Rebase to krb5 1.22.2
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'failed'.
FYI, We've changed SELinux policy in FreeIPA to allow standalone use of SSSD helpers on non-enrolled systems. However, https://openqa.fedoraproject.org/tests/4300757#step/role_deploy_domain_controller/19 shows that SSSD subpackage cannot be installed with new SELinux context.
I am not sure what specifically should I do here, perhaps we have to update main Fedora SELinux policy in the same bodhi update as well?
I have rules for setfiles_t to relabel the files but it seems dnf runs unconfined and that rule does not exist:
time->Tue Feb 17 03:07:08 2026 type=AVC msg=audit(1771315628.219:384): avc: denied { relabelto } for pid=1412 comm="dnf" name="oidc_child;6994219a" dev="dm-0" ino=5432835 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=0 ---- time->Tue Feb 17 03:07:09 2026 type=AVC msg=audit(1771315629.947:434): avc: denied { relabelto } for pid=1412 comm="dnf" name="passkey_child;6994219a" dev="dm-0" ino=5442824 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=0
abbra edited this update.
New build(s):
Removed build(s):
Karma has been reset.
Ok, looks like pk-backend needs the same set of operations permitted as with the unconfined_t domain. I'll work on that tonight.
This update's test gating status has been changed to 'passed'.
This update has been submitted for stable by bodhi
Please log in to add feedback.
Confirm request to re-trigger tests.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'failed'.
FYI, We've changed SELinux policy in FreeIPA to allow standalone use of SSSD helpers on non-enrolled systems. However, https://openqa.fedoraproject.org/tests/4300757#step/role_deploy_domain_controller/19 shows that SSSD subpackage cannot be installed with new SELinux context.
I am not sure what specifically should I do here, perhaps we have to update main Fedora SELinux policy in the same bodhi update as well?
I have rules for setfiles_t to relabel the files but it seems dnf runs unconfined and that rule does not exist:
abbra edited this update.
New build(s):
Removed build(s):
Karma has been reset.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'failed'.
abbra edited this update.
New build(s):
Removed build(s):
Karma has been reset.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'failed'.
Ok, looks like pk-backend needs the same set of operations permitted as with the unconfined_t domain. I'll work on that tonight.
abbra edited this update.
New build(s):
Removed build(s):
Karma has been reset.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'failed'.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'failed'.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'failed'.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'passed'.
This update has been submitted for stable by bodhi