From 663fdd3897c5da1a54fcb51613bd71660ef9b19a Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Wed, 20 Jun 2018 22:02:57 +0200
Subject: [PATCH] SELINUX: Also call is_selinux_enabled as a check for selinux
 child
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Resolves:
https://pagure.io/SSSD/sssd/issue/3796

The SSSD selinux management routines were only checking if SELinux is
managed on the system. If it is managed, the code tries to proceed and
set the login context, otherwise an error is returned which SSSD handles
gracefully.

But this is not enough, in some cases SELinux might be disabled, but
managed and in these cases SSSD was returning strange errors, which
might have prevented login with selinux provider in effect.

We got this hint form the RH SELinux maintainer:
"""
libsemanage is for managing SELinux infrastructure. generally if there's
/etc/selinux/config where libsemanage can read SELINUXTYPE and SELinux
module store - /etc/selinux/<SELINUXTYPE>/active (or
/var/lib/selinux/<SELINUXTYPE>/active) - is available, libsemanage can
manage it even when SELinux is disabled.

I'm not sure if selinux_child doesn any is_selinux_enabled() checks but
it could help to avoid such situations.
"""

Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
(cherry picked from commit 1e81d040c75b2b15cab48fb7df1041138747e6c3)

DOWNSTREAM:
Resolves: rhbz#1583360 - The IPA selinux provider can return an error if SELinux is completely disabled
---
 src/util/sss_semanage.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/util/sss_semanage.c b/src/util/sss_semanage.c
index 7b0eef22330db8df6ab8f46da5fb76c68f6adabc..bcce57b603bd1c4d5c6465dbb5cc7a3fbe72412d 100644
--- a/src/util/sss_semanage.c
+++ b/src/util/sss_semanage.c
@@ -82,6 +82,10 @@ static int sss_is_selinux_managed(semanage_handle_t *handle)
         return EINVAL;
     }
 
+    if (!is_selinux_enabled()) {
+        return ERR_SELINUX_NOT_MANAGED;
+    }
+
     ret = semanage_is_managed(handle);
     if (ret == 0) {
         DEBUG(SSSDBG_TRACE_FUNC, "SELinux policy not managed via libsemanage\n");
-- 
2.17.1