URL:
https://github.com/SSSD/sssd/pull/577
Author: fidencio
Title: #577: ipa: Use fqname on selinux_child_setup
Action: opened
PR body:
"""
Although there was a comment saying that pam_selinux needs the username
in the same format getpwnam() would return it, it doesn't seem to be
the case anymore.
Just using fqname from selinux_child_setup allows us to have the
expected results.
One difference that I've spotted while doing this patch (which may or
may not be an issue) is that without this patch the output of `semanage
login --list` was always (with or without domain_resolution_order set):
[root@client1 x86_64]# semanage login --list
Login Name SELinux User MLS/MCS Range Service
__default__ unconfined_u s0-s0:c0.c1023 *
admin staff_u s0-s0:c0.c1023 *
root unconfined_u s0-s0:c0.c1023 *
While now I can see:
[root@client1 x86_64]# semanage login --list
Login Name SELinux User MLS/MCS Range Service
__default__ unconfined_u s0-s0:c0.c1023 *
admin staff_u s0-s0:c0.c1023 *
admin(a)ipa.example staff_u s0-s0:c0.c1023 *
root unconfined_u s0-s0:c0.c1023 *
Resolves:
https://pagure.io/SSSD/sssd/issue/3740
Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com>
NOTE: While I still have to run downstream tests to be sure it won't introduce
regressions (although, it didn't in the very simple test that I've performed) ...
I'd appreciate a review (even before the results of the tests) in order to have an
early understanding of whether this is a valid approach or not.
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/577/head:pr577
git checkout pr577