[SSSD] [PATCH] Only create the SELinux login file if there are mappings on the server

Jakub Hrozek jhrozek at redhat.com
Mon Aug 6 10:47:02 UTC 2012


On Mon, Aug 06, 2012 at 10:51:39AM +0200, Jakub Hrozek wrote:
> [PATCH 1/2] Do not try to remove the temp login file if already
> renamed
> 
> write_selinux_string() would try to unlink the temporary file even after
> it was renamed. Failure to unlink the file would not be fatal, but would
> produce a confusing error message.
> 
> Also don't use "0" for the default fd number, that's reserved for stdin.
> Using -1 is safer.
> 
> [PATCH 2/2] Only create the SELinux login file if there are mappings
> on the server
> 
> https://fedorahosted.org/sssd/ticket/1455
> 
> In case there are no rules on the IPA server, we must simply avoid generating
> the login file. That would make us fall back to the system-wide default
> defined in /etc/selinux/targeted/seusers.
> 
> The IPA default must be only used if there *are* rules on the server,
> but none matches.

I forgot to include the [PATCH] tag. Sorry if I broke anyone's filters.



More information about the sssd-devel mailing list