sssd.git/src/responder/pam, branch refactor

Add new option default_domain_suffix

2012-10-01T19:45:21+00:00

SELinux: Always use the default if it exists on the server

2012-09-13T16:11:59+00:00

https://fedorahosted.org/sssd/ticket/1513

This is a counterpart of the FreeIPA ticket https://fedorahosted.org/freeipa/ticket/3045

During an e-mail discussion, it was decided that

    * if the default is set in the IPA config object, the SSSD would use
      that default no matter what
    * if the default is not set (aka empty or missing), the SSSD
      would just use the system default and skip creating the login
      file altogether

Check if the SELinux login directory exists

2012-09-04T08:14:18+00:00

https://fedorahosted.org/sssd/ticket/1492

Only create the SELinux login file if there are mappings on the server

2012-08-16T11:31:03+00:00

https://fedorahosted.org/sssd/ticket/1455

In case there are no rules on the IPA server, we must simply avoid generating
the login file. That would make us fall back to the system-wide default
defined in /etc/selinux/targeted/seusers.

The IPA default must be only used if there *are* rules on the server,
but none matches.

Do not try to remove the temp login file if already renamed

2012-08-16T11:30:58+00:00

write_selinux_string() would try to unlink the temporary file even after
it was renamed. Failure to unlink the file would not be fatal, but would
produce a confusing error message.

Also don't use "0" for the default fd number, that's reserved for stdin.
Using -1 is safer.

Build SELinux code in responder conditionally

2012-08-16T09:11:24+00:00

https://fedorahosted.org/sssd/ticket/1480

Fix bad check

2012-08-01T19:13:07+00:00

Write SELinux config files in responder instead of PAM module

2012-07-27T12:46:16+00:00

Move SELinux processing from session to account PAM stack

2012-07-27T08:37:06+00:00

The idea is to rename session provider to selinux provider. Processing
of SELinux rules has to be performed in account stack in order to ensure
that pam_selinux (which is the first module in PAM session stack) will
get the correct input from SSSD.

Processing of account PAM stack is bound to access provider. That means
we need to have two providers executed when SSS_PAM_ACCT_MGMT message
is received from PAM responder. Change in data_provider_be.c ensures
just that - after access provider finishes its actions, the control is
given to selinux provider and only after this provider finishes is the
result returned to PAM responder.

PAM: Fix off-by-one-error in the SELinux session code

2012-07-18T19:10:38+00:00