36805df397
- Resolves: upstream #2587 - With empty ipaselinuxusermapdefault security context on client is staff_u
82 lines
3.1 KiB
Diff
82 lines
3.1 KiB
Diff
From e991859590d4b598193f192674fca0ded1914bae Mon Sep 17 00:00:00 2001
|
|
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
Date: Fri, 13 Feb 2015 17:57:35 +0100
|
|
Subject: [PATCH 16/17] selinux: Delete existing user mapping on empty default
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
https://fedorahosted.org/sssd/ticket/2587
|
|
|
|
The case of SELinux default user mapping being an empty string is valid,
|
|
it should translate into "pick the default context on the target
|
|
machine".
|
|
|
|
In case the context is empty, we need to delete the per-user mapping from
|
|
the SELinux database to make sure the default is used.
|
|
|
|
Reviewed-by: Michal Židek <mzidek@redhat.com>
|
|
Reviewed-by: Pavel Reichl <preichl@redhat.com>
|
|
(cherry picked from commit 01f78f755fde63997ccfded71fb8395569b11430)
|
|
---
|
|
src/providers/ipa/ipa_selinux.c | 14 ++++++++------
|
|
src/providers/ipa/selinux_child.c | 10 +++++++++-
|
|
2 files changed, 17 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/src/providers/ipa/ipa_selinux.c b/src/providers/ipa/ipa_selinux.c
|
|
index f7e17c97f0bf8d6c64eb045c3bc954da8eb3d568..00c793a2643b51e59884730fa4f0ba3c7ed1bea6 100644
|
|
--- a/src/providers/ipa/ipa_selinux.c
|
|
+++ b/src/providers/ipa/ipa_selinux.c
|
|
@@ -749,7 +749,7 @@ static errno_t choose_best_seuser(TALLOC_CTX *mem_ctx,
|
|
|
|
/* If no maps match, we'll use the default SELinux user from the
|
|
* config */
|
|
- seuser_mls_str = talloc_strdup(tmp_ctx, default_user);
|
|
+ seuser_mls_str = talloc_strdup(tmp_ctx, default_user ? default_user : "");
|
|
if (seuser_mls_str == NULL) {
|
|
ret = ENOMEM;
|
|
goto done;
|
|
@@ -1373,11 +1373,13 @@ ipa_get_selinux_maps_offline(struct tevent_req *req)
|
|
return ENOMEM;
|
|
}
|
|
|
|
- ret = sysdb_attrs_add_string(state->defaults,
|
|
- IPA_CONFIG_SELINUX_DEFAULT_USER_CTX,
|
|
- default_user);
|
|
- if (ret != EOK) {
|
|
- return ret;
|
|
+ if (default_user) {
|
|
+ ret = sysdb_attrs_add_string(state->defaults,
|
|
+ IPA_CONFIG_SELINUX_DEFAULT_USER_CTX,
|
|
+ default_user);
|
|
+ if (ret != EOK) {
|
|
+ return ret;
|
|
+ }
|
|
}
|
|
|
|
ret = sysdb_attrs_add_string(state->defaults,
|
|
diff --git a/src/providers/ipa/selinux_child.c b/src/providers/ipa/selinux_child.c
|
|
index 63d4b929786d4b8cc0d40f0c65009673c7309094..3756557a5e28624e6437e805ca8a387d2f65dd1f 100644
|
|
--- a/src/providers/ipa/selinux_child.c
|
|
+++ b/src/providers/ipa/selinux_child.c
|
|
@@ -146,7 +146,15 @@ static int sc_set_seuser(const char *login_name, const char *seuser_name,
|
|
* the directories are created with the expected permissions
|
|
*/
|
|
old_mask = umask(0);
|
|
- ret = set_seuser(login_name, seuser_name, mls);
|
|
+ if (strcmp(seuser_name, "") == 0) {
|
|
+ /* An empty SELinux user should cause SSSD to use the system
|
|
+ * default. We need to remove the SELinux user from the DB
|
|
+ * in that case
|
|
+ */
|
|
+ ret = del_seuser(login_name);
|
|
+ } else {
|
|
+ ret = set_seuser(login_name, seuser_name, mls);
|
|
+ }
|
|
umask(old_mask);
|
|
return ret;
|
|
}
|
|
--
|
|
2.3.3
|
|
|