[SSSD] [PATCHES] SELinux processing related patches

Pavel Březina pbrezina at redhat.com
Mon Mar 4 13:53:26 UTC 2013


On 03/01/2013 04:13 PM, Michal Židek wrote:
> Patch 1: Right now, we have SELinux procesing split between the provider
> and responder. This patch moves it to provider only. So no partial
> results are sent to responder for further processing, which makes the
> processing steps easier to follow. (Originally the idea was to move the
> processing to the responder, but completely removing the procesing from
> provider and let it just update db turned to be more invasive than
> completely removing the procesing from responder.) If this patch is
> accepted, SELinux policy needs to be modified to allow sssd_be to write
> the selinux login files.
> https://fedorahosted.org/sssd/ticket/1743
>
>
> Patch 2, 3: Reuse cached selinux maps. Patch 2 shows how it is done with
> refresh interval fixed to 120 seconds. Patch 3 adds ipa option to
> configure this interval (I didn't want to merge these patches for better
> readability). Default value is 30 seconds.
> https://fedorahosted.org/sssd/ticket/1744
>
>
> Patches are attached.
>
> Thanks
> Michal

Hi,
switch the order of the second and third patch. So the flow is: add new 
option, then use it.

Do we want to use it anyway? Shouldn't be SELinux maps always updated?





More information about the sssd-devel mailing list