[SSSD] [PATCH] SELinux user maps: pick just one map

Jan Zelený jzeleny at redhat.com
Fri Jun 22 14:12:27 UTC 2012


Dne pátek 22 června 2012 09:41:37, Rob Crittenden napsal(a):
> Jan Zelený wrote:
> > Dne pátek 22 června 2012 09:15:15, Rob Crittenden napsal(a):
> >> Jan Zelený wrote:
> >>> This patch modifies behavior of SSSD when putting together content of
> >>> user config file for pam_selinux. SSSD will now pick only the first user
> >>> map in the priority list which matches to the user logging in. Other
> >>> maps
> >>> are ignored.
> >>> 
> >>> https://fedorahosted.org/sssd/ticket/1360
> >>> 
> >>> Rob, please confirm that this is the right and expected behavior.
> >>> 
> >>> Thanks
> >>> Jan
> >> 
> >> What you have described sounds right. I don't have enough context in
> >> sssd to know whether this patch will achieve that.
> > 
> > I realize that. I just wanted to verify that the described behavior is
> > correct. The patch itself will be reviewed by someone else from SSSD team.
> > 
> > Thank you for the confirmation
> 
> We had a discussion in IRC and it seems that the using of the usermap
> order is incorrect. The list is ordered from least to most permissive
> (xguest ... unconfined).
> 
> We want to assign the most permissive context available. So if several
> rules evaluate the same except for context we need to refer to the
> ordered list and pick the most permissive one.

Following patch selects the right record with respect to ascending order of 
permission levels.

Thanks
Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jzeleny-152-1-just-one-selinux-user-map.patch
Type: text/x-patch
Size: 2639 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120622/e1f4dd2e/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120622/e1f4dd2e/attachment.sig>


More information about the sssd-devel mailing list