ipa-client-install: enable SELinux for SSSD

[abbra]

For passkeys (FIDO2) support, SSSD uses libfido2 library which needs access to USB devices. Add SELinux booleans handling to ipa-client-install so that correct SELinux booleans can be enabled and disabled during install and uninstall. Ignore and record a warning when SELinux policy does not support the boolean.

Fixes: https://pagure.io/freeipa/issue/9434

[f-trivino]

I just have one concern, added a comment, otherwise LGTM.
This addresses well the passkeys on client side. Since this is the client we don't have issues with upgrade path.

[rcritten]

Should this be statestore.backup_state?

[abbra]

no. The task expects a function that is provided by the installation service which calls into statestore.backup_state(). See ipaserver/install/service.py:Service.backup_state():

   def backup_state(self, key, value):
        self.sstore.backup_state(self.service_name, key, value)

[rcritten]

The selinux state is not restored on uninstall. Since the new SSSD boolean wasn't available I picked a random one that was off, in this case xdm_write_home.

Uninstall fails because the [selinux] section remains in sysrestore.state:

[selinux]
xdm_write_home = off

[abbra]

thanks. I added statestore.delete_state() after resetting SELinux booleans.

[rcritten]

What we do in other places that SELinux is restored is this:

this example is from ipa_client_samba.py.

    # Restore the state of affected selinux booleans
    boolean_states = {}
    for usecase in constants.SELINUX_BOOLEAN_SMBSERVICE:
        for name in usecase:
            boolean_states[name] = statestore.restore_state("selinux", name)

    if boolean_states:
        set_selinux_booleans(boolean_states, statestore, backup=False)

or similar in httpinstance.py

        # Restore SELinux boolean states
        boolean_states = {name: self.restore_state(name)
                          for name in constants.SELINUX_BOOLEAN_HTTPD}
        try:
            tasks.set_selinux_booleans(boolean_states)
        except ipapython.errors.SetseboolError as e:
            self.print_msg('WARNING: ' + str(e))

[abbra]

That's exactly what my original code did.

[abbra]

I pushed the original code. restore_state() calls delete_state() if what was restored is not None.

[rcritten]

Ok I got the original failure reason wrong, in a way. This code needs to be moved (I moved it to 3627 in my testing). Right now it is conditioned on the state of whether SSSD was pre-configured. I think this SELinux code is independent of that.
With moving the code the original boolean values are restored and sysrestore.state removed.

[abbra]

I moved it out and conditioned on was_sssd_installed and selinux_works becase that's what we did when enabling the booleans (if sssd: ... if selinux_works: ..).

[rcritten]

Thanks, changes look good.

[flo-renaud]

master:

• d355761 ipa-client-install: enable SELinux for SSSD