[SSSD] [PATCH] SELINUX: Set permissive umask for selinux operations

Roland Mainz rmainz at redhat.com
Tue Jan 27 15:41:28 UTC 2015



----- Original Message -----
> From: "Jakub Hrozek" <jhrozek at redhat.com>
> To: sssd-devel at lists.fedorahosted.org
> Sent: Tuesday, January 27, 2015 11:31:58 AM
> Subject: Re: [SSSD] [PATCH] SELINUX: Set permissive umask for selinux operations
> 
> On Tue, Jan 27, 2015 at 10:51:24AM +0100, Jakub Hrozek wrote:
> > Alternatively, we could only set and reset the umask in the caller. That
> > way, we would know that a short-lived selinux_child is changing umask.
> > 
> > That is safer, but risks that we forget next time..so at least we need
> > to add a comment to the declaration in header.
> 
> Attached is an alternate patch that only touches the umask in the
> short-lived process.

Which syscall exactly (strace dump, please) causes the original issue ? Maybe there is a way to do this without having to rely on |umask()| (using the |*at()| APIs or a later modification of the permissions) ...

----

Bye,
Roland

-- 
  __ .  . __
 (o.\ \/ /.o) rmainz at redhat.com
  \__\/\/__/  IPA/Kerberos5 team
  /O /==\ O\  
 (;O/ \/ \O;)
 



More information about the sssd-devel mailing list