summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJakub Hrozek <jhrozek@redhat.com>2015-02-13 17:57:35 +0100
committerJakub Hrozek <jhrozek@redhat.com>2015-03-04 19:55:29 +0100
commit01f78f755fde63997ccfded71fb8395569b11430 (patch)
tree66eb4193315261c4bdf8fbf9b4ec48088bded9d1
parent2b20ff2e33ad3993a9cad910c4b4b828513613df (diff)
downloadsssd-01f78f755fde63997ccfded71fb8395569b11430.tar.gz
sssd-01f78f755fde63997ccfded71fb8395569b11430.tar.xz
sssd-01f78f755fde63997ccfded71fb8395569b11430.zip
selinux: Delete existing user mapping on empty default
https://fedorahosted.org/sssd/ticket/2587 The case of SELinux default user mapping being an empty string is valid, it should translate into "pick the default context on the target machine". In case the context is empty, we need to delete the per-user mapping from the SELinux database to make sure the default is used. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
-rw-r--r--src/providers/ipa/ipa_selinux.c14
-rw-r--r--src/providers/ipa/selinux_child.c10
2 files changed, 17 insertions, 7 deletions
diff --git a/src/providers/ipa/ipa_selinux.c b/src/providers/ipa/ipa_selinux.c
index 4286eb163..50ff84056 100644
--- a/src/providers/ipa/ipa_selinux.c
+++ b/src/providers/ipa/ipa_selinux.c
@@ -749,7 +749,7 @@ static errno_t choose_best_seuser(TALLOC_CTX *mem_ctx,
/* If no maps match, we'll use the default SELinux user from the
* config */
- seuser_mls_str = talloc_strdup(tmp_ctx, default_user);
+ seuser_mls_str = talloc_strdup(tmp_ctx, default_user ? default_user : "");
if (seuser_mls_str == NULL) {
ret = ENOMEM;
goto done;
@@ -1373,11 +1373,13 @@ ipa_get_selinux_maps_offline(struct tevent_req *req)
return ENOMEM;
}
- ret = sysdb_attrs_add_string(state->defaults,
- IPA_CONFIG_SELINUX_DEFAULT_USER_CTX,
- default_user);
- if (ret != EOK) {
- return ret;
+ if (default_user) {
+ ret = sysdb_attrs_add_string(state->defaults,
+ IPA_CONFIG_SELINUX_DEFAULT_USER_CTX,
+ default_user);
+ if (ret != EOK) {
+ return ret;
+ }
}
ret = sysdb_attrs_add_string(state->defaults,
diff --git a/src/providers/ipa/selinux_child.c b/src/providers/ipa/selinux_child.c
index 63d4b9297..3756557a5 100644
--- a/src/providers/ipa/selinux_child.c
+++ b/src/providers/ipa/selinux_child.c
@@ -146,7 +146,15 @@ static int sc_set_seuser(const char *login_name, const char *seuser_name,
* the directories are created with the expected permissions
*/
old_mask = umask(0);
- ret = set_seuser(login_name, seuser_name, mls);
+ if (strcmp(seuser_name, "") == 0) {
+ /* An empty SELinux user should cause SSSD to use the system
+ * default. We need to remove the SELinux user from the DB
+ * in that case
+ */
+ ret = del_seuser(login_name);
+ } else {
+ ret = set_seuser(login_name, seuser_name, mls);
+ }
umask(old_mask);
return ret;
}