files files.fix_user_dirs(instance_conf, opts['system_user'], mode=0500) files.fix_user_dirs(args['data_dir'], opts['system_user']) + try: + subprocess.call(['/usr/sbin/restorecon', '-R', args['data_dir']]) + except Exception: # pylint: disable=broad-except + pass def uninstall(plugins, args): logger.info('Uninstallation initiated') diff --git a/ipsilon/login/authpam.py b/ipsilon/login/authpam.py index db409f7..14ebae4 100755 --- a/ipsilon/login/authpam.py +++ b/ipsilon/login/authpam.py @@ -22,6 +22,7 @@ from ipsilon.login.common import FACILITY from ipsilon.util.plugin import PluginObject import cherrypy import pam +import subprocess class Pam(LoginPageBase): @@ -185,3 +186,11 @@ class Installer(object): globalconf['order'] = ','.join(order) po.set_config(globalconf) po.save_plugin_config(FACILITY) + + # for selinux enabled platfroms, ignore if it fails just report + try: + subprocess.call(['/usr/sbin/setsebool', '-P', + 'httpd_mod_auth_pam=on', + 'httpd_tmp_t=on']) + except Exception: # pylint: disable=broad-except + pass |