[SSSD] [PATCH] Make IPA SELinux provider aware of subdomain users

Jakub Hrozek jhrozek at redhat.com
Fri Apr 26 08:28:53 UTC 2013


On Thu, Apr 25, 2013 at 01:58:37PM +0200, Sumit Bose wrote:
> Hi,
> 
> the IPA SELinux provider cannot look up subdomain user. This patch
> should fix it and ticket https://fedorahosted.org/sssd/ticket/1892.
> 
> bye,
> Sumit

[snip]

> -    op_ctx = ipa_selinux_create_op_ctx(be_req, be_ctx->domain->sysdb,
> -                                       be_ctx->domain,
> +    if (strcasecmp(pd->domain, be_ctx->domain->name) != 0) {
> +        subdom_be_ctx = ipa_get_subdomains_be_ctx(be_ctx);
> +        if (subdom_be_ctx == NULL) {
> +            DEBUG(SSSDBG_TRACE_ALL, ("Subdomains are not configured, " \
> +                                     "trying configured domain.\n"));
> +            user_domain = be_ctx->domain;

I wonder if this try of a configured domain would ever succeed?
Shouldn't we just fail in case an unknown domain is requested and
subdomains are off?



More information about the sssd-devel mailing list