[SSSD] [PATCH] Convert sdap_access code to new error code facility

Pavel Březina pbrezina at redhat.com
Mon Mar 4 13:14:55 UTC 2013


On 03/04/2013 12:19 AM, Simo Sorce wrote:
> Not fully tested, but I am reasonably confident it should work just
> fine.
>
> The changes to the HBAC code are the ones I am a bit concerned with.
>
>>From my reading of the code, the 'fail' case migh return PAM_SUCCESS
> even though HABC failed to operate before the patches, because
> pam_success was set when sdap_access_recv() was called.
>
> I changed that code to unconditionally return PAM_SYSTEM_ERR because
> I can't see any legitimate case where an error would still warrant
> returning success. This is really a corner case that is almost
> impossible to hit though. I think the only case where it would return
> the wrong result is in case the hbac search base was missing and we
> still got this far somehow.
>
> So please check carefully.
> Simo.
>
> -- Simo Sorce * Red Hat, Inc * New York
>   #endif /* SDAP_ACCESS_H_ */
> diff --git a/src/util/util_errors.c b/src/util/util_errors.c
> index 88806f531ed90699438deed060d192b7ac029920..a292fa6b19f38943228bd221c09cfe0a21604448 100644
> --- a/src/util/util_errors.c
> +++ b/src/util/util_errors.c
> @@ -39,6 +39,7 @@ struct err_string error_to_str[] = {
>       { "Password Change Failed" }, /* ERR_CHPASS_FAILED */
>       { "Network I/O Error" }, /* ERR_NETWORK_IO */
>       { "Account Expired" }, /* ERR_ACCOUNT_EXPIRED */
> +    { "Host Access Denied" }, /* ERR_ACEESS_DENIED */
                                      typo ^

>       { "Password Expired" }, /* ERR_PASSWORD_EXPIRED */
>   };

Everything seems to be working correctly. Ack from me.



More information about the sssd-devel mailing list