Starting with FreeIPA 4.3 the ipaserver.dcerpc module uses python-cryptography for its RC4 code. The implementation has the same issue as #5442. As soon as ipaserver.dcerpc uses RC4 for the first time, it initializes cryptography's backend, which in return results into a SELinux violation and segfault of Apache HTTPD.
I have posted a patch that uses M2Crypto for RC4 on Python 2.7. M2Crypto was used for 4.2. On Python 3 the module still uses python-cryptography. It's not a big deal. Python 3 is not officially supported for web frontend.
Note that the posted patch should not be pushed but rather applied in downstream packages. E.g in Fedora rawhide when 4.3 will be released.
After the release this ticket is supposed to be cloned to Fedora rawhide.
Lowering priority given that it is not a blocker for the actual release but rather for downstream package.
The Christian's patch: http://www.redhat.com/archives/freeipa-devel/2015-December/msg00234.html for master branch.
Moving, 4.3 was released.
4.3.2 was released, moving to 4.3.3
Lowering priority, this is handled in downstream patches.
The problem should be fixed by python-cryptography >= 1.2 with python-cffi >= 1.4.1, too.
So it looks like we can close this ticket. And remove the downstream patch which is mentioned in https://fedorahosted.org/freeipa/ticket/5442#comment:7
But I wonder, why https://bugzilla.redhat.com/show_bug.cgi?id=1277224 is still open.
The execmem denial is only fixed for recent versions of cryptography with a recent version of cffi. PyOpenSSL still uses cffi's old closure API for callback which requires dynamic code creation. It would take a lot of effort to migrate PyOpenSSL to static callbacks.
Metadata Update from @cheimes: - Issue assigned to cheimes - Issue set to the milestone: FreeIPA 4.3.3
4.3.x EOL
Metadata Update from @mbasti: - Issue close_status updated to: None - Issue set to the milestone: FreeIPA 4.4.5 (was: FreeIPA 4.3.3)
Metadata Update from @cheimes: - Issue close_status updated to: fixed - Issue status updated to: Closed (was: Open)
Login to comment on this ticket.