https://bugzilla.redhat.com/show_bug.cgi?id=649037

Description

Description of problem: Unable to set SELinux user for the user´s login.

Version-Release number of selected component (if applicable):
sssd-1.2.1-34.el5

How reproducible:
Always

Steps to Reproduce:
1. Configure SSSD for local domain.
2. sss_useradd -Z user_u luser1
3.

Actual results:

sss_useradd -Z user_u luser1

Cannot set SELinux login context

Expected results:
User should be added successfully. This works fine in RHEL6.

Additional info:

Relevant sssd.conf section:
[domain/LOCAL]
id_provider = local
auth_provider = local
min_id = 2000
enumerate = true

sestatus

SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 21
Policy from config file: targeted

cat /etc/selinux/targeted/seusers

This file is auto-generated by libsemanage

Please use the semanage command to make changes

root:root:s0-s0:c0.c1023
default:user_u:s0
yyy:user_u:s0

rpm -qf /usr/lib/libselinux.so

libselinux-1.33.4-5.6.el5

Analysis

The problem is in the SSSD.

    ret = semanage_commit(handle);
    if (ret != 0) {
        DEBUG(1, ("Cannot commit SELinux transaction\n"));
        ret = EIO;
        goto done;
    }

From semanage/handle.h:

/* Attempt to commit all changes since this transaction began. If the
 * commit is successful then increment the "policy sequence number"
 * and then release the transaction lock.  Return that policy number
 * afterwards, or -1 on error.
 */
int semanage_commit(semanage_handle_t *);

Whereas most semanage functions return zero on success, this particular command
is expected to return a positive integer on success.