[Freeipa-devel] [freeipa PR#1160][opened] Block PyOpenSSL to prevent SELinux execmem in wsgi

[tiran]

   URL: https://github.com/freeipa/freeipa/pull/1160
Author: tiran
 Title: #1160: Block PyOpenSSL to prevent SELinux execmem in wsgi
Action: opened

PR body:
"""
Some dependencies like Dogtag's pki.client library and custodia use
python-requsts to make HTTPS connection. python-requests prefers
PyOpenSSL over Python's stdlib ssl module. PyOpenSSL is build on top
of python-cryptography which trigger a execmem SELinux violation
in the context of Apache HTTPD (httpd_execmem).

When requests is imported, it always tries to import pyopenssl glue
code from urllib3's contrib directory. The import of PyOpenSSL is
enough to trigger the SELinux denial.

Block any import of PyOpenSSL's SSL module in wsgi by raising an
ImportError. The block is compatible with new python-requests with
unbundled urllib3, too.

Fixes: https://pagure.io/freeipa/issue/5442
Fixes: RHBZ#1491508
Signed-off-by: Christian Heimes <cheimes(a)redhat.com&gt;
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1160/head:pr1160
git checkout pr1160