On 03/04/2013 12:19 AM, Simo Sorce wrote:
Not fully tested, but I am reasonably confident it should work just
fine.
The changes to the HBAC code are the ones I am a bit concerned with.
>From my reading of the code, the 'fail' case migh return PAM_SUCCESS
even though HABC failed to operate before the patches, because
pam_success was set when sdap_access_recv() was called.
I changed that code to unconditionally return PAM_SYSTEM_ERR because
I can't see any legitimate case where an error would still warrant
returning success. This is really a corner case that is almost
impossible to hit though. I think the only case where it would return
the wrong result is in case the hbac search base was missing and we
still got this far somehow.
So please check carefully.
Simo.
-- Simo Sorce * Red Hat, Inc * New York
#endif /* SDAP_ACCESS_H_ */
diff --git a/src/util/util_errors.c b/src/util/util_errors.c
index 88806f531ed90699438deed060d192b7ac029920..a292fa6b19f38943228bd221c09cfe0a21604448
100644
--- a/src/util/util_errors.c
+++ b/src/util/util_errors.c
@@ -39,6 +39,7 @@ struct err_string error_to_str[] = {
{ "Password Change Failed" }, /* ERR_CHPASS_FAILED */
{ "Network I/O Error" }, /* ERR_NETWORK_IO */
{ "Account Expired" }, /* ERR_ACCOUNT_EXPIRED */
+ { "Host Access Denied" }, /* ERR_ACEESS_DENIED */
typo ^
{ "Password Expired" }, /* ERR_PASSWORD_EXPIRED */
};
Everything seems to be working correctly. Ack from me.