Re: Seusers vs ldap

[Ivan Gyurdiev <ivg2@cornell.edu>]

>>> How would we go about implementing LDAP support for seusers in 
>>> libsemanage?
>>> I asked Joshua about this on IRC, but I think we to plan this on list.
>>>
>>> I think the most important question to be decided is whether we'll 
>>> use libldap directly, or execute external programs to work with 
>>> LDAP? The first option makes libsemanage always linked to libldap.
>>
>> Why not loadable module?
>>
> it's a possibility. there is no kind of dynamic library loading 
> infrastructure in libsemanage though, and we should really figure out 
> which is the best way to do it before proceeding on any of these routes.
Well, what's your justification for using external programs in 
libsemanage - for verify operations, and for loading the policy (I'm not 
sure if there's any justification for genhomedircon, it should be 
absorbed by libsemanage eventually). I thought there were security 
issues involved - maybe confine the load_policy or verifier program 
differently from the libsemanage client. Are any such issues applicable 
in the ldap case?

With regard to loadable module - what kind of infrastructure is needed - 
do we use dlopen()?
What resources are there to learn about this kind of thing...
Can you think of other uses of loadable modules in libsemanage?
Stephen, do you have an opinion on what should be done?

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.