[SSSD] [PATCH] SELinux: Always use the default if it exists on the server

Pavel Březina pbrezina at redhat.com
Thu Sep 13 13:24:05 UTC 2012


On 09/13/2012 12:24 PM, Jakub Hrozek wrote:
> In order to test these patches properly, you need to be running the
> latest patches that are currently on review on freeipa-devel. Ping me
> off-line for access to such IPA client.
>
> [PATCH 1/2] DB: Always write the SELinux object to sysdb
> This is a fallout of the transaction processing refactoring.
>
> There's no point in checking if the object already exists because we always
> wipe the whole sysdb subtree. We were also immediatelly cancelling the
> transaction because we'd jump to goto, even though it was with EOK.

Ack.

> [PATCH 2/2] SELinux: Always use the default if it exists on the server
>
> https://fedorahosted.org/sssd/ticket/1513
>
> This is a counterpart of the FreeIPA ticket https://fedorahosted.org/freeipa/ticket/3045
>
> During an e-mail discussion, it was decided that
>
>      * if the default is set in the IPA config object, the SSSD would use
>        that default no matter what
>      * if the default is not set (aka empty or missing), the SSSD would just
>        use the system default and skip creating the login file altogether

Nack.

> @@ -136,11 +136,9 @@ static void ipa_selinux_handler_done(struct tevent_req *req)
>          goto fail;
>      }
>
> -    if (default_user != NULL && map_order != NULL) {
> -        ret = sysdb_store_selinux_config(sysdb, default_user, map_order);
> -        if (ret != EOK) {
> -            goto fail;
> -        }
> +    ret = sysdb_store_selinux_config(sysdb, default_user, map_order);
> +    if (ret != EOK) {
> +        goto fail;
>      }

Are you sure that it is safe to remove the NULL checks? You are testing 
default_user inside sysdb_store_selinux_config(), but not map_order. 
There is a code path where map_order may be NULL.




More information about the sssd-devel mailing list