[SSSD] [PATCHES][PRELIMINARY] Move SELinux processing to account PAM stack
Jakub Hrozek
jhrozek at redhat.com
Thu Jul 26 15:05:32 UTC 2012
On Thu, Jul 26, 2012 at 11:18:22AM +0200, Jan Zelený wrote:
> Dne středa 25 července 2012 10:19:04, Simo Sorce napsal(a):
> > On Wed, 2012-07-25 at 08:54 +0200, Jan Zelený wrote:
> > > #161 - Rename session provider to selinux provider
> > > #162 - Move SELinux provider processing right after PAM_ACCT_MGMT
> > >
> > > These patches are a proof of concept solving following ticket:
> > >
> > > https://fedorahosted.org/sssd/ticket/1439
> > >
> > > I realize that there might be some rough edges to sand off but right now
> > > the important thing for me is to know whether the approach implemented in
> > > patch #162 and described in the comment #1 in the ticket is valid.
> >
> > NACK, we discussed a better approach on IRC.
> >
> > Simo.
>
> Here it is. I re-numbered the patch set because there is a new patch #163
> bringing a simple fix that should be applied before patch #165.
>
> I also extended the commit message. Now it explains the entire idea behind the
> patch.
>
> Thanks
> Jan
I was able to successfuly test the basic SELinux features with this
patch on a fresh ipa-client install with unmodified PAM stack -- great!
Code-wise, I'm just not a big fan of "phase" in the generic be_req
structure, but that could be fixed post-beta.
Ack from me, I'd like to have Simo take a second look, because he has
architected the approach.
More information about the sssd-devel
mailing list