documented certmonger integration does not work

[martinpitt]

Reported on the mailing list:

$ getcert request -f ${CERT_FILE} -k ${KEY_FILE} -D $(hostname --fqdn) -C \
"sed -n w/etc/cockpit/ws-certs.d/50-from-certmonger.cert ${CERT_FILE} \
${KEY_FILE}"

reportedly failed with

type=AVC msg=audit(1633548839.586:8895): avc:  denied  { create } for
  pid=836449 comm="sed" name="50-from-certmonger.cert"
scontext=system_u:
system_r:certmonger_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=0

/etc/cockpit/ws-certs.d should be certs_t instead of etc_t to make this work.

Let's fix the documentation at least, but possibly also the default permissions of the certs dir. We don't test this in CI, let's add a test to make sure this keeps working.

After that, the file permissions need updating so that cockpit-ws can read that. This is a separate issue though, we should generally stop relying on file perms and just copy the cert to /run in a pre-start command.

[martinpitt]

Steps:

• Fix type of cert dir: chcon -t cert_t /etc/cockpit/ws-certs.d/

• Drop the seddery from the command, as cockpit has supported split certificates for a long time. Instead, give certmonger the
  expected permissions:

   getcert request -f /etc/cockpit/ws-certs.d/50-certmonger.cert -k /etc/cockpit/ws-certs.d/50-certmonger.key -m 640 -o root:cockpit-ws -M 644 --ca=local
  

• Write an integration test

I did this manually, and it works.

[martinpitt]

@vmojzis @zpytela: I'm afraid I need a little help here: I am trying to change /etc/cockpit/ws-certs.d/ from the default etc_t to cert_t. As far as I understand, I'd need a new line in cockpit.fc like this:

/etc/cockpit/ws-certs.d(/.*)?	--	gen_context(system_u:object_r:cert_t,s0)

This builds fine, and installing the package also doesn't throw any error -- other than "libsemanage.semanage_direct_install_info: Overriding cockpit module at lower priority 100 with module at priority 200.", but that's been there before -- probably due to cockpit adopting its own policy.

However, when I upgrade, or even remove/install the built rpm, the file system permissions don't change:

#  ls -ldZ /etc/cockpit/ws-certs.d/
drwxr-xr-x. 2 root root system_u:object_r:etc_t:s0 4096 Oct 12 12:56 /etc/cockpit/ws-certs.d/

I also tried to restorecon, but no change. Do I need to do anything else than the .fc entry? Could this be a conflict with the global Fedora policy? (See fedora-selinux/selinux-policy#856)

Thanks!

[allisonkarlitskaya]

Interestingly, this same problem is exactly why we have certmonger in cockpit-certificate-helper (for the IPA domain joining case) create the certificates in /run first and then move them over. This can probably be improved now, which would allow us to take advantage of the monitoring/refreshing.