From 0f1b17391dce51ce149cafecf5dfe7acc1dc32cb Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Fri, 13 Feb 2015 17:57:35 +0100
Subject: [PATCH 190/190] selinux: Delete existing user mapping on empty
 default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://fedorahosted.org/sssd/ticket/2587

The case of SELinux default user mapping being an empty string is valid,
it should translate into "pick the default context on the target
machine".

In case the context is empty, we need to delete the per-user mapping from
the SELinux database to make sure the default is used.

Reviewed-by: Michal Židek <mzidek@redhat.com>
Reviewed-by: Pavel Reichl <preichl@redhat.com>
(cherry picked from commit 01f78f755fde63997ccfded71fb8395569b11430)
---
 src/providers/ipa/ipa_selinux.c   | 14 ++++++++------
 src/providers/ipa/selinux_child.c | 10 +++++++++-
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/src/providers/ipa/ipa_selinux.c b/src/providers/ipa/ipa_selinux.c
index 133b679b6d518704ebb2bd901c64ac48170c9a0b..1172424cb3f6df06e6ecaa8914427f8f945a7251 100644
--- a/src/providers/ipa/ipa_selinux.c
+++ b/src/providers/ipa/ipa_selinux.c
@@ -749,7 +749,7 @@ static errno_t choose_best_seuser(TALLOC_CTX *mem_ctx,
 
     /* If no maps match, we'll use the default SELinux user from the
      * config */
-    seuser_mls_str = talloc_strdup(tmp_ctx, default_user);
+    seuser_mls_str = talloc_strdup(tmp_ctx, default_user ? default_user : "");
     if (seuser_mls_str == NULL) {
         ret = ENOMEM;
         goto done;
@@ -1373,11 +1373,13 @@ ipa_get_selinux_maps_offline(struct tevent_req *req)
         return ENOMEM;
     }
 
-    ret = sysdb_attrs_add_string(state->defaults,
-                                 IPA_CONFIG_SELINUX_DEFAULT_USER_CTX,
-                                 default_user);
-    if (ret != EOK) {
-        return ret;
+    if (default_user) {
+        ret = sysdb_attrs_add_string(state->defaults,
+                                    IPA_CONFIG_SELINUX_DEFAULT_USER_CTX,
+                                    default_user);
+        if (ret != EOK) {
+            return ret;
+        }
     }
 
     ret = sysdb_attrs_add_string(state->defaults,
diff --git a/src/providers/ipa/selinux_child.c b/src/providers/ipa/selinux_child.c
index d4670389667607972dd6f072b5ddfda5973e082b..2f79dea109752de09af1105495e1ca8db1e80680 100644
--- a/src/providers/ipa/selinux_child.c
+++ b/src/providers/ipa/selinux_child.c
@@ -146,7 +146,15 @@ static int sc_set_seuser(const char *login_name, const char *seuser_name,
      * the directories are created with the expected permissions
      */
     old_mask = umask(0);
-    ret = set_seuser(login_name, seuser_name, mls);
+    if (strcmp(seuser_name, "") == 0) {
+        /* An empty SELinux user should cause SSSD to use the system
+         * default. We need to remove the SELinux user from the DB
+         * in that case
+         */
+        ret = del_seuser(login_name);
+    } else {
+        ret = set_seuser(login_name, seuser_name, mls);
+    }
     umask(old_mask);
     return ret;
 }
-- 
2.1.0