[SSSD] [PATCHES] Modify priority evaluation in SELinux user maps

Jakub Hrozek jhrozek at redhat.com
Mon Jul 16 15:45:05 UTC 2012


On Mon, Jul 16, 2012 at 04:20:23PM +0200, Jan Zelený wrote:
> The functionality is now following:
> 
> When rule is being matched, its priority is determined as a combination
> of user and host specificity (host taking preference).
> 
> After the rule is matched in provider, its host priority is stored
> in sysdb for later usage.
> 
> When rules are matched in the responder, their user priority is
> determined. After that their host priority is retrieved directly from
> sysdb and sum of both priorities is used to determine whether to take
> that rule into account or not. If more rules have the same priority, the order 
> given in IPA config is used.
> 
> Thanks
> Jan

Nack, I don't like the concept of storing the priority scores in the
sysdb -- the priority scores depend on the user being processed and the
hostname that comes from pam data. I think the scores should be computed
in responder and the provider should only store the data in the sysdb.



More information about the sssd-devel mailing list