On 04/28/2016 01:38 PM, Lukas Slebodnik wrote:
> On (28/04/16 13:06), Michal Židek wrote:
> > On 04/28/2016 12:23 PM, Sumit Bose wrote:
> > > On Thu, Apr 28, 2016 at 11:26:19AM +0200, Lukas Slebodnik wrote:
> > > > On (19/04/16 11:41), Michal Židek wrote:
> > > > > On 04/13/2016 04:59 PM, Michal Židek wrote:
> > > ...
> > > >
> > > > >From e41fb64fb2a0f326095e9712c62b1b9f9ce4782e Mon Sep 17 00:00:00
2001
> > > > > From: =?UTF-8?q?Michal=20=C5=BDidek?= <mzidek(a)redhat.com>
> > > > > Date: Wed, 13 Apr 2016 16:46:24 +0200
> > > > > Subject: [PATCH] GPO: ignore non-KVP lines if possible
> > > > >
> > > > > Ticket:
> > > > >
https://fedorahosted.org/sssd/ticket/2751
> > > > >
> > > > > Non-KVP break GPO processing. They are
> > > > > used for values we are not interested in
> > > > > so it is safe to ignore them.
> > > > > ---
> > > > > src/providers/ad/ad_gpo.c | 3 ++-
> > > > > src/providers/ad/ad_gpo_child.c | 3 ++-
> > > > > src/util/util.h | 5 +++++
> > > > > 3 files changed, 9 insertions(+), 2 deletions(-)
> > > > >
> > > > > diff --git a/src/providers/ad/ad_gpo.c
b/src/providers/ad/ad_gpo.c
> > > > > index 3bd9ab0..859c5df 100644
> > > > > --- a/src/providers/ad/ad_gpo.c
> > > > > +++ b/src/providers/ad/ad_gpo.c
> > > > > @@ -1136,7 +1136,8 @@ ad_gpo_store_policy_settings(struct
sss_domain_info *domain,
> > > > > goto done;
> > > > > }
> > > > >
> > > > > - ret = ini_config_parse(file_ctx, INI_STOP_ON_NONE, 0, 0,
ini_config);
> > > > > + ret = ini_config_parse(file_ctx, INI_STOP_ON_NONE, 0,
> > > > > + INI_PARSE_IGNORE_NON_KVP,
ini_config);
> > > > > if (ret != 0) {
> > > > > int lret;
> > > > > char **errors;
> > > >
> > > > It will fix the bug with #2751.
> > > > But we will ignore parsing errors in all sections.
> > > > and I worry about security bugs due to deny rules.
> >
> > We actually do have a security issue now. If we fail to parse the GPO
> > because of the non key-value pairs (which are not incorrect GPO
> > syntax) then no rules from the GPO are used. These can be any
> > rules. In this case we write a critical error in the
> > logs, but we do not deny access.
> That's not true.
>
> We deny access even though it should be allowed.
> Because we return PAM_SYSTEM_ERROR
>
https://fedorahosted.org/sssd/attachment/ticket/2751/GPO_failed_1.13.1_al...
>
>
> > Even if we did the opposite and
> > denied all access, we would also have an issue that would prevent
> > users from logging into their machines.
> That's just a bug and not security issue.
> And it's current state.
Are you sure?
https://bugzilla.redhat.com/show_bug.cgi?id=1316164
Yes, I am.
(Mon Feb 29 15:48:10 2016) [sssd[be[example.com]]]
[ad_gpo_access_done] (0x0040): Ignoring error: [5](Input/output error);
GPO-based access control failed, but GPO is not in enforcing mode.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If GPO is not in enforcing mode then we do not reject the access.
The same as SELinux in permissive mode.
LS