URL:
https://github.com/SSSD/sssd/pull/577
Title: #577: ipa: Use fqname on selinux_child_setup
fidencio commented:
"""
So it makes sense that the context is set correctly by pam_selinux
after you log in, but are you sure that it gets set by the selinux child the way you want?
Does everything still work if you do:
```
semanage login -d admin
semanage login -d admin(a)ipa.example
```
?
If you then log in, what is the output of semanage login -l ?
btw the reason I'm asking is that even after the patch the context is set for me only
for the short name.
You're damn right here! The patch doesn't actually solve the situation :-(
Because sss_output_fqname does pretty much the same as the previous
code (so, I agree that we should use it), but neither of the conditions to qualify the
name match for me. The IPA domain has both `domain->fqnames` and
`domain->output_fqnames` set to false.
Yep, I've noticed that as well. And it's not that easy to solve ...
IIRC only the responders currently set domain->output_fqnames.
Exactly.
Wouldn't the correct fix be to also initialize
domain->output_fqnames for the instances of sss_domain_info that providers use?
I'll cook something up here and re-submit the patches.
I may end up need to talk to you about the approach, in any case.
Thanks for the review.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/577#issuecomment-391399115