Patch 1: Right now, we have SELinux procesing split between the
provider
and responder. This patch moves it to provider only. So no partial
results are sent to responder for further processing, which makes the
processing steps easier to follow. (Originally the idea was to move the
processing to the responder, but completely removing the procesing from
provider and let it just update db turned to be more invasive than
completely removing the procesing from responder.) If this patch is
accepted, SELinux policy needs to be modified to allow sssd_be to write
the selinux login files.
https://fedorahosted.org/sssd/ticket/1743
Patch 2, 3: Reuse cached selinux maps. Patch 2 shows how it is done with
refresh interval fixed to 120 seconds. Patch 3 adds ipa option to
configure this interval (I didn't want to merge these patches for better
readability). Default value is 30 seconds.
https://fedorahosted.org/sssd/ticket/1744
Patches are attached.
Thanks
Michal