Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Document how to prevent invalid selinux context for default home directories in SSSD-AD direct integration. #5155

Closed
thalman opened this issue May 13, 2020 · 2 comments
Closed

Document how to prevent invalid selinux context for default home directories in SSSD-AD direct integration. #5155

thalman opened this issue May 13, 2020 · 2 comments
Labels
branch: sssd-1-16 Target also sssd-1-16 branch Bugzilla Closed: Fixed Issue was closed as fixed.

Comments

@thalman
Copy link
Contributor

thalman commented May 13, 2020

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1553784

Description of problem:

not sure if this is an sssd bug or selinux-context one. I want to document the
issue found in a customer case.

By default, sssd-ad sets the home directory path as /home/<AD domain>/<Unix
username>

With existing SELinux contexts, this ends up having the following:

*/home* have the *home_root_t* context (which is OK)
*/home/<AD domain>* have the *user_home_dir_t* context (which seems to be
wrong)
*/home/<AD domain>/<Unix username>* have the *user_home_t* context (which is
also wrong)

The expected behavior should be:

- /home/<AD Domain> should have *user_root_t* context
- /home/<AD Domain>/<User> should have *user_home_dir_t*
- an equivalency context should be created for /home/<AD Domain> based on /home
- /home/<AD Domain> should exist prior to mkhomedir running, or mkhomedir
should also have the *create* call in its allow list (allow oddjob_mkhomedir_t
home_root_t : dir { ... } ;)



Version-Release number of selected component (if applicable): RHEL7.4
thalman added a commit to thalman/sssd that referenced this issue May 13, 2020
@thalman
man: Document invalid selinux context for homedirs
cd7ee1e 
The default value of fallback_homedir expands into path, that is not
expected by selinux. Generally not only selinux might be affected by
this default value. This PR documents the issue and recommends
further steps.

Resolves:
SSSD#5155
@thalman thalman mentioned this issue May 13, 2020
Closed
@thalman thalman added branch: sssd-1-16 Target also sssd-1-16 branch Waiting for review labels May 13, 2020
thalman added a commit to thalman/sssd that referenced this issue May 15, 2020
@thalman
man: Document invalid selinux context for homedirs
043b79c 
The default value of fallback_homedir expands into path, that is not
expected by selinux. Generally not only selinux might be affected by
this default value. This PR documents the issue and recommends
further steps.

Resolves:
SSSD#5155
pbrezina pushed a commit that referenced this issue May 22, 2020
@thalman @pbrezina
man: Document invalid selinux context for homedirs
adebc96 
The default value of fallback_homedir expands into path, that is not
expected by selinux. Generally not only selinux might be affected by
this default value. This PR documents the issue and recommends
further steps.

Resolves:
#5155

Reviewed-by: Alexey Tikhonov <atikhonov@redhat.com>
(cherry picked from commit d8d7438)
@pbrezina
Copy link
Member

Pushed PR: #5156

  • master
    • d8d7438 - man: Document invalid selinux context for homedirs
  • sssd-1-16
    • adebc96 - man: Document invalid selinux context for homedirs

@pbrezina pbrezina added the Closed: Fixed Issue was closed as fixed. label May 22, 2020
@alexey-tikhonov
Copy link
Member

RHEL8 BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1845987

etrunko pushed a commit to etrunko/sssd that referenced this issue Nov 16, 2023
@thalman @etrunko
man: Document invalid selinux context for homedirs
88021cb 
The default value of fallback_homedir expands into path, that is not
expected by selinux. Generally not only selinux might be affected by
this default value. This PR documents the issue and recommends
further steps.

Resolves:
SSSD#5155

Reviewed-by: Alexey Tikhonov <atikhonov@redhat.com>
(cherry picked from commit d8d7438)
etrunko pushed a commit to etrunko/sssd that referenced this issue Nov 16, 2023
@thalman @etrunko
man: Document invalid selinux context for homedirs
056e9f2 
The default value of fallback_homedir expands into path, that is not
expected by selinux. Generally not only selinux might be affected by
this default value. This PR documents the issue and recommends
further steps.

Resolves:
SSSD#5155

Reviewed-by: Alexey Tikhonov <atikhonov@redhat.com>
(cherry picked from commit d8d7438)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
branch: sssd-1-16 Target also sssd-1-16 branch Bugzilla Closed: Fixed Issue was closed as fixed.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@thalman @pbrezina @alexey-tikhonov