[SSSD] [PATCHES] IPA: Use libsemanage

Jakub Hrozek jhrozek at redhat.com
Thu Sep 25 06:04:09 UTC 2014


On Wed, Sep 24, 2014 at 06:52:15PM +0200, Michal Židek wrote:
> Hi,
> 
> these 3 patches remove the old approach where we directly
> wrote the selinux login file. Here, the same approach is used
> as in the tools (sss_useradd/sss_usermod) where we already
> use libsemanage to manage these tasks.

Thanks a lot for the patches! I'm afraid we won't have the capacity to
review them until Tuesday and the next release, though..

> 
> The advantage is that we remove some lines of code (yay!)
> and get the auditing of selinux user changes for free.
> 
> 1st patch just moves stuff around, so that set_seuser
> function can be used from IPA provider.
> 
> 2nd patch is a very simple change that adds new attribute
> to the set_seuser function (mls_range).
> 
> The main functionality is in the 3rd patch. Note that to
> test the patch, you must run in permissive mode.
> $ setenforce Permissive
> 
> Otherwise you will get AVC denials (because sssd_be is
> not allowed to use libsemanage).
> 
> So we will have to change the selinux policy in fedora/rhel
> to make it work this way. I  will ping the selinux policy maintainer
> after the patches are reviewed.

Thanks, please do. Can you also in general ask him to help us review the
patches? Just to make sure we're not misusing something in the library..

> 
> Patches are attached.
> 
> Thanks,
> Michal



More information about the sssd-devel mailing list