On Tue, Aug 26, 2014 at 03:00:27PM -0400, Yassir Elley wrote:
> Oops. Pls ignore the sentence fragment immediately above.
>
> Let me also clarify the question.
>
> The following is my proposed table for various combinations of gpo_mode and
> the category (or bucket) which the service maps to. I am only looking at
> the permit and deny categories here (not interactive, network, etc)
>
> gpo_mode service_category return_value
> ====================================================
> disabled permit EOK immediately (i.e. before any
> LDAP/SMB calls)
> disabled deny EOK immediately ...
>
> enforcing permit EOK immediately ...
> enforcing deny EACCES immediately ...
>
> permissive permit EOK immediately ...
> permissive deny EOK immediately ...
>
> Do you agree with the above table?
Looks good to me. With the permissive setting we should add a DEBUG
message, though.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel