On 09/13/2012 12:24 PM, Jakub Hrozek wrote:
>In order to test these patches properly, you need to be running the
>latest patches that are currently on review on freeipa-devel. Ping me
>off-line for access to such IPA client.
>
>[PATCH 1/2] DB: Always write the SELinux object to sysdb
>This is a fallout of the transaction processing refactoring.
>
>There's no point in checking if the object already exists because we always
>wipe the whole sysdb subtree. We were also immediatelly cancelling the
>transaction because we'd jump to goto, even though it was with EOK.
Ack.
>[PATCH 2/2] SELinux: Always use the default if it exists on the server
>
>https://fedorahosted.org/sssd/ticket/1513
>
>This is a counterpart of the FreeIPA ticket
https://fedorahosted.org/freeipa/ticket/3045
>
>During an e-mail discussion, it was decided that
>
> * if the default is set in the IPA config object, the SSSD would use
> that default no matter what
> * if the default is not set (aka empty or missing), the SSSD would just
> use the system default and skip creating the login file altogether
Nack.
>@@ -136,11 +136,9 @@ static void ipa_selinux_handler_done(struct tevent_req *req)
> goto fail;
> }
>
>- if (default_user != NULL && map_order != NULL) {
>- ret = sysdb_store_selinux_config(sysdb, default_user, map_order);
>- if (ret != EOK) {
>- goto fail;
>- }
>+ ret = sysdb_store_selinux_config(sysdb, default_user, map_order);
>+ if (ret != EOK) {
>+ goto fail;
> }
Are you sure that it is safe to remove the NULL checks? You are
testing default_user inside sysdb_store_selinux_config(), but not
map_order. There is a code path where map_order may be NULL.
Right, I should have kept the map_order check. I moved it into the save
function itself.