Fixes #37999 - allow smart-proxy with PuppetCA to read some etc files

[PopiBrossard]

Dear maintainer,

The current foreman-proxy SELinux policy isn't working when trying to use the PuppetCA feature. The proxy tries to read some files in /etc/foreman-proxy but is not allowed:

type=AVC msg=audit(1721979897.417:100790): avc:  denied  { read } for  pid=731469 comm="smart-proxy" name="puppetca_hostname_whitelisting.yml" dev="dm-0" ino=33791767 scontext=system_u:system_r:foreman_proxy_t:s0 tcontext=system_u:object_r:hostname_etc_t:s0 tclass=file permissive=1
type=AVC msg=audit(1721979897.417:100790): avc:  denied  { open } for  pid=731469 comm="smart-proxy" path="/etc/foreman-proxy/settings.d/puppetca_hostname_whitelisting.yml" dev="dm-0" ino=33791767 scontext=system_u:system_r:foreman_proxy_t:s0 tcontext=system_u:object_r:hostname_etc_t:s0 tclass=file permissive=1
type=AVC msg=audit(1721979897.417:100791): avc:  denied  { ioctl } for  pid=731469 comm="smart-proxy" path="/etc/foreman-proxy/settings.d/puppetca_hostname_whitelisting.yml" dev="dm-0" ino=33791767 ioctlcmd=0x5401 scontext=system_u:system_r:foreman_proxy_t:s0 tcontext=system_u:object_r:hostname_etc_t:s0 tclass=file permissive=1
type=AVC msg=audit(1721979897.417:100792): avc:  denied  { getattr } for  pid=731469 comm="smart-proxy" path="/etc/foreman-proxy/settings.d/puppetca_hostname_whitelisting.yml" dev="dm-0" ino=33791767 scontext=system_u:system_r:foreman_proxy_t:s0 tcontext=system_u:object_r:hostname_etc_t:s0 tclass=file permissive=1

To make this work, I've created a new file type foreman_proxy_etc_t and added the minimum privileges.

Regards

[ekohl]

Technically we never finished the Foreman Proxy policy, so it doesn't surprise me it's broken. I'd be happy to merge improvements though

[PopiBrossard]

Dear maintainer,
Should I do anything to permit this merge request ?
Thanks,

[ekohl]

Sorry, I should have explained that before in my comment. Could you open a Redmine issue on https://projects.theforeman.org/projects/selinux and link it here? We mostly use it to generate correct release notes.

[PopiBrossard]

I've created an issue as requested. The redmine issue is https://projects.theforeman.org/issues/37999

[ekohl]

Thanks for that. The check looks at the git commit, not the PR title. If you can amend your commit to update the title then I expect the Redmine issues check to pass.