|
 |
5f5010d |
From 3c106c400b9946405289fc5f6b57a76d08667b50 Mon Sep 17 00:00:00 2001
|
|
|
5f5010d |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
5f5010d |
Date: Thu, 1 Sep 2016 17:04:06 +0300
|
|
 |
1e16388 |
Subject: [PATCH] Workarounds for SELinux execmem violations in cryptography
|
|
|
a33b200 |
|
|
|
b2442d5 |
pki.client no longer tries to use PyOpenSSL instead of Python's ssl
|
|
|
b2442d5 |
module.
|
|
|
b2442d5 |
|
|
|
a33b200 |
Some dependencies like Dogtag's pki.client library and custodia use
|
|
|
a33b200 |
python-requsts to make HTTPS connection. python-requests prefers
|
|
|
a33b200 |
PyOpenSSL over Python's stdlib ssl module. PyOpenSSL is build on top
|
|
|
a33b200 |
of python-cryptography which trigger a execmem SELinux violation
|
|
|
a33b200 |
in the context of Apache HTTPD (httpd_execmem).
|
|
|
5f5010d |
|
|
|
a33b200 |
When requests is imported, it always tries to import pyopenssl glue
|
|
|
a33b200 |
code from urllib3's contrib directory. The import of PyOpenSSL is
|
|
|
a33b200 |
enough to trigger the SELinux denial.
|
|
|
5f5010d |
|
|
|
a33b200 |
A hack in wsgi.py prevents the import by raising an ImportError.
|
|
|
a33b200 |
---
|
|
|
a33b200 |
install/share/wsgi.py | 14 ++++++++++++++
|
|
|
5f5010d |
1 file changed, 14 insertions(+)
|
|
|
a33b200 |
|
|
|
a33b200 |
diff --git a/install/share/wsgi.py b/install/share/wsgi.py
|
|
|
5f5010d |
index ee9311e..bb201fa 100644
|
|
|
a33b200 |
--- a/install/share/wsgi.py
|
|
|
a33b200 |
+++ b/install/share/wsgi.py
|
|
|
a33b200 |
@@ -23,6 +23,20 @@
|
|
|
a33b200 |
"""
|
|
|
a33b200 |
WSGI appliction for IPA server.
|
|
|
a33b200 |
"""
|
|
|
a33b200 |
+import sys
|
|
|
a33b200 |
+
|
|
|
a33b200 |
+# Some dependencies like Dogtag's pki.client library and custodia use
|
|
|
a33b200 |
+# python-requsts to make HTTPS connection. python-requests prefers
|
|
|
a33b200 |
+# PyOpenSSL over Python's stdlib ssl module. PyOpenSSL is build on top
|
|
|
a33b200 |
+# of python-cryptography which trigger a execmem SELinux violation
|
|
|
a33b200 |
+# in the context of Apache HTTPD (httpd_execmem).
|
|
|
a33b200 |
+# When requests is imported, it always tries to import pyopenssl glue
|
|
|
a33b200 |
+# code from urllib3's contrib directory. The import of PyOpenSSL is
|
|
|
a33b200 |
+# enough to trigger the SELinux denial.
|
|
|
a33b200 |
+# This hack prevents the import by raising an ImportError.
|
|
|
a33b200 |
+
|
|
|
a76abac |
+sys.modules['requests.packages.urllib3.contrib.pyopenssl'] = None
|
|
|
a33b200 |
+
|
|
|
a33b200 |
from ipalib import api
|
|
|
a33b200 |
from ipalib.config import Env
|
|
|
a33b200 |
from ipalib.constants import DEFAULT_CONFIG
|
|
|
a33b200 |
--
|
|
|
5f5010d |
2.7.4
|
|
|
a33b200 |
|