[SSSD] [PATCH] HBAC: create empty groups with one NULL element
Jakub Hrozek
jhrozek at redhat.com
Wed Jan 4 21:12:58 UTC 2012
https://fedorahosted.org/sssd/ticket/1130
Some places if HBAC would create a "{ NULL }" array when there are no
groups, some would just use a NULL pointer.
I think using the array is a safer solution because the loops we use
usually just go through safely. Shanks found one such issue today where
we would use a NULL pointer for the groups pointer in the srchost
element and SSSD would crash.
The attached patch standartizes on using the single element arrays.
-------------- next part --------------
>From 06646c50c236a1757a4cf2bde21823fbd4b83aa5 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 4 Jan 2012 17:10:28 +0100
Subject: [PATCH 1/2] HBAC: create empty groups with one NULL element
https://fedorahosted.org/sssd/ticket/1130
---
src/providers/ipa/ipa_hbac_common.c | 31 +++++++++++++++----------------
1 files changed, 15 insertions(+), 16 deletions(-)
diff --git a/src/providers/ipa/ipa_hbac_common.c b/src/providers/ipa/ipa_hbac_common.c
index 859b9840343e16a2812b0d7e4ce1cd63a8ce617f..af0000cff68befa710505aae32988b3b88c0b16e 100644
--- a/src/providers/ipa/ipa_hbac_common.c
+++ b/src/providers/ipa/ipa_hbac_common.c
@@ -179,6 +179,15 @@ replace_attribute_name(const char *old_name,
return EOK;
}
+static errno_t
+create_empty_grouplist(struct hbac_request_element *el)
+{
+ el->groups = talloc_array(el, const char *, 1);
+ if (!el->groups) return ENOMEM;
+
+ el->groups[0] = NULL;
+ return EOK;
+}
/********************************************
* Functions for handling conversion to the *
@@ -525,12 +534,7 @@ hbac_eval_user_element(TALLOC_CTX *mem_ctx,
el = ldb_msg_find_element(msg, SYSDB_ORIG_MEMBEROF);
if (el == NULL || el->num_values == 0) {
DEBUG(7, ("No groups for [%s]\n", users->name));
- users->groups = talloc_array(users, const char *, 1);
- if (users->groups == NULL) {
- ret = ENOMEM;
- goto done;
- }
- users->groups[0] = NULL;
+ ret = create_empty_grouplist(users);
goto done;
}
DEBUG(7, ("[%d] groups for [%s]\n", el->num_values, users->name));
@@ -624,8 +628,7 @@ hbac_eval_service_element(TALLOC_CTX *mem_ctx,
* This rule will only match the name or
* a service category of ALL
*/
- svc->groups = NULL;
- ret = EOK;
+ ret = create_empty_grouplist(svc);
goto done;
} else if (ret != EOK) {
goto done;
@@ -641,8 +644,7 @@ hbac_eval_service_element(TALLOC_CTX *mem_ctx,
* This rule will only match the name or
* a service category of ALL
*/
- svc->groups = NULL;
- ret = EOK;
+ ret = create_empty_grouplist(svc);
goto done;
}
@@ -713,8 +715,7 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
/* We don't know the host (probably an rhost)
* So we can't determine it's groups either.
*/
- host->groups = NULL;
- ret = EOK;
+ ret = create_empty_grouplist(host);
goto done;
}
@@ -735,8 +736,7 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
* This rule will only match the name or
* a host category of ALL
*/
- host->groups = NULL;
- ret = EOK;
+ ret = create_empty_grouplist(host);
goto done;
} else if (ret != EOK) {
goto done;
@@ -752,8 +752,7 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
* This rule will only match the name or
* a host category of ALL
*/
- host->groups = NULL;
- ret = EOK;
+ ret = create_empty_grouplist(host);
goto done;
}
--
1.7.7.4
More information about the sssd-devel
mailing list