[SSSD] [PATCH] IPA: Write SELinux usernames in the right case

Jakub Hrozek jhrozek at redhat.com
Wed Mar 12 14:42:09 UTC 2014


pam_selinux expects the file to be of the same case as getpwnam uses.
This patch uses the right case for the file instead of the original one.
-------------- next part --------------
>From 6b4d8e9c226b5d2e1ae0f06738809458049741cc Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 12 Mar 2014 15:19:02 +0100
Subject: [PATCH] IPA: Write SELinux usernames in the right case

---
 src/providers/ipa/ipa_selinux.c | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/src/providers/ipa/ipa_selinux.c b/src/providers/ipa/ipa_selinux.c
index 81e8d59fd58be25253968eee3a498e1a300f3347..1fc0c68d0bdc7cc5131d61694db26a208c51d300 100644
--- a/src/providers/ipa/ipa_selinux.c
+++ b/src/providers/ipa/ipa_selinux.c
@@ -270,6 +270,7 @@ static errno_t create_order_array(TALLOC_CTX *mem_ctx, const char *map_order,
                                   char ***_order_array, size_t *_order_count);
 static errno_t choose_best_seuser(struct sysdb_attrs **usermaps,
                                   struct pam_data *pd,
+                                  struct sss_domain_info *user_domain,
                                   char **order_array, int order_count,
                                   const char *default_user);
 
@@ -355,8 +356,8 @@ static void ipa_selinux_handler_done(struct tevent_req *req)
         goto fail;
     }
 
-    ret = choose_best_seuser(best_match_maps, pd, order_array, order_count,
-                             default_user);
+    ret = choose_best_seuser(best_match_maps, pd, op_ctx->user_domain,
+                             order_array, order_count, default_user);
     if (ret != EOK) {
         DEBUG(SSSDBG_CRIT_FAILURE,
               "Failed to evaluate ordered SELinux users array.\n");
@@ -645,13 +646,16 @@ done:
     return ret;
 }
 
-static errno_t write_selinux_login_file(const char *username, char *string);
+static errno_t write_selinux_login_file(const char *orig_name,
+                                        struct sss_domain_info *dom,
+                                        char *string);
 static errno_t remove_selinux_login_file(const char *username);
 
 /* Choose best selinux user based on given order and write
  * the user to selinux login file. */
 static errno_t choose_best_seuser(struct sysdb_attrs **usermaps,
                                   struct pam_data *pd,
+                                  struct sss_domain_info *user_domain,
                                   char **order_array, int order_count,
                                   const char *default_user)
 {
@@ -706,7 +710,7 @@ static errno_t choose_best_seuser(struct sysdb_attrs **usermaps,
         }
     }
 
-    ret = write_selinux_login_file(pd->user, file_content);
+    ret = write_selinux_login_file(pd->user, user_domain, file_content);
 done:
     if (!file_content) {
         err = remove_selinux_login_file(pd->user);
@@ -717,7 +721,9 @@ done:
     return ret;
 }
 
-static errno_t write_selinux_login_file(const char *username, char *string)
+static errno_t write_selinux_login_file(const char *orig_name,
+                                        struct sss_domain_info *dom,
+                                        char *string)
 {
     char *path = NULL;
     char *tmp_path = NULL;
@@ -729,6 +735,7 @@ static errno_t write_selinux_login_file(const char *username, char *string)
     char *full_string = NULL;
     int enforce;
     errno_t ret = EOK;
+    const char *username;
 
     len = strlen(string);
     if (len == 0) {
@@ -741,6 +748,15 @@ static errno_t write_selinux_login_file(const char *username, char *string)
         return ENOMEM;
     }
 
+    /* pam_selinux needs the username in the same format getpwnam() would
+     * return it
+     */
+    username = sss_get_cased_name(tmp_ctx, orig_name, dom->case_sensitive);
+    if (username == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
     path = selogin_path(tmp_ctx, username);
     if (path == NULL) {
         ret = ENOMEM;
-- 
1.8.5.3



More information about the sssd-devel mailing list