[SSSD] [PATCH] Make IPA SELinux provider aware of subdomain users
Sumit Bose
sbose at redhat.com
Fri Apr 26 09:40:11 UTC 2013
On Fri, Apr 26, 2013 at 10:47:22AM +0200, Sumit Bose wrote:
> On Fri, Apr 26, 2013 at 10:28:53AM +0200, Jakub Hrozek wrote:
> > On Thu, Apr 25, 2013 at 01:58:37PM +0200, Sumit Bose wrote:
> > > Hi,
> > >
> > > the IPA SELinux provider cannot look up subdomain user. This patch
> > > should fix it and ticket https://fedorahosted.org/sssd/ticket/1892.
> > >
> > > bye,
> > > Sumit
> >
> > [snip]
> >
> > > - op_ctx = ipa_selinux_create_op_ctx(be_req, be_ctx->domain->sysdb,
> > > - be_ctx->domain,
> > > + if (strcasecmp(pd->domain, be_ctx->domain->name) != 0) {
> > > + subdom_be_ctx = ipa_get_subdomains_be_ctx(be_ctx);
> > > + if (subdom_be_ctx == NULL) {
> > > + DEBUG(SSSDBG_TRACE_ALL, ("Subdomains are not configured, " \
> > > + "trying configured domain.\n"));
> > > + user_domain = be_ctx->domain;
> >
> > I wonder if this try of a configured domain would ever succeed?
> > Shouldn't we just fail in case an unknown domain is requested and
> > subdomains are off?
>
> My intention was to preserve the original behaviour as much as possible.
> But you are right, currently only the configured domain can be resolved
> in this case.
>
> I will modify the patch accordingly.
New version attached.
bye,
Sumit
>
> bye,
> Sumit
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From 1c986a3176f842420222516b7dc2456ba5ad66e1 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 22 Apr 2013 10:43:44 +0200
Subject: [PATCH] Make IPA SELinux provider aware of subdomain users
Fixes https://fedorahosted.org/sssd/ticket/1892
---
src/providers/ipa/ipa_selinux.c | 27 +++++++++++++++++++++++++--
src/providers/ipa/ipa_subdomains.c | 14 ++++++++++++++
src/providers/ipa/ipa_subdomains.h | 2 ++
3 files changed, 41 insertions(+), 2 deletions(-)
diff --git a/src/providers/ipa/ipa_selinux.c b/src/providers/ipa/ipa_selinux.c
index ed44fac..d82485e 100644
--- a/src/providers/ipa/ipa_selinux.c
+++ b/src/providers/ipa/ipa_selinux.c
@@ -36,6 +36,7 @@
#include "providers/ipa/ipa_access.h"
#include "providers/ipa/ipa_selinux_common.h"
#include "providers/ipa/ipa_selinux_maps.h"
+#include "providers/ipa/ipa_subdomains.h"
#ifdef HAVE_SELINUX_LOGIN_DIR
@@ -94,6 +95,8 @@ void ipa_selinux_handler(struct be_req *be_req)
struct tevent_req *req;
struct pam_data *pd;
const char *hostname;
+ struct sss_domain_info *user_domain;
+ struct be_ctx *subdom_be_ctx;
pd = talloc_get_type(be_req_get_data(be_req), struct pam_data);
@@ -107,8 +110,28 @@ void ipa_selinux_handler(struct be_req *be_req)
goto fail;
}
- op_ctx = ipa_selinux_create_op_ctx(be_req, be_ctx->domain->sysdb,
- be_ctx->domain,
+ if (strcasecmp(pd->domain, be_ctx->domain->name) != 0) {
+ subdom_be_ctx = ipa_get_subdomains_be_ctx(be_ctx);
+ if (subdom_be_ctx == NULL) {
+ DEBUG(SSSDBG_CONF_SETTINGS, ("Subdomains are not configured, " \
+ "cannot lookup domain [%s].\n",
+ pd->domain));
+ goto fail;
+ } else {
+ user_domain = find_subdomain_by_name(subdom_be_ctx->domain,
+ pd->domain, true);
+ if (user_domain == NULL) {
+ DEBUG(SSSDBG_MINOR_FAILURE, ("No domain entry found " \
+ "for [%s].\n", pd->domain));
+ goto fail;
+ }
+ }
+ } else {
+ user_domain = be_ctx->domain;
+ }
+
+ op_ctx = ipa_selinux_create_op_ctx(be_req, user_domain->sysdb,
+ user_domain,
be_req, pd->user, hostname,
selinux_ctx);
if (op_ctx == NULL) {
diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index 529618b..98fc69f 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -79,6 +79,20 @@ struct ipa_subdomains_ctx {
time_t disabled_until;
};
+struct be_ctx *ipa_get_subdomains_be_ctx(struct be_ctx *be_ctx)
+{
+ struct ipa_subdomains_ctx *subdom_ctx;
+
+ subdom_ctx = talloc_get_type(be_ctx->bet_info[BET_SUBDOMAINS].pvt_bet_data,
+ struct ipa_subdomains_ctx);
+ if (subdom_ctx == NULL) {
+ DEBUG(SSSDBG_TRACE_ALL, ("Subdomains are not configured.\n"));
+ return NULL;
+ }
+
+ return subdom_ctx->be_ctx;
+}
+
const char *get_flat_name_from_subdomain_name(struct be_ctx *be_ctx,
const char *name)
{
diff --git a/src/providers/ipa/ipa_subdomains.h b/src/providers/ipa/ipa_subdomains.h
index 35b42b4..df7f994 100644
--- a/src/providers/ipa/ipa_subdomains.h
+++ b/src/providers/ipa/ipa_subdomains.h
@@ -28,6 +28,8 @@
#include "providers/dp_backend.h"
#include "providers/ipa/ipa_common.h"
+struct be_ctx *ipa_get_subdomains_be_ctx(struct be_ctx *be_ctx);
+
const char *get_flat_name_from_subdomain_name(struct be_ctx *be_ctx,
const char *name);
--
1.7.7.6
More information about the sssd-devel
mailing list