[SSSD] [PATCH] IPA: Return and save all SELinux rules in the provider

Jakub Hrozek jhrozek at redhat.com
Wed Jul 18 15:32:13 UTC 2012


On Wed, Jul 18, 2012 at 10:39:56AM -0400, Stephen Gallagher wrote:
> On Wed, 2012-07-18 at 13:24 +0200, Jakub Hrozek wrote:
> > The IPA session code used to download all enabled SELinux rules, but
> > then filter out those that match to the current user and save only
> > those. This meant that if a rule was deleted or disabled on the server,
> > it remained in the cache and was still evaluated.
> > 
> > The attached patch changes that behaviour to save all downloaded rules --
> > if this proves to be slow, we can optimize, for instance in a similar
> > way HBAC rules are optimized, by falling back to sysdb rules if several
> > requests arrive within a specified interval. However, we don't use
> > member/memberof links when saving the SELinux mappings, so the sysdb
> > write should be reasonably fast.
> > 
> > [PATCH 1/3] IPA: Download defaults even if there are no SELinux mappings
> > We should always download the defaults because even if there are no
> > rules, we might want to use (or update) the defaults. Previously, the
> > defaults were only downloaded when there were some rules on the server.
> > 
> > [PATCH 2/3] SYSDB: Delete SELinux mappings
> > A sysdb function that can be used to delete SELinux mappings from the
> > sysdb
> > 
> > [PATCH 3/3] IPA: Return and save all SELinux rules in the provider
> > https://fedorahosted.org/sssd/ticket/1421
> 
> Ack to all three.
> 

Pushed all three to master.

> However, there's a FIXME that I think we can solve very easily. I've
> opened https://fedorahosted.org/sssd/ticket/1427 to track this.

Thank you, we'll get to this performance improvement in beta 6 (I
assume).



More information about the sssd-devel mailing list