[gssproxy] 01/02: Mark selinux config attributes as deprecated

[git repository hosting]

This is an automated email from the git hooks/post-receive script.

rharwood pushed a commit to branch master
in repository gssproxy.

commit 00893a5a596daaad87fe6a5b1cdf133384f696ea
Author: Robbie Harwood <rharwood(a)redhat.com&gt;
Date:   Fri May 12 16:51:06 2017 -0400

    Mark selinux config attributes as deprecated
    
    Resolves: #179
    Signed-off-by: Robbie Harwood <rharwood(a)redhat.com&gt;
    Reviewed-by: Simo Sorce <simo(a)redhat.com&gt;
    Merges: #183
---
 proxy/man/gssproxy.conf.5.xml | 23 +++++++++--------------
 proxy/src/gp_config.c         |  2 ++
 2 files changed, 11 insertions(+), 14 deletions(-)

diff --git a/proxy/man/gssproxy.conf.5.xml b/proxy/man/gssproxy.conf.5.xml
index ad9d96f..ed003c1 100644
--- a/proxy/man/gssproxy.conf.5.xml
+++ b/proxy/man/gssproxy.conf.5.xml
@@ -91,12 +91,13 @@
                     <term>allow_any_uid (boolean)</term>
                     <listitem>
                         <para>Allow any process of any user to use this
service.</para>
-                        <para>Note that absent a custom socket or selinux_context
option
-                              this option may cause a service definition to mask access
to
-                              following services. To avoid issues change the order of
services
-                              in your configuation file so that services with
allow_any_uid
-                              enabled are listed last, or define a custom socket for
other
-                              services.</para>
+                        <para>Note that absent a custom socket option this
+                              option may cause a service definition to mask
+                              access to following services. To avoid issues
+                              change the order of services in your
+                              configuation file so that services with
+                              allow_any_uid enabled are listed last, or define
+                              a custom socket for other services.</para>
                         <para>Default: false</para>
                     </listitem>
                 </varlistentry>
@@ -331,14 +332,8 @@
                 <varlistentry>
                     <term>selinux_context (string)</term>
                     <listitem>
-                        <para>This parameter instructs the proxy to allow map a
-                              request to the service only if the context of the
-                              connecting client matches the one defined here.
-                        </para>
-                        <para>When this parameter is not set any client will be
-                              allowed regardless of their selinux context.
-                        </para>
-                        <para>Example: selinux_context = system_u:system_r:gssd_t
+                        <para>This option is deprecated.  Use a custom socket
+                              or euid instead.
                         </para>
                     </listitem>
                     </varlistentry>
diff --git a/proxy/src/gp_config.c b/proxy/src/gp_config.c
index a671333..1d2bf7d 100644
--- a/proxy/src/gp_config.c
+++ b/proxy/src/gp_config.c
@@ -477,6 +477,8 @@ static int load_services(struct gp_config *cfg, struct gp_ini_context
*ctx)
             ret = gp_config_get_string(ctx, secname,
                                        "selinux_context", &value);
             if (ret == 0) {
+                GPDEBUG(
+                    "selinux_ctx is deprecated; use euid/socket instead.\n");
                 cfg->svcs[n]->selinux_ctx = SELINUX_context_new(value);
                 if (!cfg->svcs[n]->selinux_ctx) {
                     ret = EINVAL;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.