Bug 1553784

Because SSSD only reports what the home directory is and what the UID and GID numbers of the user are, I think the file system contexts are more in the realm of SELinux policy or whoever is creating the home directories, I think it's fine to move the bugzilla to the selinux policy package.

Hi Jakub,

I understand that SSSD reports the home dir and uid/gid, but the home dir it reports is not the standard path (e.g. "/home/user"), but by default it is "/home/AD-domain/user", so I would expect some SELinux equivalency context between /home and /home/AD-domain to be set up by SSSD itself.

Will let Lukas decide of course.

REnaud.

(In reply to Renaud Métrich from comment #3)
> Hi Jakub,
> 
> I understand that SSSD reports the home dir and uid/gid, but the home dir it
> reports is not the standard path (e.g. "/home/user"), but by default it is
> "/home/AD-domain/user",

The homedir is either read from the POSIX attributes or in their absence, SSSD uses local fallback mechanisms like override_homedir etc. If you want the homedir to be /home/$username, just set:
override_homedir = /home/%u

> so I would expect some SELinux equivalency context
> between /home and /home/AD-domain to be set up by SSSD itself.

SSSD doesn't do anything like that. It just provides the NSS API, see e.g. man getpwnam(3).

OK, let me rephrase.
In https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/windows_integration_guide/SSSD-AD#sssd-ad-proc, we can see the following text:

Optional: Configure User Home Directories and Shells

The pam_oddjob_mkhomedir.so library automatically creates home directories when users first log in to the Linux system. By default, SSSD retrieves the format of the home directory from the AD identity provider. To customize the directory format on Linux clients:

1. Open the /etc/sssd/sssd.conf file.

2. In the [domain] section, use one of these options:

* fallback_homedir sets a fallback home directory format, which is used only if a home directory is not defined in AD

* override_homedir sets a home directory template, which always overrides the home directory defined in AD

For example, to always use the format /home/domain_name/user_name:

[domain/EXAMPLE]
[... file truncated ...]
override_homedir = /home/%d/%u

For details, see the sssd.conf(5) man page.


It appears that this text (and the sssd.conf manpage) doesn't mention that when doing so, the SELinux contexts will be broken, as described in the Description of this BZ.
IMHO, this BZ is hence a Doc BZ, for both guide and manpage.

I understand Renaud, and it make sense to me, but I if I don't know the name of AD-domain I'm not able to setup any SELinux file context equivalency. 
Maybe it should be mentioned in the sssd-ad manpage.

Yes this is an sssd-ad issue.

Jakub, 
I can help with documentation, moving back to sssd

Unfortunately the 7.7 development phase passed and we didn't have time to address this bug. Moving to 7.8

Moving it to 7.9

Note that this is not a bug in SSSD or oddjob. It is a limitation of a conceptual level that needs somehow to be solved separately.

oddjob, when responding to pam_mkhomedir_oddjob requests, correctly creates all required components of the home directory path. It also uses SELinux matchpathcon() function to find out what context should be set for the corresponding path component.

The problem here is that we have two different concepts for home directory paths:

 - traditional UNIX home directory, can be called single-level home directory, /home/<user>
 - multi-leveled home directories, /home/<domain>/<user>

There is no way for SELinux policy to differentiate between the two.

Upstream ticket:
https://github.com/SSSD/sssd/issues/5155

* `master`
    * d8d743870c459b5ff283c89d78b70d1684bd19a9 - man: Document invalid selinux context for homedirs
* `sssd-1-16`
    * adebc962af61b86f78ff3dfb6e33db27149c399d - man: Document invalid selinux context for homedirs

Verified against sssd-1.16.5-10.el7.x86_64, text is in sssd-ad man file

"Note that the system typically expects a home directory in /home/%u folder. If you decide to use a different directory structure, some other parts of your system may need adjustments.

For example automated creation of home directories in combination with selinux requires selinux adjustment, otherwise the home directory will be created with wrong selinux context."

Since this is a man page edit this will not have any automation.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sssd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3904