On Fri, Jul 20, 2012 at 01:40:40PM +0200, Jan Zelený wrote:
Dne pátek 20 července 2012 13:23:48, Jakub Hrozek napsal(a):
> On Fri, Jul 20, 2012 at 12:30:16PM +0200, Jan Zelený wrote:
> > Dne pátek 20 července 2012 11:48:49, Jakub Hrozek napsal(a):
> > > There was a logic bug in sysdb_search_selinux_usermap_by_username that
> > > resulted in returning the value the variable "ret" had after the
last
> > > call
> > > to sysdb_attrs_get_uint32_t, which in cases the last rule processed did
> > > not have the requested attributes led to using the default user context.
> > >
> > > I think this would fix the strange bug Rob was seeing yesterday, but I
> > > still need to verify that.
> >
> > Is there a patch please?
>
> Yes :)
Thank you.
Ack to the patch. It fixes potential problem when the last user map in the list
won't have hostPriority attribute. Although I find this to be nearly impossible
scenario, It's good to be as defensive as possible.
If you managed to induce such scenario, please send me a reproducer, I'd like
to take a look on that.
Jan
It was being triggered by the logic bug in sss_selinux_match fixed in
the other thread.
Pushed to master.