[SSSD] [PATCHES] Patch set fixing SELinux - HBAC linking
Jan Zelený
jzeleny at redhat.com
Mon Jul 23 07:08:52 UTC 2012
Dne pondělí 23 července 2012 08:16:30, Jan Zelený napsal(a):
> Dne pátek 20 července 2012 21:19:08, Jakub Hrozek napsal(a):
> > On Fri, Jul 20, 2012 at 05:51:29PM +0200, Jan Zelený wrote:
> > > Dne pátek 20 července 2012 17:46:33, Jakub Hrozek napsal(a):
> > > > On Fri, Jul 20, 2012 at 05:27:44PM +0200, Jan Zelený wrote:
> > > > > > Oh right, it's and HBAC attribute..
> > > > > >
> > > > > > Can't you just include ipa_hbac_private.h, then?
> > > > >
> > > > > I didn't exactly like that solution either so I moved those two
> > > > > constants
> > > > > to ipa_hbac.h which is supposed to be a public HBAC interface. The
> > > > > "right
> > > > > solution" would be to construct a map for HBAC rules, I know we
> > > > > discussed
> > > > > this with Stephen several months back but we never really got to do
> > > > > that.
> > > >
> > > > ipa_hbac.h is a public header of libipa_hbac, included in
> > > > libipa_hbac-devel. The attribute names don't have to be in the public
> > > > interface, I think that including the ipa_hbac_private.h header is
> > > > just
> > > > fine.
> > >
> > > Well, it's probably the best of bad options. Patches attached.
> > >
> > > Jan
> >
> > Nack, these patches still don't work. Here is my setup:
> >
> > # ipa selinuxusermap-find
> > ---------------------------
> > 2 SELinux User Maps matched
> > ---------------------------
> >
> > Rule name: test_all_user_all_hosts
> > SELinux User: xguest_u:s0
> > User category: all
> > Host category: all
> > Enabled: TRUE
> >
> > Rule name: test_user_all_hosts
> > SELinux User: user_u:s0-s0:c0.c1023
> > Host category: all
> > Enabled: TRUE
> > Users: tuser1
> >
> > I'm logging in as tuser1, so I was expecting to get
> > "user_u:s0-s0:c0.c1023", however neither of the maps match and I'm left
> > with the default.
>
> Could you please provide some more information like log files and cache? I
> have re-tested everything on my setup and it performs as expected.
>
> Thanks
> Jan
Never mind. I tried to play with my setup a bit and I eventually found the
issue myself. It was rather stupid copy-paste error, sorry for the
inconvenience.
Sending corrected patch set.
Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jzeleny-156-1-debug-messages-in-selinux-code.patch
Type: text/x-patch
Size: 5667 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120723/6d3c64cd/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jzeleny-157-2-extend-category-support-in-selinux-user-maps.patch
Type: text/x-patch
Size: 3039 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120723/6d3c64cd/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jzeleny-158-remove-ipa_selinux_map_merge.patch
Type: text/x-patch
Size: 3613 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120723/6d3c64cd/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jzeleny-159-2-hbac-selinux-linking.patch
Type: text/x-patch
Size: 2185 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120723/6d3c64cd/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120723/6d3c64cd/attachment.sig>
More information about the sssd-devel
mailing list