----- Original Message -----
> From: "Jakub Hrozek" <jhrozek(a)redhat.com>
> To: sssd-devel(a)lists.fedorahosted.org
> Sent: Tuesday, January 27, 2015 5:38:57 PM
> Subject: Re: [SSSD] [PATCH] SELINUX: Set permissive umask for selinux operations
>
> On Tue, Jan 27, 2015 at 05:25:36PM +0100, Jakub Hrozek wrote:
> > On Tue, Jan 27, 2015 at 11:07:01AM -0500, Roland Mainz wrote:
> > >
> > >
> > > ----- Original Message -----
> > > > From: "Roland Mainz" <rmainz(a)redhat.com>
> > > > To: "Development of the System Security Services Daemon"
> > > > <sssd-devel(a)lists.fedorahosted.org>
> > > > Sent: Tuesday, January 27, 2015 4:41:28 PM
> > > > Subject: Re: [SSSD] [PATCH] SELINUX: Set permissive umask for
selinux
> > > > operations
> > > >
> > > >
> > > >
> > > > ----- Original Message -----
> > > > > From: "Jakub Hrozek" <jhrozek(a)redhat.com>
> > > > > To: sssd-devel(a)lists.fedorahosted.org
> > > > > Sent: Tuesday, January 27, 2015 11:31:58 AM
> > > > > Subject: Re: [SSSD] [PATCH] SELINUX: Set permissive umask for
selinux
> > > > > operations
> > > > >
> > > > > On Tue, Jan 27, 2015 at 10:51:24AM +0100, Jakub Hrozek wrote:
> > > > > > Alternatively, we could only set and reset the umask in the
caller.
> > > > > > That
> > > > > > way, we would know that a short-lived selinux_child is
changing
> > > > > > umask.
> > > > > >
> > > > > > That is safer, but risks that we forget next time..so at
least we
> > > > > > need
> > > > > > to add a comment to the declaration in header.
> > > > >
> > > > > Attached is an alternate patch that only touches the umask in
the
> > > > > short-lived process.
> > > >
> > > > Which syscall exactly (strace dump, please) causes the original issue
?
> > > > Maybe
> > > > there is a way to do this without having to rely on |umask()| (using
> > > > the
> > > > |*at()| APIs or a later modification of the permissions) ...
> > >
> > > I discussed this with jhrozek on IRC... basically libsemanage should fix
> > > the permissions after the |mkdir()| call like the mkdir(1) code in
> > >
https://searchcode.com/codesearch/view/5481405/ line 160 ... but until
> > > they we have to stick with the |umask()| workaround (and praying that
> > > sssd never uses threads).
> >
> > I filed:
> >
https://bugzilla.redhat.com/show_bug.cgi?id=1186422
> > and:
> >
https://bugzilla.redhat.com/show_bug.cgi?id=1186431
> >
> > against libsemanage. As discussed with Roland on IRC, I will add a URL
> > of the bugzilla to a comment in selinux_child to make it clear that it's
> > just a workaround for a bug, not a clean solution.
>
> FYI, I'll push the attached patch. The only difference from the version
> Michal acked is the additional comment.
Thanks for the bug reference in the patch... the patch is r=rmainz(a)redhat.com ...
Pushed upstream:
* master: 8f78b6442f3176ee43aa06704a3adb9f4ac625d6
* sssd-1-12: b8894eb53017af67224d05470d2cdd2a65070a41