On Wed, Sep 24, 2014 at 06:52:15PM +0200, Michal Židek wrote:
these 3 patches remove the old approach where we directly
wrote the selinux login file. Here, the same approach is used
as in the tools (sss_useradd/sss_usermod) where we already
use libsemanage to manage these tasks.
Thanks a lot for the patches! I'm afraid we won't have the capacity to
review them until Tuesday and the next release, though..
The advantage is that we remove some lines of code (yay!)
and get the auditing of selinux user changes for free.
1st patch just moves stuff around, so that set_seuser
function can be used from IPA provider.
2nd patch is a very simple change that adds new attribute
to the set_seuser function (mls_range).
The main functionality is in the 3rd patch. Note that to
test the patch, you must run in permissive mode.
$ setenforce Permissive
Otherwise you will get AVC denials (because sssd_be is
not allowed to use libsemanage).
So we will have to change the selinux policy in fedora/rhel
to make it work this way. I will ping the selinux policy maintainer
after the patches are reviewed.
Thanks, please do. Can you also in general ask him to help us review the
patches? Just to make sure we're not misusing something in the library..
Patches are attached.