[SSSD] [PATCH] Convert sdap_access code to new error code facility

Jakub Hrozek jhrozek at redhat.com
Tue Mar 19 21:50:48 UTC 2013


On Mon, Mar 04, 2013 at 02:14:55PM +0100, Pavel Březina wrote:
> On 03/04/2013 12:19 AM, Simo Sorce wrote:
> >Not fully tested, but I am reasonably confident it should work just
> >fine.
> >
> >The changes to the HBAC code are the ones I am a bit concerned with.
> >
> >>From my reading of the code, the 'fail' case migh return PAM_SUCCESS
> >even though HABC failed to operate before the patches, because
> >pam_success was set when sdap_access_recv() was called.
> >
> >I changed that code to unconditionally return PAM_SYSTEM_ERR because
> >I can't see any legitimate case where an error would still warrant
> >returning success. This is really a corner case that is almost
> >impossible to hit though. I think the only case where it would return
> >the wrong result is in case the hbac search base was missing and we
> >still got this far somehow.
> >
> >So please check carefully.
> >Simo.
> >
> >-- Simo Sorce * Red Hat, Inc * New York
> >  #endif /* SDAP_ACCESS_H_ */
> >diff --git a/src/util/util_errors.c b/src/util/util_errors.c
> >index 88806f531ed90699438deed060d192b7ac029920..a292fa6b19f38943228bd221c09cfe0a21604448 100644
> >--- a/src/util/util_errors.c
> >+++ b/src/util/util_errors.c
> >@@ -39,6 +39,7 @@ struct err_string error_to_str[] = {
> >      { "Password Change Failed" }, /* ERR_CHPASS_FAILED */
> >      { "Network I/O Error" }, /* ERR_NETWORK_IO */
> >      { "Account Expired" }, /* ERR_ACCOUNT_EXPIRED */
> >+    { "Host Access Denied" }, /* ERR_ACEESS_DENIED */
>                                      typo ^
> 
> >      { "Password Expired" }, /* ERR_PASSWORD_EXPIRED */
> >  };
> 
> Everything seems to be working correctly. Ack from me.

Pushed to master,



More information about the sssd-devel mailing list