gsadmin/spinifex
1
0
Fork 0
mirror of https://github.com/mulgadc/spinifex.git synced 2026-10-23 12:47:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ovn): broaden AppArmor read grant to /etc/spinifex (covers CA cert)

Browse Source 
The earlier override granted reads on /etc/spinifex/ipsec/** only, which
covers the peer cert + key but NOT the cluster CA at /etc/spinifex/ca.pem.
charon then can't load the CA, can't validate the peer cert chain, and
surfaces the failure as `no trusted RSA public key found for '<peer>'`
even though identity matching now succeeds — IKE_AUTH fails with
AUTHENTICATION_FAILED and no xfrm SAs negotiate.

Grant /etc/spinifex/** instead (covers ca.pem + ipsec/peer.{pem,key})
and always rewrite the override so re-runs replace the older narrower
rule.

Refs: mulga-siv-136
This commit is contained in:
joshsiv-mulga
2026-05-25 20:46:15 +10:00
parent 45017d1307
commit f523932179
1 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/setup-ovn.sh
+12 -9
View File
@@ -249,17 +249,20 @@ install_packages
# strongswan-charon ships an AppArmor profile for /usr/lib/ipsec/charon that
# only allows reading from /etc/ipsec.*, /etc/strongswan.*, and a few other
# fixed paths. ovs-monitor-ipsec writes the per-tunnel strongSwan config with
# absolute paths to our cert + key under /etc/spinifex/ipsec/, so charon hits
# "Permission denied" when loading them and no SAs come up. The profile
# includes a 'local' override file expressly for site additions — drop a
# read grant for our cert dir there and reload the profile.
# absolute paths to our peer cert + key under /etc/spinifex/ipsec/ AND to the
# cluster CA at /etc/spinifex/ca.pem, so charon hits "Permission denied" on
# both load paths and surfaces as `no trusted RSA public key found for
# '<peer>'` (CA can't be loaded → can't validate peer cert chain → no SAs).
# The profile includes a 'local' override file expressly for site additions
# — grant reads on /etc/spinifex/** (covers ca.pem AND ipsec/peer.{pem,key})
# and reload.
if [ -d /etc/apparmor.d/local ]; then
LOCAL_OVERRIDE=/etc/apparmor.d/local/usr.lib.ipsec.charon
if ! grep -q '/etc/spinifex/ipsec/' "$LOCAL_OVERRIDE" 2>/dev/null; then
echo " Adding AppArmor read grant for /etc/spinifex/ipsec to charon profile"
echo "/etc/spinifex/ipsec/** r," | sudo tee "$LOCAL_OVERRIDE" >/dev/null
sudo apparmor_parser -r /etc/apparmor.d/usr.lib.ipsec.charon 2>/dev/null || true
fi
# Always rewrite — re-runs may have an older, narrower rule (e.g. the
# initial /etc/spinifex/ipsec/** only) that misses /etc/spinifex/ca.pem.
echo " Adding AppArmor read grant for /etc/spinifex (cert + CA) to charon profile"
echo "/etc/spinifex/** r," | sudo tee "$LOCAL_OVERRIDE" >/dev/null
sudo apparmor_parser -r /etc/apparmor.d/usr.lib.ipsec.charon 2>/dev/null || true
fi
# --- Step 2: Enable services ---