[SSSD] [PATCHES][PRELIMINARY] Support of SELinux user maps in SSSD

Jan Zeleny jzeleny at redhat.com
Tue Jan 31 21:15:43 UTC 2012


Jan Zelený <jzeleny at redhat.com> wrote:
> Hi,
> I'm sending all patches implementing support for SELinux user maps. Some
> support patches are included as well.
> 
> #0001:
> Implemented support for multiple search bases in HBAC rules and services.
> As discussed before, this is not strictly needed, but I did it anyway to
> unify the approach to multiple search bases. Just a reminder: the plan is
> to use these structures and then limit maximal number of search bases to 1
> since there is no support in IPA server for more bases anyway.
> 
> #0002:
> This fixes minor regression brought by my previous patch which is already
> pushed (multiple search bases in IPA hosts).
> 
> #0003:
> Add generic routines to retrieve IPA configuration object. These routines
> will be used in other parts of the code.
> 
> #0004:
> Rewrite retrieval of password migration flag from IPA config to user
> previously implemented generic IPA config interface.
> 
> #0005:
> Some sysdb netgroup attributes will be used in SELinux user maps. They will
> also have the same semantics, therefore they should be renamed and then re-
> used.
> 
> #0006:
> Some sysdb routines for SELinux support. Please note that some routines are
> written in very generic way - I'd like to use them also elsewhere in the
> current code, perhaps as a part of some sysdb refactoring.
> 
> #0007:
> Utility functions for SELinux map matching against information about
> current user and host.
> 
> #0008:
> SELinux user maps support in IPA provider. Also generig data provider
> related code is here. I'm considering splitting this patch in two or
> three. Let me know your opinion.
> 
> #0009:
> Responder support of SELinux user maps - retrieve all applicable maps from
> sysbd and create content of the user mapping file
> /etc/selinux/<policy>/logins/<usernale>
> 
> #0010:
> Get the file content from PAM responder and write it to the file. I'm not
> completely sure whether or not to implement some kind of locking to prevent
> possible race conditions when reading/writing to this file.
> 
> Thanks in advance for the review. Any advices how to improve the code will
> be appreciated.
> Jan

Patches rebased on top of current master.

Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Implemented-support-for-multiple-search-bases-in-HBA.patch
Type: text/x-patch
Size: 28848 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120131/74b4b8cd/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Fixed-minor-memory-hierarchy-related-issue-in-IPA-HB.patch
Type: text/x-patch
Size: 1384 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120131/74b4b8cd/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-Add-support-for-generic-IPA-config-retrieval.patch
Type: text/x-patch
Size: 8439 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120131/74b4b8cd/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0004-Make-password-migration-code-use-the-IPA-config-retr.patch
Type: text/x-patch
Size: 4653 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120131/74b4b8cd/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0007-Added-some-SELinux-related-utility-functions.patch
Type: text/x-patch
Size: 8316 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120131/74b4b8cd/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0005-Renamed-some-sysdb-constants-for-their-wider-usage.patch
Type: text/x-patch
Size: 4587 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120131/74b4b8cd/attachment-0005.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-Added-some-SELinux-related-sysdb-routines.patch
Type: text/x-patch
Size: 19603 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120131/74b4b8cd/attachment-0006.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0009-SELinux-support-in-PAM-responder.patch
Type: text/x-patch
Size: 6501 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120131/74b4b8cd/attachment-0007.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0010-SELinux-support-in-PAM-module.patch
Type: text/x-patch
Size: 3470 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120131/74b4b8cd/attachment-0008.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0008-SELinux-user-maps-in-IPA-backend.patch
Type: text/x-patch
Size: 60162 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120131/74b4b8cd/attachment-0009.bin>


More information about the sssd-devel mailing list