[SSSD] [PATCH] Add options to override GID, homedir and shell

Jakub Hrozek jhrozek at redhat.com
Fri May 13 09:14:36 UTC 2011


On 05/10/2011 01:35 PM, Stephen Gallagher wrote:
> On Tue, 2011-05-10 at 10:58 +0200, Jakub Hrozek wrote:
>> On 05/09/2011 07:42 PM, Stephen Gallagher wrote:
>>> On Mon, 2011-05-09 at 10:45 +0200, Jakub Hrozek wrote:
>>>> On 05/06/2011 04:05 PM, Stephen Gallagher wrote:
>>>>> get_shell_override() should not shortcut out if there are no allowed
>>>>> shells. It should still check /etc/shells because if it's not listed, we
>>>>> want to convert it to nologin.
>>>>>
>>>>
>>>> This is done in the attached patch, but I don't agree with the change.
>>>>
>>>> It differs from the current behaviour and moreover allowed_shells is
>>>> unset in the default setting, so the change would affect anyone running
>>>> with defaults.
>>>>
>>>
>>> Well, that wouldn't really have been a change in behavior, since if the
>>> shell didn't exist on the system, the login program or SSH would still
>>> be denying them. 
>>
>> Oh, I though the user would get /bin/sh..
>>
>> In this case I agree with you..thank you for explaining.
> 
> 
> I was thinking about this more last night, and I think in the end that
> you were probably right with how you did this the first time. While it's
> true that both 'login' and 'sshd' will just reject the user (actually,
> they'll try to exec the shell, get an error from exec and then bail
> out), it's possible that other mechanisms like rlogin or telnet or
> similar might have their own ways of behaving (implementing their own
> fallback, for example).
> 
> So I think that we probably need to just punt if we don't have an
> allowed_shells option and return the LDAP value.
> 
> Sorry for going back and forth on this so many times.
> 
> 

No problem :-)

New patches attached. They also change the label "fail" to "done" in the
two functions that expand templates.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-a-confdb_get_uint32_t-convenience-function.patch
Type: text/x-patch
Size: 3667 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110513/161ed7f4/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Add-options-to-override-GID-homedir-and-shell.patch
Type: text/x-patch
Size: 26068 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110513/161ed7f4/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 261 bytes
Desc: OpenPGP digital signature
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110513/161ed7f4/attachment.sig>


More information about the sssd-devel mailing list