From 663fdd3897c5da1a54fcb51613bd71660ef9b19a Mon Sep 17 00:00:00 2001

From: Jakub Hrozek <jhrozek@redhat.com>

Date: Wed, 20 Jun 2018 22:02:57 +0200

Subject: [PATCH] SELINUX: Also call is_selinux_enabled as a check for selinux

 child

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Resolves:

https://pagure.io/SSSD/sssd/issue/3796

The SSSD selinux management routines were only checking if SELinux is

managed on the system. If it is managed, the code tries to proceed and

set the login context, otherwise an error is returned which SSSD handles

gracefully.

But this is not enough, in some cases SELinux might be disabled, but

managed and in these cases SSSD was returning strange errors, which

might have prevented login with selinux provider in effect.

We got this hint form the RH SELinux maintainer:

"""

libsemanage is for managing SELinux infrastructure. generally if there's

/etc/selinux/config where libsemanage can read SELINUXTYPE and SELinux

module store - /etc/selinux/<SELINUXTYPE>/active (or

/var/lib/selinux/<SELINUXTYPE>/active) - is available, libsemanage can

manage it even when SELinux is disabled.

I'm not sure if selinux_child doesn any is_selinux_enabled() checks but

it could help to avoid such situations.

"""

Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

(cherry picked from commit 1e81d040c75b2b15cab48fb7df1041138747e6c3)

DOWNSTREAM:

Resolves: rhbz#1583360 - The IPA selinux provider can return an error if SELinux is completely disabled

---

 src/util/sss_semanage.c | 4 ++++

 1 file changed, 4 insertions(+)

diff --git a/src/util/sss_semanage.c b/src/util/sss_semanage.c

index 7b0eef22330db8df6ab8f46da5fb76c68f6adabc..bcce57b603bd1c4d5c6465dbb5cc7a3fbe72412d 100644

--- a/src/util/sss_semanage.c

+++ b/src/util/sss_semanage.c

@@ -82,6 +82,10 @@ static int sss_is_selinux_managed(semanage_handle_t *handle)

         return EINVAL;

     }

+    if (!is_selinux_enabled()) {

+        return ERR_SELINUX_NOT_MANAGED;

+    }

+

     ret = semanage_is_managed(handle);

     if (ret == 0) {

         DEBUG(SSSDBG_TRACE_FUNC, "SELinux policy not managed via libsemanage\n");

-- 

2.17.1