[SSSD] [PATCH] Reworked proxy provider

Stephen Gallagher sgallagh at redhat.com
Thu May 20 16:28:13 UTC 2010


On 05/20/2010 08:05 AM, Sumit Bose wrote:
> Hi,
>
> this patch should fix #471. It move the sources of the proxy provider
> into separate directory and introduces a new process which handles the
> pam operations.
>
> Please note that this patch needs 'Copy pam data from DBus message' to
> work properly.


Nack.


process_proxy_child_reply():
If SBUS returns a DBUS_MESSAGE_TYPE_ERROR, you still attempt to cache 
the password. This should be a PAM_SYSTEM_ERR. Same for default.

Please rename be_check_online() to pc_check_online() in proxy_child.c 
for clarity. Same for be_pam_handler()


I'm concerned about what will happen if the PAM conversation hangs. I 
know the backend will eventually hit the SBUS timeout and return, but 
the child will still be hung. I suppose that eventually the monitor will 
kill it and restart it, but might it not be a better idea to instead set 
a SIGALRM timer around the PAM conversation? This is mostly for 
conversation, it's not a Nack in itself. We know that PAM proxy is 
synchronous and inherently limited by PAM itself.

Otherwise, this is looking good.

-- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/



More information about the sssd-devel mailing list