[SSSD] [PATCHES] IPA: Use libsemanage

Michal Židek mzidek at redhat.com
Wed Sep 24 17:45:16 UTC 2014


On 09/24/2014 06:52 PM, Michal Židek wrote:
> Hi,
>
> these 3 patches remove the old approach where we directly
> wrote the selinux login file. Here, the same approach is used
> as in the tools (sss_useradd/sss_usermod) where we already
> use libsemanage to manage these tasks.
>
> The advantage is that we remove some lines of code (yay!)
> and get the auditing of selinux user changes for free.
>
> 1st patch just moves stuff around, so that set_seuser
> function can be used from IPA provider.
>
> 2nd patch is a very simple change that adds new attribute
> to the set_seuser function (mls_range).
>
> The main functionality is in the 3rd patch. Note that to
> test the patch, you must run in permissive mode.
> $ setenforce Permissive
>
> Otherwise you will get AVC denials (because sssd_be is
> not allowed to use libsemanage).
>
> So we will have to change the selinux policy in fedora/rhel
> to make it work this way. I  will ping the selinux policy maintainer
> after the patches are reviewed.
>
> Patches are attached.
>
> Thanks,
> Michal
>

I forgot to remove one unused variable. New
patches are attached.

Michal

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-util-Move-semanage-related-functions-to-src-util.patch
Type: text/x-patch
Size: 21788 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140924/515d1dda/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-sss_semanage-Add-mlsrange-parameter-to-set_seuser.patch
Type: text/x-patch
Size: 5163 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140924/515d1dda/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-IPA-Use-set_seuser-instead-of-writing-selinux-login-.patch
Type: text/x-patch
Size: 8308 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140924/515d1dda/attachment-0002.bin>


More information about the sssd-devel mailing list