[SSSD] [PATCH] Convert sdap_access code to new error code facility

Simo Sorce simo at redhat.com
Sun Mar 3 23:19:38 UTC 2013


Not fully tested, but I am reasonably confident it should work just
fine.

The changes to the HBAC code are the ones I am a bit concerned with.

>From my reading of the code, the 'fail' case migh return PAM_SUCCESS
even though HABC failed to operate before the patches, because
pam_success was set when sdap_access_recv() was called.

I changed that code to unconditionally return PAM_SYSTEM_ERR because
I can't see any legitimate case where an error would still warrant
returning success. This is really a corner case that is almost
impossible to hit though. I think the only case where it would return
the wrong result is in case the hbac search base was missing and we
still got this far somehow.

So please check carefully.
Simo.

-- 
Simo Sorce * Red Hat, Inc * New York
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Convert-sdap_access-to-new-error-codes.patch
Type: text/x-patch
Size: 46703 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130303/1dc7ac78/attachment.bin>


More information about the sssd-devel mailing list