|
 |
cdf651 |
From 663fdd3897c5da1a54fcb51613bd71660ef9b19a Mon Sep 17 00:00:00 2001
|
|
|
cdf651 |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
cdf651 |
Date: Wed, 20 Jun 2018 22:02:57 +0200
|
|
|
cdf651 |
Subject: [PATCH] SELINUX: Also call is_selinux_enabled as a check for selinux
|
|
|
cdf651 |
child
|
|
|
cdf651 |
MIME-Version: 1.0
|
|
|
cdf651 |
Content-Type: text/plain; charset=UTF-8
|
|
|
cdf651 |
Content-Transfer-Encoding: 8bit
|
|
|
cdf651 |
|
|
|
cdf651 |
Resolves:
|
|
|
cdf651 |
https://pagure.io/SSSD/sssd/issue/3796
|
|
|
cdf651 |
|
|
|
cdf651 |
The SSSD selinux management routines were only checking if SELinux is
|
|
|
cdf651 |
managed on the system. If it is managed, the code tries to proceed and
|
|
|
cdf651 |
set the login context, otherwise an error is returned which SSSD handles
|
|
|
cdf651 |
gracefully.
|
|
|
cdf651 |
|
|
|
cdf651 |
But this is not enough, in some cases SELinux might be disabled, but
|
|
|
cdf651 |
managed and in these cases SSSD was returning strange errors, which
|
|
|
cdf651 |
might have prevented login with selinux provider in effect.
|
|
|
cdf651 |
|
|
|
cdf651 |
We got this hint form the RH SELinux maintainer:
|
|
|
cdf651 |
"""
|
|
|
cdf651 |
libsemanage is for managing SELinux infrastructure. generally if there's
|
|
|
cdf651 |
/etc/selinux/config where libsemanage can read SELINUXTYPE and SELinux
|
|
|
cdf651 |
module store - /etc/selinux/<SELINUXTYPE>/active (or
|
|
|
cdf651 |
/var/lib/selinux/<SELINUXTYPE>/active) - is available, libsemanage can
|
|
|
cdf651 |
manage it even when SELinux is disabled.
|
|
|
cdf651 |
|
|
|
cdf651 |
I'm not sure if selinux_child doesn any is_selinux_enabled() checks but
|
|
|
cdf651 |
it could help to avoid such situations.
|
|
|
cdf651 |
"""
|
|
|
cdf651 |
|
|
|
cdf651 |
Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
|
|
|
cdf651 |
(cherry picked from commit 1e81d040c75b2b15cab48fb7df1041138747e6c3)
|
|
|
cdf651 |
|
|
|
cdf651 |
DOWNSTREAM:
|
|
|
cdf651 |
Resolves: rhbz#1583360 - The IPA selinux provider can return an error if SELinux is completely disabled
|
|
|
cdf651 |
---
|
|
|
cdf651 |
src/util/sss_semanage.c | 4 ++++
|
|
|
cdf651 |
1 file changed, 4 insertions(+)
|
|
|
cdf651 |
|
|
|
cdf651 |
diff --git a/src/util/sss_semanage.c b/src/util/sss_semanage.c
|
|
|
cdf651 |
index 7b0eef22330db8df6ab8f46da5fb76c68f6adabc..bcce57b603bd1c4d5c6465dbb5cc7a3fbe72412d 100644
|
|
|
cdf651 |
--- a/src/util/sss_semanage.c
|
|
|
cdf651 |
+++ b/src/util/sss_semanage.c
|
|
|
cdf651 |
@@ -82,6 +82,10 @@ static int sss_is_selinux_managed(semanage_handle_t *handle)
|
|
|
cdf651 |
return EINVAL;
|
|
|
cdf651 |
}
|
|
|
cdf651 |
|
|
|
cdf651 |
+ if (!is_selinux_enabled()) {
|
|
|
cdf651 |
+ return ERR_SELINUX_NOT_MANAGED;
|
|
|
cdf651 |
+ }
|
|
|
cdf651 |
+
|
|
|
cdf651 |
ret = semanage_is_managed(handle);
|
|
|
cdf651 |
if (ret == 0) {
|
|
|
cdf651 |
DEBUG(SSSDBG_TRACE_FUNC, "SELinux policy not managed via libsemanage\n");
|
|
|
cdf651 |
--
|
|
|
cdf651 |
2.17.1
|
|
|
cdf651 |
|