[SSSD] [PATCHES] If possible, use cache in SELinux rules processing

Jan Zelený jzeleny at redhat.com
Tue Jul 31 07:49:45 UTC 2012


Dne pondělí 30 července 2012 19:04:50, Jakub Hrozek napsal(a):
> On Mon, Jul 30, 2012 at 09:34:43AM +0200, Jan Zelený wrote:
> > These three patches provide changes that reduce the amount of data
> > retrieved from IPA server in case this data is previously retrieved by
> > HBAC access provider.
> > 
> > #168: modify hbac_get_cached_rules() so it can be used out of the HBAC
> > code
> > #169: use cache for HBAC rules
> > #170: use cache for host record
> 
> Nack, the patches break HBAC-linked SELinux mappings completely.
> 
> hbac_get_cached_rules() doesn't return originalDN, yet
> ipa_get_selinux_hbac_process depends on them.

Thanks for catching this. As it turned out, I had disabled HBAC-linked rules 
on my IPA server at some point, that's why I didn't catch this myself.

> Code style issues are inline.

All fixed, new patches attached.

Thanks
Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jzeleny-168-1-hbac_get_cached_rules-made-public.patch
Type: text/x-patch
Size: 4395 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120731/d0dc3f47/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jzeleny-169-fetching-of-hbac-rules-from-sysdb.patch
Type: text/x-patch
Size: 4560 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120731/d0dc3f47/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jzeleny-170-fetching-host-info-from-sysdb.patch
Type: text/x-patch
Size: 4920 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120731/d0dc3f47/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120731/d0dc3f47/attachment.sig>


More information about the sssd-devel mailing list