[SSSD] [PATCHES] SELinux processing related patches

Michal Židek mzidek at redhat.com
Mon Mar 4 15:13:31 UTC 2013


On 03/04/2013 02:53 PM, Pavel Březina wrote:
> On 03/01/2013 04:13 PM, Michal Židek wrote:
>> Patch 1: Right now, we have SELinux procesing split between the provider
>> and responder. This patch moves it to provider only. So no partial
>> results are sent to responder for further processing, which makes the
>> processing steps easier to follow. (Originally the idea was to move the
>> processing to the responder, but completely removing the procesing from
>> provider and let it just update db turned to be more invasive than
>> completely removing the procesing from responder.) If this patch is
>> accepted, SELinux policy needs to be modified to allow sssd_be to write
>> the selinux login files.
>> https://fedorahosted.org/sssd/ticket/1743
>>
>>
>> Patch 2, 3: Reuse cached selinux maps. Patch 2 shows how it is done with
>> refresh interval fixed to 120 seconds. Patch 3 adds ipa option to
>> configure this interval (I didn't want to merge these patches for better
>> readability). Default value is 30 seconds.
>> https://fedorahosted.org/sssd/ticket/1744
>>
>>
>> Patches are attached.
>>
>> Thanks
>> Michal
>
> Hi,
> switch the order of the second and third patch. So the flow is: add new
> option, then use it.

I don't think this is good idea. If the option is present, the logic to 
implement it's effect should be present too. It is also easier to test 
the patches one by one this way (first test the mechanism with fixed 
time interval, then make it configurable and test if interval is 
changing). For now I only changed the 120 seconds in the 2nd patch to 5 
seconds (so it is not that aggressive).
>
> Do we want to use it anyway? Shouldn't be SELinux maps always updated?
>

Well, we can still make 0 seconds the default value (or 5 seconds, which 
is used by IPA_HBAC_REFRESH). But selinux maps are not changed 
frequently on ipa side, so having this option is IMO good thing. In the 
new attached patches the default value is changed to 5.

Michal
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Move-SELinux-processing-to-provider.patch
Type: text/x-patch
Size: 33366 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130304/b89d7d1d/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Reuse-cached-SELinux-mappings.patch
Type: text/x-patch
Size: 5171 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130304/b89d7d1d/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-Make-the-SELinux-refresh-time-configurable.patch
Type: text/x-patch
Size: 5433 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130304/b89d7d1d/attachment-0002.bin>


More information about the sssd-devel mailing list