IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-01-26 16:16:31 -06:00
Code Issues Packages Projects Releases Wiki Activity

Set SELinux default context to unconfined_u:s0-s0:c0.c1023

Browse Source 
Don't require ipaselinuxdefaultuser to be set. If this is unset then
SSSD will use the system default.

https://fedorahosted.org/freeipa/ticket/3045
This commit is contained in:
Rob Crittenden 2012-09-10 17:07:54 -04:00 committed by Martin Kosek
parent 46f09fb8cc
commit 79b90d1465
3 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
install/share/bootstrap-template.ldif
View File

@ -383,7 +383,7 @@ ipaDefaultEmailDomain: $DOMAIN
ipaMigrationEnabled: FALSE
ipaConfigString: AllowNThash
ipaSELinuxUserMapOrder: guest_u:s0$$xguest_u:s0$$user_u:s0-s0:c0.c1023$$staff_u:s0-s0:c0.c1023$$unconfined_u:s0-s0:c0.c1023
ipaSELinuxUserMapDefault: guest_u:s0
ipaSELinuxUserMapDefault: unconfined_u:s0-s0:c0.c1023
dn: cn=cosTemplates,cn=accounts,$SUFFIX
changetype: add

2
install/updates/50-ipaconfig.update
View File

@ -1,5 +1,5 @@
dn: cn=ipaConfig,cn=etc,$SUFFIX
add:ipaSELinuxUserMapOrder: guest_u:s0$$xguest_u:s0$$user_u:s0-s0:c0.c1023$$staff_u:s0-s0:c0.c1023$$unconfined_u:s0-s0:c0.c1023
add:ipaSELinuxUserMapDefault: guest_u:s0
add:ipaSELinuxUserMapDefault: unconfined_u:s0-s0:c0.c1023
add:ipaUserObjectClasses: ipasshuser

9
ipalib/plugins/config.py
View File

@ -185,7 +185,7 @@ class config(LDAPObject):
label=_('SELinux user map order'),
doc=_('Order in increasing priority of SELinux users, delimited by $'),
),
Str('ipaselinuxusermapdefault',
Str('ipaselinuxusermapdefault?',
label=_('Default SELinux user'),
doc=_('Default SELinux user when no match is found in SELinux map rule'),
),
@ -274,7 +274,10 @@ class config_mod(LDAPUpdate):
failedattr = 'ipaselinuxusermapdefault'
else:
config = ldap.get_ipa_config()[1]
defaultuser = config['ipaselinuxusermapdefault'][0]
if 'ipaselinuxusermapdefault' in config:
defaultuser = config['ipaselinuxusermapdefault'][0]
else:
defaultuser = None
if 'ipaselinuxusermaporder' in validate:
order = validate['ipaselinuxusermaporder']
@ -284,7 +287,7 @@ class config_mod(LDAPUpdate):
config = ldap.get_ipa_config()[1]
order = config['ipaselinuxusermaporder']
userlist = order[0].split('$')
if defaultuser not in userlist:
if defaultuser and defaultuser not in userlist:
raise errors.ValidationError(name=failedattr,
error=_('SELinux user map default user not in order list'))