[SSSD] [PATCH] Write SELinux config files in responder instead of PAM module

Jakub Hrozek jhrozek at redhat.com
Fri Jul 27 12:52:04 UTC 2012


On Fri, Jul 27, 2012 at 11:19:39AM +0200, Jan Zelený wrote:
> Dne pátek 27 července 2012 09:49:57, Jan Zelený napsal(a):
> > Without this change, a process linking our PAM module would do the writing.
> > That could be potentially problematic because everych such process will
> > probably have its own selinux context. That would need rule in the policy
> > for every process that is linked with PAM modules.
> > 
> > With this change, the context of process writing to the config file will be
> > sssd_t, which makes life easier for SELinux policy maintainers.
> > 
> > Thanks
> > Jan
> 
> Review done on IRC by Jakub, sending corrected patch.
> 
> Thanks
> Jan

Ack and pushed to master.



More information about the sssd-devel mailing list