----- Original Message -----
From: "Roland Mainz" <rmainz(a)redhat.com>
To: "Development of the System Security Services Daemon"
<sssd-devel(a)lists.fedorahosted.org>
Sent: Tuesday, January 27, 2015 4:41:28 PM
Subject: Re: [SSSD] [PATCH] SELINUX: Set permissive umask for selinux operations
----- Original Message -----
> From: "Jakub Hrozek" <jhrozek(a)redhat.com>
> To: sssd-devel(a)lists.fedorahosted.org
> Sent: Tuesday, January 27, 2015 11:31:58 AM
> Subject: Re: [SSSD] [PATCH] SELINUX: Set permissive umask for selinux
> operations
>
> On Tue, Jan 27, 2015 at 10:51:24AM +0100, Jakub Hrozek wrote:
> > Alternatively, we could only set and reset the umask in the caller. That
> > way, we would know that a short-lived selinux_child is changing umask.
> >
> > That is safer, but risks that we forget next time..so at least we need
> > to add a comment to the declaration in header.
>
> Attached is an alternate patch that only touches the umask in the
> short-lived process.
Which syscall exactly (strace dump, please) causes the original issue ? Maybe
there is a way to do this without having to rely on |umask()| (using the
|*at()| APIs or a later modification of the permissions) ...
I discussed this with jhrozek on IRC... basically libsemanage should fix the permissions
after the |mkdir()| call like the mkdir(1) code in
https://searchcode.com/codesearch/view/5481405/ line 160 ... but until they we have to
stick with the |umask()| workaround (and praying that sssd never uses threads).
----
Bye,
Roland
--
__ . . __
(o.\ \/ /.o) rmainz(a)redhat.com
\__\/\/__/ IPA/Kerberos5 team
/O /==\ O\
(;O/ \/ \O;)