From e527dd17e89c0826d55d4a214c176fb00e383eef Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Oct 18 2017 10:11:40 +0000 Subject: Block PyOpenSSL to prevent SELinux execmem in wsgi Some dependencies like Dogtag's pki.client library and custodia use python-requsts to make HTTPS connection. python-requests prefers PyOpenSSL over Python's stdlib ssl module. PyOpenSSL is build on top of python-cryptography which trigger a execmem SELinux violation in the context of Apache HTTPD (httpd_execmem). When requests is imported, it always tries to import pyopenssl glue code from urllib3's contrib directory. The import of PyOpenSSL is enough to trigger the SELinux denial. Block any import of PyOpenSSL's SSL module in wsgi by raising an ImportError. The block is compatible with new python-requests with unbundled urllib3, too. Fixes: https://pagure.io/freeipa/issue/5442 Fixes: RHBZ#1491508 Signed-off-by: Christian Heimes Reviewed-By: Alexander Bokovoy Reviewed-By: Tomas Krizek --- diff --git a/install/share/wsgi.py b/install/share/wsgi.py index ca97d1e..2e16f75 100644 --- a/install/share/wsgi.py +++ b/install/share/wsgi.py @@ -23,6 +23,19 @@ """ WSGI appliction for IPA server. """ +import sys + +# Some dependencies like Dogtag's pki.client library and custodia use +# python-requsts to make HTTPS connection. python-requests prefers +# PyOpenSSL over Python's stdlib ssl module. PyOpenSSL is build on top +# of python-cryptography which trigger a execmem SELinux violation +# in the context of Apache HTTPD (httpd_execmem). +# When requests is imported, it always tries to import pyopenssl glue +# code from urllib3's contrib directory. The import of PyOpenSSL is +# enough to trigger the SELinux denial. +# Block any import of PyOpenSSL's SSL module by raising an ImportError +sys.modules['OpenSSL.SSL'] = None + from ipaplatform.paths import paths from ipalib import api from ipalib.config import Env