[SSSD] [PATCH] Make IPA SELinux provider aware of subdomain users

Sumit Bose sbose at redhat.com
Fri Apr 26 08:47:22 UTC 2013


On Fri, Apr 26, 2013 at 10:28:53AM +0200, Jakub Hrozek wrote:
> On Thu, Apr 25, 2013 at 01:58:37PM +0200, Sumit Bose wrote:
> > Hi,
> > 
> > the IPA SELinux provider cannot look up subdomain user. This patch
> > should fix it and ticket https://fedorahosted.org/sssd/ticket/1892.
> > 
> > bye,
> > Sumit
> 
> [snip]
> 
> > -    op_ctx = ipa_selinux_create_op_ctx(be_req, be_ctx->domain->sysdb,
> > -                                       be_ctx->domain,
> > +    if (strcasecmp(pd->domain, be_ctx->domain->name) != 0) {
> > +        subdom_be_ctx = ipa_get_subdomains_be_ctx(be_ctx);
> > +        if (subdom_be_ctx == NULL) {
> > +            DEBUG(SSSDBG_TRACE_ALL, ("Subdomains are not configured, " \
> > +                                     "trying configured domain.\n"));
> > +            user_domain = be_ctx->domain;
> 
> I wonder if this try of a configured domain would ever succeed?
> Shouldn't we just fail in case an unknown domain is requested and
> subdomains are off?

My intention was to preserve the original behaviour as much as possible.
But you are right, currently only the configured domain can be resolved
in this case.

I will modify the patch accordingly.

bye,
Sumit
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list