>From c1e5375003ffd910f4e1727fad015605450b49d1 Mon Sep 17 00:00:00 2001
From: Michal Zidek <mzidek@redhat.com>
Date: Wed, 24 Sep 2014 16:03:04 +0200
Subject: [PATCH 2/3] sss_semanage: Add mlsrange parameter to set_seuser

mlsrange parameter will be needed in IPA provider
and probably at some point in the tools as well.
---
 src/tools/sss_useradd.c |  2 +-
 src/tools/sss_usermod.c |  2 +-
 src/util/sss_semanage.c | 21 ++++++++++++++-------
 src/util/util.h         |  3 ++-
 4 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/src/tools/sss_useradd.c b/src/tools/sss_useradd.c
index 5943940..8521b83 100644
--- a/src/tools/sss_useradd.c
+++ b/src/tools/sss_useradd.c
@@ -205,7 +205,7 @@ int main(int argc, const char **argv)
 
     /* Set SELinux login context - must be done after transaction is done
      * b/c libselinux calls getpwnam */
-    ret = set_seuser(tctx->octx->name, pc_selinux_user);
+    ret = set_seuser(tctx->octx->name, pc_selinux_user, NULL);
     if (ret != EOK) {
         ERROR("Cannot set SELinux login context\n");
         ret = EXIT_FAILURE;
diff --git a/src/tools/sss_usermod.c b/src/tools/sss_usermod.c
index 9683c6e..55e9439 100644
--- a/src/tools/sss_usermod.c
+++ b/src/tools/sss_usermod.c
@@ -300,7 +300,7 @@ int main(int argc, const char **argv)
 
     /* Set SELinux login context - must be done after transaction is done
      * b/c libselinux calls getpwnam */
-    ret = set_seuser(tctx->octx->name, pc_selinux_user);
+    ret = set_seuser(tctx->octx->name, pc_selinux_user, NULL);
     if (ret != EOK) {
         ERROR("Cannot set SELinux login context\n");
         ret = EXIT_FAILURE;
diff --git a/src/util/sss_semanage.c b/src/util/sss_semanage.c
index dbef3b3..b7bc3bd 100644
--- a/src/util/sss_semanage.c
+++ b/src/util/sss_semanage.c
@@ -118,7 +118,8 @@ fail:
 static int sss_semanage_user_add(semanage_handle_t *handle,
                                  semanage_seuser_key_t *key,
                                  const char *login_name,
-                                 const char *seuser_name)
+                                 const char *seuser_name,
+                                 const char *mls)
 {
     int ret;
     semanage_seuser_t *seuser = NULL;
@@ -138,7 +139,8 @@ static int sss_semanage_user_add(semanage_handle_t *handle,
         goto done;
     }
 
-    ret = semanage_seuser_set_mlsrange(handle, seuser, DEFAULT_SERANGE);
+    ret = semanage_seuser_set_mlsrange(handle, seuser,
+                                       mls ? mls : DEFAULT_SERANGE);
     if (ret != 0) {
         DEBUG(SSSDBG_CRIT_FAILURE,
               "Could not set serange for %s\n", login_name);
@@ -171,7 +173,8 @@ done:
 static int sss_semanage_user_mod(semanage_handle_t *handle,
                                  semanage_seuser_key_t *key,
                                  const char *login_name,
-                                 const char *seuser_name)
+                                 const char *seuser_name,
+                                 const char *mls)
 {
     int ret;
     semanage_seuser_t *seuser = NULL;
@@ -184,7 +187,8 @@ static int sss_semanage_user_mod(semanage_handle_t *handle,
         goto done;
     }
 
-    ret = semanage_seuser_set_mlsrange(handle, seuser, DEFAULT_SERANGE);
+    ret = semanage_seuser_set_mlsrange(handle, seuser,
+                                       mls ? mls : DEFAULT_SERANGE);
     if (ret != 0) {
         DEBUG(SSSDBG_CRIT_FAILURE,
               "Could not set serange for %s\n", login_name);
@@ -213,7 +217,8 @@ done:
     return ret;
 }
 
-int set_seuser(const char *login_name, const char *seuser_name)
+int set_seuser(const char *login_name, const char *seuser_name,
+               const char *mls)
 {
     semanage_handle_t *handle = NULL;
     semanage_seuser_key_t *key = NULL;
@@ -247,14 +252,16 @@ int set_seuser(const char *login_name, const char *seuser_name)
     }
 
     if (seuser_exists) {
-        ret = sss_semanage_user_mod(handle, key, login_name, seuser_name);
+        ret = sss_semanage_user_mod(handle, key, login_name, seuser_name,
+                                    mls);
         if (ret != 0) {
             DEBUG(SSSDBG_CRIT_FAILURE, "Cannot modify SELinux user mapping\n");
             ret = EIO;
             goto done;
         }
     } else {
-        ret = sss_semanage_user_add(handle, key, login_name, seuser_name);
+        ret = sss_semanage_user_add(handle, key, login_name, seuser_name,
+                                    mls);
         if (ret != 0) {
             DEBUG(SSSDBG_CRIT_FAILURE, "Cannot add SELinux user mapping\n");
             ret = EIO;
diff --git a/src/util/util.h b/src/util/util.h
index 9d6aa5e..b3a0681 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -574,7 +574,8 @@ char * sss_reverse_replace_space(TALLOC_CTX *mem_ctx,
                                  const char replace_char);
 
 /* from sss_semanage.c */
-int set_seuser(const char *login_name, const char *seuser_name);
+int set_seuser(const char *login_name, const char *seuser_name,
+               const char *mlsrange);
 int del_seuser(const char *login_name);
 
 #endif /* __SSSD_UTIL_H__ */
-- 
1.9.3

