summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorJakub Hrozek <jhrozek@redhat.com>2014-03-05 16:35:00 +0100
committerJakub Hrozek <jhrozek@redhat.com>2014-03-11 19:07:23 +0100
commit809e53108089bf892cd3c8da2ff4e475f2fd6b54 (patch)
tree357dd5e48302fcbd02305e2c83ec4c36038eedc1 /src
parent6fc597a48a49e313ab940c442dc06b3cd11392d4 (diff)
downloadsssd-809e53108089bf892cd3c8da2ff4e475f2fd6b54.tar.gz
sssd-809e53108089bf892cd3c8da2ff4e475f2fd6b54.tar.xz
sssd-809e53108089bf892cd3c8da2ff4e475f2fd6b54.zip
IPA: Use the correct domain when processing SELinux rules
We blindly used the user's domain for everything. That wrong in case the user comes from a subdomain. We should use the IPA domain for accessing the SELinux rules and host data and the user domain only for the user. https://fedorahosted.org/sssd/ticket/2270 Reviewed-by: Pavel Březina <pbrezina@redhat.com> (cherry picked from commit 36f606d6743e77721bedeed0907f1be7a19fa4f4)
Diffstat (limited to 'src')
-rw-r--r--src/providers/ipa/ipa_selinux.c26
1 files changed, 16 insertions, 10 deletions
diff --git a/src/providers/ipa/ipa_selinux.c b/src/providers/ipa/ipa_selinux.c
index 2209ca188..4ec5a6415 100644
--- a/src/providers/ipa/ipa_selinux.c
+++ b/src/providers/ipa/ipa_selinux.c
@@ -57,7 +57,8 @@ static errno_t ipa_get_selinux_recv(struct tevent_req *req,
static struct ipa_selinux_op_ctx *
ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb,
- struct sss_domain_info *domain,
+ struct sss_domain_info *ipa_domain,
+ struct sss_domain_info *user_domain,
struct be_req *be_req, const char *username,
const char *hostname,
struct ipa_selinux_ctx *selinux_ctx);
@@ -80,7 +81,8 @@ static errno_t ipa_selinux_process_maps(TALLOC_CTX *mem_ctx,
struct ipa_selinux_op_ctx {
struct be_req *be_req;
- struct sss_domain_info *domain;
+ struct sss_domain_info *user_domain;
+ struct sss_domain_info *ipa_domain;
struct ipa_selinux_ctx *selinux_ctx;
struct sysdb_attrs *user;
@@ -131,6 +133,7 @@ void ipa_selinux_handler(struct be_req *be_req)
}
op_ctx = ipa_selinux_create_op_ctx(be_req, user_domain->sysdb,
+ be_ctx->domain,
user_domain,
be_req, pd->user, hostname,
selinux_ctx);
@@ -155,7 +158,8 @@ fail:
static struct ipa_selinux_op_ctx *
ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb,
- struct sss_domain_info *domain,
+ struct sss_domain_info *ipa_domain,
+ struct sss_domain_info *user_domain,
struct be_req *be_req, const char *username,
const char *hostname,
struct ipa_selinux_ctx *selinux_ctx)
@@ -175,15 +179,16 @@ ipa_selinux_create_op_ctx(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb,
return NULL;
}
op_ctx->be_req = be_req;
- op_ctx->domain = domain;
+ op_ctx->ipa_domain = ipa_domain;
+ op_ctx->user_domain = user_domain;
op_ctx->selinux_ctx = selinux_ctx;
- ret = sss_selinux_extract_user(op_ctx, sysdb, domain, username, &op_ctx->user);
+ ret = sss_selinux_extract_user(op_ctx, sysdb, user_domain, username, &op_ctx->user);
if (ret != EOK) {
goto fail;
}
- host_dn = sysdb_custom_dn(sysdb, op_ctx, domain, hostname, HBAC_HOSTS_SUBDIR);
+ host_dn = sysdb_custom_dn(sysdb, op_ctx, ipa_domain, hostname, HBAC_HOSTS_SUBDIR);
if (host_dn == NULL) {
goto fail;
}
@@ -229,7 +234,7 @@ static void ipa_selinux_handler_done(struct tevent_req *req)
struct ipa_selinux_op_ctx *op_ctx = tevent_req_callback_data(req, struct ipa_selinux_op_ctx);
struct be_req *breq = op_ctx->be_req;
struct be_ctx *be_ctx = be_req_get_be_ctx(breq);
- struct sysdb_ctx *sysdb = op_ctx->domain->sysdb;
+ struct sysdb_ctx *sysdb = op_ctx->ipa_domain->sysdb;
errno_t ret, sret;
size_t map_count = 0;
struct sysdb_attrs **maps = NULL;
@@ -258,21 +263,22 @@ static void ipa_selinux_handler_done(struct tevent_req *req)
}
in_transaction = true;
- ret = sysdb_delete_usermaps(op_ctx->domain->sysdb, op_ctx->domain);
+ ret = sysdb_delete_usermaps(op_ctx->ipa_domain->sysdb, op_ctx->ipa_domain);
if (ret != EOK) {
DEBUG(SSSDBG_CRIT_FAILURE,
("Cannot delete existing maps from sysdb\n"));
goto fail;
}
- ret = sysdb_store_selinux_config(sysdb, op_ctx->domain,
+ ret = sysdb_store_selinux_config(op_ctx->ipa_domain->sysdb,
+ op_ctx->ipa_domain,
default_user, map_order);
if (ret != EOK) {
goto fail;
}
if (map_count > 0 && maps != NULL) {
- ret = ipa_save_user_maps(sysdb, op_ctx->domain, map_count, maps);
+ ret = ipa_save_user_maps(sysdb, op_ctx->ipa_domain, map_count, maps);
if (ret != EOK) {
goto fail;
}