[SSSD] [PATCHES] Modify priority evaluation in SELinux user maps

Jakub Hrozek jhrozek at redhat.com
Tue Jul 17 14:27:40 UTC 2012


On Tue, Jul 17, 2012 at 04:07:27PM +0200, Jan Zelený wrote:
> Dne úterý 17 července 2012 15:53:48, Jakub Hrozek napsal(a):
> > On Tue, Jul 17, 2012 at 09:14:14AM +0200, Jan Zelený wrote:
> > > Dne pondělí 16 července 2012 17:45:05, Jakub Hrozek napsal(a):
> > > > On Mon, Jul 16, 2012 at 04:20:23PM +0200, Jan Zelený wrote:
> > > > > The functionality is now following:
> > > > > 
> > > > > When rule is being matched, its priority is determined as a
> > > > > combination
> > > > > of user and host specificity (host taking preference).
> > > > > 
> > > > > After the rule is matched in provider, its host priority is stored
> > > > > in sysdb for later usage.
> > > > > 
> > > > > When rules are matched in the responder, their user priority is
> > > > > determined. After that their host priority is retrieved directly from
> > > > > sysdb and sum of both priorities is used to determine whether to take
> > > > > that rule into account or not. If more rules have the same priority,
> > > > > the
> > > > > order given in IPA config is used.
> > > > > 
> > > > > Thanks
> > > > > Jan
> > > > 
> > > > Nack, I don't like the concept of storing the priority scores in the
> > > > sysdb -- the priority scores depend on the user being processed and the
> > > > hostname that comes from pam data. I think the scores should be computed
> > > > in responder and the provider should only store the data in the sysdb.
> > > 
> > > Your assumption is not entirely accurate. The host priority depends on
> > > host- related data that are retrieved from IPA server. Therefore we would
> > > need to store this data in sysdb instead of the priority and do the same
> > > processing twice - once in provider to know what rules apply to the host
> > > and once in responder to determine their priority. That's why I think
> > > calculating priority in the first pass and then utilize this number
> > > (which don't change by the way) further instead of calculating it againg
> > > is far better.
> > > 
> > > However if you insist, I won't argue with you and do the change.
> > 
> > It's wrong because the priority is computer *per-user* and stored in a
> > generic object, at least that's how I read the code.
> > 
> > How would this work for a different user, would we store
> > per-user value in a generic object on each login? What about offline
> > logins, what if a different user logs in?
> 
> No, the priority in sysdb is *per host*. The user part is then computed and 
> added to the host part in responder as you suggest.

Right, I saw SYSDB_SELINUX_USER_PRIORITY and got confused. Please remove
that constant, add ticket URL to the commit message and I'll ack.




More information about the sssd-devel mailing list