On (28/04/16 14:15), Michal Židek wrote:
> On 04/28/2016 01:38 PM, Lukas Slebodnik wrote:
>> On (28/04/16 13:06), Michal Židek wrote:
>>> On 04/28/2016 12:23 PM, Sumit Bose wrote:
>>>> On Thu, Apr 28, 2016 at 11:26:19AM +0200, Lukas Slebodnik wrote:
>>>>> On (19/04/16 11:41), Michal Židek wrote:
>>>>>> On 04/13/2016 04:59 PM, Michal Židek wrote:
>>>> ...
>>>>>
>>>>> >From e41fb64fb2a0f326095e9712c62b1b9f9ce4782e Mon Sep 17 00:00:00
2001
>>>>>> From: =?UTF-8?q?Michal=20=C5=BDidek?= <mzidek(a)redhat.com>
>>>>>> Date: Wed, 13 Apr 2016 16:46:24 +0200
>>>>>> Subject: [PATCH] GPO: ignore non-KVP lines if possible
>>>>>>
>>>>>> Ticket:
>>>>>>
https://fedorahosted.org/sssd/ticket/2751
>>>>>>
>>>>>> Non-KVP break GPO processing. They are
>>>>>> used for values we are not interested in
>>>>>> so it is safe to ignore them.
>>>>>> ---
>>>>>> src/providers/ad/ad_gpo.c | 3 ++-
>>>>>> src/providers/ad/ad_gpo_child.c | 3 ++-
>>>>>> src/util/util.h | 5 +++++
>>>>>> 3 files changed, 9 insertions(+), 2 deletions(-)
>>>>>>
>>>>>> diff --git a/src/providers/ad/ad_gpo.c
b/src/providers/ad/ad_gpo.c
>>>>>> index 3bd9ab0..859c5df 100644
>>>>>> --- a/src/providers/ad/ad_gpo.c
>>>>>> +++ b/src/providers/ad/ad_gpo.c
>>>>>> @@ -1136,7 +1136,8 @@ ad_gpo_store_policy_settings(struct
sss_domain_info *domain,
>>>>>> goto done;
>>>>>> }
>>>>>>
>>>>>> - ret = ini_config_parse(file_ctx, INI_STOP_ON_NONE, 0, 0,
ini_config);
>>>>>> + ret = ini_config_parse(file_ctx, INI_STOP_ON_NONE, 0,
>>>>>> + INI_PARSE_IGNORE_NON_KVP,
ini_config);
>>>>>> if (ret != 0) {
>>>>>> int lret;
>>>>>> char **errors;
>>>>>
>>>>> It will fix the bug with #2751.
>>>>> But we will ignore parsing errors in all sections.
>>>>> and I worry about security bugs due to deny rules.
>>>
>>> We actually do have a security issue now. If we fail to parse the GPO
>>> because of the non key-value pairs (which are not incorrect GPO
>>> syntax) then no rules from the GPO are used. These can be any
>>> rules. In this case we write a critical error in the
>>> logs, but we do not deny access.
>> That's not true.
>>
>> We deny access even though it should be allowed.
>> Because we return PAM_SYSTEM_ERROR
>>
https://fedorahosted.org/sssd/attachment/ticket/2751/GPO_failed_1.13.1_al...
>>
>>
>>> Even if we did the opposite and
>>> denied all access, we would also have an issue that would prevent
>>> users from logging into their machines.
>> That's just a bug and not security issue.
>> And it's current state.
>
> Are you sure?
>
https://bugzilla.redhat.com/show_bug.cgi?id=1316164
>
Yes, I am.
(Mon Feb 29 15:48:10 2016) [sssd[be[example.com]]]
[ad_gpo_access_done] (0x0040): Ignoring error: [5](Input/output error);
GPO-based access control failed, but GPO is not in enforcing mode.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If GPO is not in enforcing mode then we do not reject the access.
The same as SELinux in permissive mode.
LS