[SSSD] [PATCH] IPA: Return and save all SELinux rules in the provider

Stephen Gallagher sgallagh at redhat.com
Wed Jul 18 14:39:56 UTC 2012


On Wed, 2012-07-18 at 13:24 +0200, Jakub Hrozek wrote:
> The IPA session code used to download all enabled SELinux rules, but
> then filter out those that match to the current user and save only
> those. This meant that if a rule was deleted or disabled on the server,
> it remained in the cache and was still evaluated.
> 
> The attached patch changes that behaviour to save all downloaded rules --
> if this proves to be slow, we can optimize, for instance in a similar
> way HBAC rules are optimized, by falling back to sysdb rules if several
> requests arrive within a specified interval. However, we don't use
> member/memberof links when saving the SELinux mappings, so the sysdb
> write should be reasonably fast.
> 
> [PATCH 1/3] IPA: Download defaults even if there are no SELinux mappings
> We should always download the defaults because even if there are no
> rules, we might want to use (or update) the defaults. Previously, the
> defaults were only downloaded when there were some rules on the server.
> 
> [PATCH 2/3] SYSDB: Delete SELinux mappings
> A sysdb function that can be used to delete SELinux mappings from the
> sysdb
> 
> [PATCH 3/3] IPA: Return and save all SELinux rules in the provider
> https://fedorahosted.org/sssd/ticket/1421

Ack to all three.

However, there's a FIXME that I think we can solve very easily. I've
opened https://fedorahosted.org/sssd/ticket/1427 to track this.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120718/00fb8e53/attachment.sig>


More information about the sssd-devel mailing list