freeipa/install/updates/50-ipaconfig.update

dn: cn=ipaConfig,cn=etc,$SUFFIX
replace: ipaSELinuxUserMapOrder: guest_u:s0$$xguest_u:s0$$user_u:s0-s0:c0.c1023$$staff_u:s0-s0:c0.c1023$$unconfined_u:s0-s0:c0.c1023::ipaSELinuxUserMapOrder: guest_u:s0$$xguest_u:s0$$user_u:s0$$staff_u:s0-s0:c0.c1023$$unconfined_u:s0-s0:c0.c1023
add:ipaSELinuxUserMapDefault: unconfined_u:s0-s0:c0.c1023
add:ipaUserObjectClasses: ipasshuser
remove:ipaConfigString:AllowLMhash
add:objectClass: ipaUserAuthTypeClass
add:objectClass: ipaNameResolutionData
Add SELinux user mapping framework. This will allow one to define what SELinux context a given user gets on a given machine. A rule can contain a set of users and hosts or it can point to an existing HBAC rule that defines them. https://fedorahosted.org/freeipa/ticket/755 2011-11-23 15:59:21 -06:00			`dn: cn=ipaConfig,cn=etc,$SUFFIX`
Use replace instead of add to set new default ipaSELinuxUserMapOrder The add was in effect replacing whatever data was already there causing any custom order to be lost on each run of ipa-server-upgrade. https://pagure.io/freeipa/issue/6610 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> 2018-06-01 14:19:35 -05:00			`replace: ipaSELinuxUserMapOrder: guest_u:s0$$xguest_u:s0$$user_u:s0-s0:c0.c1023$$staff_u:s0-s0:c0.c1023$$unconfined_u:s0-s0:c0.c1023::ipaSELinuxUserMapOrder: guest_u:s0$$xguest_u:s0$$user_u:s0$$staff_u:s0-s0:c0.c1023$$unconfined_u:s0-s0:c0.c1023`
Set SELinux default context to unconfined_u:s0-s0:c0.c1023 Don't require ipaselinuxdefaultuser to be set. If this is unset then SSSD will use the system default. https://fedorahosted.org/freeipa/ticket/3045 2012-09-10 16:07:54 -05:00			`add:ipaSELinuxUserMapDefault: unconfined_u:s0-s0:c0.c1023`
Add LDAP schema for SSH public keys. https://fedorahosted.org/freeipa/ticket/754 2011-12-07 01:46:23 -06:00			`add:ipaUserObjectClasses: ipasshuser`
Remove deprecated AllowLMhash config Remove this ipaConfigString value as LM hash is deprecated and in fact even insecure. https://fedorahosted.org/freeipa/ticket/3795 2013-11-01 03:25:33 -05:00			`remove:ipaConfigString:AllowLMhash`
Add support for managing user auth types https://fedorahosted.org/freeipa/ticket/3368 2013-09-18 14:48:23 -05:00			`add:objectClass: ipaUserAuthTypeClass`
Short name resolution: introduce the required schema Add ipaDomainResolutionOrder and ipaNameResolutionData to IPAv3 schema. Extend ipaConfig object with ipaNameResolutionData objectclass during update. https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> 2017-03-09 07:24:21 -06:00			`add:objectClass: ipaNameResolutionData`