From: "Jakub Hrozek" <jhrozek(a)redhat.com>
To: sssd-devel(a)lists.fedorahosted.org
Sent: Tuesday, January 27, 2015 5:38:57 PM
Subject: Re: [SSSD] [PATCH] SELINUX: Set permissive umask for selinux operations
On Tue, Jan 27, 2015 at 05:25:36PM +0100, Jakub Hrozek wrote:
> On Tue, Jan 27, 2015 at 11:07:01AM -0500, Roland Mainz wrote:
> >
> >
> > ----- Original Message -----
> > > From: "Roland Mainz" <rmainz(a)redhat.com>
> > > To: "Development of the System Security Services Daemon"
> > > <sssd-devel(a)lists.fedorahosted.org>
> > > Sent: Tuesday, January 27, 2015 4:41:28 PM
> > > Subject: Re: [SSSD] [PATCH] SELINUX: Set permissive umask for selinux
> > > operations
> > >
> > >
> > >
> > > ----- Original Message -----
> > > > From: "Jakub Hrozek" <jhrozek(a)redhat.com>
> > > > To: sssd-devel(a)lists.fedorahosted.org
> > > > Sent: Tuesday, January 27, 2015 11:31:58 AM
> > > > Subject: Re: [SSSD] [PATCH] SELINUX: Set permissive umask for
selinux
> > > > operations
> > > >
> > > > On Tue, Jan 27, 2015 at 10:51:24AM +0100, Jakub Hrozek wrote:
> > > > > Alternatively, we could only set and reset the umask in the
caller.
> > > > > That
> > > > > way, we would know that a short-lived selinux_child is changing
> > > > > umask.
> > > > >
> > > > > That is safer, but risks that we forget next time..so at least
we
> > > > > need
> > > > > to add a comment to the declaration in header.
> > > >
> > > > Attached is an alternate patch that only touches the umask in the
> > > > short-lived process.
> > >
> > > Which syscall exactly (strace dump, please) causes the original issue ?
> > > Maybe
> > > there is a way to do this without having to rely on |umask()| (using
> > > the
> > > |*at()| APIs or a later modification of the permissions) ...
> >
> > I discussed this with jhrozek on IRC... basically libsemanage should fix
> > the permissions after the |mkdir()| call like the mkdir(1) code in
> >
https://searchcode.com/codesearch/view/5481405/ line 160 ... but until
> > they we have to stick with the |umask()| workaround (and praying that
> > sssd never uses threads).
>
> I filed:
>
https://bugzilla.redhat.com/show_bug.cgi?id=1186422
> and:
>
https://bugzilla.redhat.com/show_bug.cgi?id=1186431
>
> against libsemanage. As discussed with Roland on IRC, I will add a URL
> of the bugzilla to a comment in selinux_child to make it clear that it's
> just a workaround for a bug, not a clean solution.
FYI, I'll push the attached patch. The only difference from the version
Michal acked is the additional comment.
Thanks for the bug reference in the patch... the patch is r=rmainz(a)redhat.com ...
----
Bye,
Roland
--
__ . . __
(o.\ \/ /.o) rmainz(a)redhat.com
\__\/\/__/ IPA/Kerberos5 team
/O /==\ O\
(;O/ \/ \O;)