On Fri, Oct 14, 2016 at 12:41:23AM +0200, Jacquelin Charbonnel wrote:
> Thank you for this information. Yes, /tmp is writable.
> My problem is : access are sometimes definitively refused for random
> who wants to log in diskless workstations.
> But if this banned user tries to connect to the single machine which
> the fs in rw mode, it's work, and this solve immediately its problem on all
> the other stateless machines !? Strange...
Maybe it is the selinux_provider, iirc at least in older version it used
to write some data somewhere below /etc/selinux/. You can easily test
this by setting 'selinux_provider = none' in the domain section in
> Le 13/10/2016 à 20:33, Jakub Hrozek a écrit :
> > On Thu, Oct 13, 2016 at 05:45:32PM +0200, Jacquelin Charbonnel wrote:
> > > Hi everybody,
> > >
> > > What is the best practice to enroll diskless Fedora24 workstations
> > > (under
> > > stateless Linux) into a IPA domain ?
> > > Each diskless workstation mounts its filesystem in RO mode from a single
> > > NFS share, with some specific directories (like /var/lib/sss) mapped RW in
> > > RAM.
> > I can't speak for other components, but /var/lib/sss/ is the only
> > directory sssd writes to (except tmpfiles, but I guess /tmp would also
> > be a writable fs?)
> Jacquelin Charbonnel - (+33)2 4173 5397
> CNRS Mathrice/LAREMA - Campus universitaire d'Angers
> Manage your subscription for the Freeipa-users mailing list:
> Go to http://freeipa.org for more info on the project
Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project