[SSSD] [PATCHES] SELinux processing related patches

Michal Židek mzidek at redhat.com
Fri Mar 1 17:21:35 UTC 2013


On 03/01/2013 05:02 PM, Michal Židek wrote:
> On 03/01/2013 04:34 PM, Michal Židek wrote:
>> On 03/01/2013 04:13 PM, Michal Židek wrote:
>>> Patch 1: Right now, we have SELinux procesing split between the provider
>>> and responder. This patch moves it to provider only. So no partial
>>> results are sent to responder for further processing, which makes the
>>> processing steps easier to follow. (Originally the idea was to move the
>>> processing to the responder, but completely removing the procesing from
>>> provider and let it just update db turned to be more invasive than
>>> completely removing the procesing from responder.) If this patch is
>>> accepted, SELinux policy needs to be modified to allow sssd_be to write
>>> the selinux login files.
>>> https://fedorahosted.org/sssd/ticket/1743
>>>
>>>
>>> Patch 2, 3: Reuse cached selinux maps. Patch 2 shows how it is done with
>>> refresh interval fixed to 120 seconds. Patch 3 adds ipa option to
>>> configure this interval (I didn't want to merge these patches for better
>>> readability). Default value is 30 seconds.
>>> https://fedorahosted.org/sssd/ticket/1744
>>>
>>>
>>> Patches are attached.
>>>
>>> Thanks
>>> Michal
>>>
>>>
>>
>> Please ignore the version.m4 file in attachment.
>>
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
> Selfnack. Looks like there is a bug, need to check it.
>

Ok. So the original patches worked fine :-D.

I had a test that I ran to check if I broke something and it was like:
create some selinux maps
test login
modify (delete some) selinux maps
test login
...

But since I had ipa_selinux_refresh = 120 (an option.. ehm.. recently 
added) in sssd.conf I reused the first maps for all the test cases, 
which was not what the test expected. After setting ipa_selinux_refresh 
= 0, everything worked fine in the test.



More information about the sssd-devel mailing list