[SSSD] [PATCH] SELINUX: Set permissive umask for selinux operations

Jakub Hrozek jhrozek at redhat.com
Tue Jan 27 16:25:36 UTC 2015


On Tue, Jan 27, 2015 at 11:07:01AM -0500, Roland Mainz wrote:
> 
> 
> ----- Original Message -----
> > From: "Roland Mainz" <rmainz at redhat.com>
> > To: "Development of the System Security Services Daemon" <sssd-devel at lists.fedorahosted.org>
> > Sent: Tuesday, January 27, 2015 4:41:28 PM
> > Subject: Re: [SSSD] [PATCH] SELINUX: Set permissive umask for selinux operations
> > 
> > 
> > 
> > ----- Original Message -----
> > > From: "Jakub Hrozek" <jhrozek at redhat.com>
> > > To: sssd-devel at lists.fedorahosted.org
> > > Sent: Tuesday, January 27, 2015 11:31:58 AM
> > > Subject: Re: [SSSD] [PATCH] SELINUX: Set permissive umask for selinux
> > > operations
> > > 
> > > On Tue, Jan 27, 2015 at 10:51:24AM +0100, Jakub Hrozek wrote:
> > > > Alternatively, we could only set and reset the umask in the caller. That
> > > > way, we would know that a short-lived selinux_child is changing umask.
> > > > 
> > > > That is safer, but risks that we forget next time..so at least we need
> > > > to add a comment to the declaration in header.
> > > 
> > > Attached is an alternate patch that only touches the umask in the
> > > short-lived process.
> > 
> > Which syscall exactly (strace dump, please) causes the original issue ? Maybe
> > there is a way to do this without having to rely on |umask()| (using the
> > |*at()| APIs or a later modification of the permissions) ...
> 
> I discussed this with jhrozek on IRC... basically libsemanage should fix the permissions after the |mkdir()| call like the mkdir(1) code in https://searchcode.com/codesearch/view/5481405/ line 160 ... but until they we have to stick with the |umask()| workaround (and praying that sssd never uses threads).

I filed:
https://bugzilla.redhat.com/show_bug.cgi?id=1186422
and:
https://bugzilla.redhat.com/show_bug.cgi?id=1186431

against libsemanage. As discussed with Roland on IRC, I will add a URL
of the bugzilla to a comment in selinux_child to make it clear that it's
just a workaround for a bug, not a clean solution.



More information about the sssd-devel mailing list