[PATCHES] Patch set fixing SELinux - HBAC linking
by Jan Zelený
#156
Added some debug messages
#157
The original priority patch had this condition in the wrong place, resulting
in hostCategory == all not being taken into account
#158
The function ipa_selinux_map_merge() is no longer necessary since more generic
function has been implemented and it is even used in the code
#159
This patch provides the fix for HBAC - SELinux linking itself. I'm not sure
about defining those two constants on top. If anyone has better idea where to
put them in order to consolidate them with the same constants private for HBAC
code, I'm open to suggestions.
Thanks
Jan
11 years, 9 months
[PATCH][PRELIMINARY] sudo: send username and uid while requesting default options
by Pavel Březina
https://fedorahosted.org/sssd/ticket/1239
[PATCH 1/2]
Finally removes EOK constant from sudo api header. It is not used in
the SUDO code so it does not require their changes.
[PATCH 2/2]
This does what is requested in the ticket. It seems to be very huge but
in fact it is mainly changing the variable. Basically I tried to get
rid of domain ctx where possible, leave it only in initgroups part and
use command ctx elsewhere.
The in-memory cache is not yet implemented, I want to discuss the
possible ways of doing it.
The basic problem is that we need to get the domain during the request
for default options. How will we do it? I think there are two options:
1. always try to perform the initgroups - find the domain and the check
the in-memory cache (which may be slow if the user is in the last
domain, but that will be probably handled as part of
https://fedorahosted.org/sssd/ticket/1126
2. store uid:username = domain in the in-memory cache (same cache as
results or a new one?)
This patch contains a modified version of sysdb_get_sudo_user_info()
where the uid is not mandatory. I want to replace this function with
sysdb_sudo_get_user_groups() (or make it generic and place it in
sysdb_ops?) because the groupnames are the only thing we don't know.
However this requires a modification of the data provider protocol as
well so I'm keeping it for later.
11 years, 9 months
[PATCH] ding-libs spec file update
by Jan Zelený
Attached patch contains some changes that I'd like to propose. All
modifications are based on spec file for Fedora rawhide.
Thanks
Jan
11 years, 9 months