URL:
https://github.com/SSSD/sssd/pull/577
Title: #577: ipa: Use fqname on selinux_child_setup
jhrozek commented:
"""
So it makes sense that the context is set correctly by pam_selinux after you log in, but
are you sure that it gets set by the selinux child the way you want? Does everything still
work if you do:
```
semanage login -d admin
semanage login -d admin(a)ipa.example
```
?
If you then log in, what is the output of `semanage login -l` ?
btw the reason I'm asking is that even after the patch the context is set for me only
for the short name. Because `sss_output_fqname` does pretty much the same as the previous
code (so, I agree that we should use it), but neither of the conditions to qualify the
name match for me. The IPA domain has both `domain->fqnames` and
`domain->output_fqnames` set to false. IIRC only the responders currently set
`domain->output_fqnames`.
Wouldn't the correct fix be to also initialize `domain->output_fqnames` for the
instances of `sss_domain_info` that providers use?
"""
See the full comment at
https://github.com/SSSD/sssd/pull/577#issuecomment-391379772