[SSSD] [PATCHES][PRELIMINARY] Move SELinux processing to account PAM stack

Jakub Hrozek jhrozek at redhat.com
Thu Jul 26 15:05:32 UTC 2012


On Thu, Jul 26, 2012 at 11:18:22AM +0200, Jan Zelený wrote:
> Dne středa 25 července 2012 10:19:04, Simo Sorce napsal(a):
> > On Wed, 2012-07-25 at 08:54 +0200, Jan Zelený wrote:
> > > #161 - Rename session provider to selinux provider
> > > #162 - Move SELinux provider processing right after PAM_ACCT_MGMT
> > > 
> > > These patches are a proof of concept solving following ticket:
> > > 
> > > https://fedorahosted.org/sssd/ticket/1439
> > > 
> > > I realize that there might be some rough edges to sand off but right now
> > > the important thing for me is to know whether the approach implemented in
> > > patch #162 and described in the comment #1 in the ticket is valid.
> > 
> > NACK, we discussed a better approach on IRC.
> > 
> > Simo.
> 
> Here it is. I re-numbered the patch set because there is a new patch #163 
> bringing a simple fix that should be applied before patch #165.
> 
> I also extended the commit message. Now it explains the entire idea behind the 
> patch.
> 
> Thanks
> Jan

I was able to successfuly test the basic SELinux features with this
patch on a fresh ipa-client install with unmodified PAM stack -- great!

Code-wise, I'm just not a big fan of "phase" in the generic be_req
structure, but that could be fixed post-beta.

Ack from me, I'd like to have Simo take a second look, because he has
architected the approach.



More information about the sssd-devel mailing list