[PATCH] Process SELinux mapping while offline
by Jakub Hrozek
This patchset fixes the SELinux processing so that it works also offline
for cases described in #1626 for example.
The code was architected in an extremely strange way where every request
would store a per-request/per-user score attribute in the selinux mapping
objects themselves and the responder would just pick the highest score.
At the same time, the scores were only calculated when the mappings were
downloaded and only for rules that matched, which pretty much broke offline
support. I intend to fix the architecture by only making the provider only
download and store the rules and let the responder pick the context. But I'm
not sure if I can do that right during the current time constraints. I filed
#1743 to track that effort and I'll be sending some patches for master so
far, but I'd like to include this patchset to fix the functionality at last.
I also noticed that the rules are downloaded on *every login*, without
any timeout in between, so I filed #1744 to either reuse
IPA_HBAC_REFRESH or introduce a similar timeout for performance reasons.
[PATCH 1/4] SYSDB: Remove duplicate selinux defines
Some constants were defined in both sysdb.h and sysdb_selinux.h. This
patch removes the duplicates.
[PATCH 2/4] SYSDB: Split a function to read all SELinux maps
This function will be reused in the DP to read maps from cache when
offline.
[PATCH 3/4] SELINUX: Process maps even when offline
The patch is quite big, but I couldn't split it in a meaningful way,
sorry. The patch changes the ipa_get_selinux{send,recv} to only provide
data independently on the offline stat and moves all the processing to
the ipa_selinux_handler. The scores are calculated
[PATCH 4/4] IPA: Rename IPA_CONFIG_SELINUX_DEFAULT_MAP
The option IPA_CONFIG_SELINUX_DEFAULT_MAP was misnamed. It doesn't
describe any map, but the default context the user should obtain when
nothing else matches.
11 years, 3 months
Tool for querying SSSD database
by David Bambušek
Greetings,
my name is David Bambusek and I have just started working on my bachelor
thesis with topic "Tool for querying SSSD database". I would be very glad
if anyone, who has some interesting suggestion, information, recommendation
or any clue, that could possibly help me in my work, would email me wih it.
I would really strongly appreciate it.
Thank you all in advance
David Bambusek
11 years, 3 months
[PATCHES] SYSDB ghost fix
by Ondrej Kos
Here are two patches for the SYSDB:
[PATCH 1/2] SYSDB: replace ghost users properly
this fixes https://fedorahosted.org/sssd/ticket/1714
[PATCH 2/2] SYSDB: split sysdb_add_user
splits add_user code to more readable blocks
Patches are attached
Ondra
--
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech
phone: +420-532-294-558
cell: +420-736-417-909
ext: 82-62558
loc: 1013 Brno 1 office
irc: okos @ #brno
11 years, 3 months