On (28/04/16 14:15), Michal Židek wrote:
On 04/28/2016 01:38 PM, Lukas Slebodnik wrote:
On (28/04/16 13:06), Michal Židek wrote:
On 04/28/2016 12:23 PM, Sumit Bose wrote:
On Thu, Apr 28, 2016 at 11:26:19AM +0200, Lukas Slebodnik wrote:
On (19/04/16 11:41), Michal Židek wrote:
On 04/13/2016 04:59 PM, Michal Židek wrote:
...
From e41fb64fb2a0f326095e9712c62b1b9f9ce4782e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C5=BDidek?= mzidek@redhat.com Date: Wed, 13 Apr 2016 16:46:24 +0200 Subject: [PATCH] GPO: ignore non-KVP lines if possible
Ticket: https://fedorahosted.org/sssd/ticket/2751
Non-KVP break GPO processing. They are used for values we are not interested in so it is safe to ignore them.
src/providers/ad/ad_gpo.c | 3 ++- src/providers/ad/ad_gpo_child.c | 3 ++- src/util/util.h | 5 +++++ 3 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c index 3bd9ab0..859c5df 100644 --- a/src/providers/ad/ad_gpo.c +++ b/src/providers/ad/ad_gpo.c @@ -1136,7 +1136,8 @@ ad_gpo_store_policy_settings(struct sss_domain_info *domain, goto done; }
- ret = ini_config_parse(file_ctx, INI_STOP_ON_NONE, 0, 0, ini_config);
- ret = ini_config_parse(file_ctx, INI_STOP_ON_NONE, 0,
INI_PARSE_IGNORE_NON_KVP, ini_config); if (ret != 0) { int lret; char **errors;It will fix the bug with #2751. But we will ignore parsing errors in all sections. and I worry about security bugs due to deny rules.
We actually do have a security issue now. If we fail to parse the GPO because of the non key-value pairs (which are not incorrect GPO syntax) then no rules from the GPO are used. These can be any rules. In this case we write a critical error in the logs, but we do not deny access.
That's not true.
We deny access even though it should be allowed. Because we return PAM_SYSTEM_ERROR https://fedorahosted.org/sssd/attachment/ticket/2751/GPO_failed_1.13.1_alpha...
Even if we did the opposite and denied all access, we would also have an issue that would prevent users from logging into their machines.
That's just a bug and not security issue. And it's current state.
Are you sure? https://bugzilla.redhat.com/show_bug.cgi?id=1316164
Yes, I am. (Mon Feb 29 15:48:10 2016) [sssd[be[example.com]]] [ad_gpo_access_done] (0x0040): Ignoring error: [5](Input/output error); GPO-based access control failed, but GPO is not in enforcing mode. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If GPO is not in enforcing mode then we do not reject the access. The same as SELinux in permissive mode.
LS