URL: https://github.com/freeipa/freeipa/pull/513
Author: tiran
Title: #513: certdb: Don't restore_context() of new NSSDB
Action: opened
PR body:
"""
It's not necesary to restore the context of newly created files. SELinux
ensures that new files have the correct permission. An explicit
restore_context() is only required when either policies have changed or
the context was changed manually.
Signed-off-by: Christian Heimes <chei...@redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/513/head:pr513
git checkout pr513
From 3143bd3cba3c2daadaa290c8e76bc0870b33a619 Mon Sep 17 00:00:00 2001
From: Christian Heimes <chei...@redhat.com>
Date: Mon, 27 Feb 2017 15:12:39 +0100
Subject: [PATCH] certdb: Don't restore_context() of new NSSDB
It's not necesary to restore the context of newly created files. SELinux
ensures that new files have the correct permission. An explicit
restore_context() is only required when either policies have changed or
the context was changed manually.
Signed-off-by: Christian Heimes <chei...@redhat.com>
---
ipapython/certdb.py | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/ipapython/certdb.py b/ipapython/certdb.py
index b22c3c1..5389e63 100644
--- a/ipapython/certdb.py
+++ b/ipapython/certdb.py
@@ -29,7 +29,6 @@
from nss import nss
from nss.error import NSPRError
-from ipaplatform.tasks import tasks
from ipapython.dn import DN
from ipapython.ipa_log_manager import root_logger
from ipapython import ipautil
@@ -158,18 +157,15 @@ def create_db(self, user=None, group=None, mode=None, backup=False):
# Finally fix up perms
os.chown(self.secdir, uid, gid)
os.chmod(self.secdir, dirmode)
- tasks.restore_context(self.secdir)
for filename in NSS_FILES:
path = os.path.join(self.secdir, filename)
if os.path.exists(path):
- if uid != -1 or gid != -1:
- os.chown(path, uid, gid)
+ os.chown(path, uid, gid)
if path == self.pwd_file:
new_mode = pwdfilemode
else:
new_mode = filemode
os.chmod(path, new_mode)
- tasks.restore_context(path)
def list_certs(self):
"""Return nicknames and cert flags for all certs in the database
--
Manage your subscription for the Freeipa-devel mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-devel
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code
