[SSSD] [PATCH] HBAC: create empty groups with one NULL element

Jakub Hrozek jhrozek at redhat.com
Wed Jan 4 21:12:58 UTC 2012


https://fedorahosted.org/sssd/ticket/1130

Some places if HBAC would create a "{ NULL }" array when there are no
groups, some would just use a NULL pointer.

I think using the array is a safer solution because the loops we use
usually just go through safely. Shanks found one such issue today where
we would use a NULL pointer for the groups pointer in the srchost
element and SSSD would crash.

The attached patch standartizes on using the single element arrays.
-------------- next part --------------
>From 06646c50c236a1757a4cf2bde21823fbd4b83aa5 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 4 Jan 2012 17:10:28 +0100
Subject: [PATCH 1/2] HBAC: create empty groups with one NULL element

https://fedorahosted.org/sssd/ticket/1130
---
 src/providers/ipa/ipa_hbac_common.c |   31 +++++++++++++++----------------
 1 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/src/providers/ipa/ipa_hbac_common.c b/src/providers/ipa/ipa_hbac_common.c
index 859b9840343e16a2812b0d7e4ce1cd63a8ce617f..af0000cff68befa710505aae32988b3b88c0b16e 100644
--- a/src/providers/ipa/ipa_hbac_common.c
+++ b/src/providers/ipa/ipa_hbac_common.c
@@ -179,6 +179,15 @@ replace_attribute_name(const char *old_name,
     return EOK;
 }
 
+static errno_t
+create_empty_grouplist(struct hbac_request_element *el)
+{
+    el->groups = talloc_array(el, const char *, 1);
+    if (!el->groups) return ENOMEM;
+
+    el->groups[0] = NULL;
+    return EOK;
+}
 
 /********************************************
  * Functions for handling conversion to the *
@@ -525,12 +534,7 @@ hbac_eval_user_element(TALLOC_CTX *mem_ctx,
     el = ldb_msg_find_element(msg, SYSDB_ORIG_MEMBEROF);
     if (el == NULL || el->num_values == 0) {
         DEBUG(7, ("No groups for [%s]\n", users->name));
-        users->groups = talloc_array(users, const char *, 1);
-        if (users->groups == NULL) {
-            ret = ENOMEM;
-            goto done;
-        }
-        users->groups[0] = NULL;
+        ret = create_empty_grouplist(users);
         goto done;
     }
     DEBUG(7, ("[%d] groups for [%s]\n", el->num_values, users->name));
@@ -624,8 +628,7 @@ hbac_eval_service_element(TALLOC_CTX *mem_ctx,
          * This rule will only match the name or
          * a service category of ALL
          */
-        svc->groups = NULL;
-        ret = EOK;
+        ret = create_empty_grouplist(svc);
         goto done;
     } else if (ret != EOK) {
         goto done;
@@ -641,8 +644,7 @@ hbac_eval_service_element(TALLOC_CTX *mem_ctx,
          * This rule will only match the name or
          * a service category of ALL
          */
-        svc->groups = NULL;
-        ret = EOK;
+        ret = create_empty_grouplist(svc);
         goto done;
     }
 
@@ -713,8 +715,7 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
         /* We don't know the host (probably an rhost)
          * So we can't determine it's groups either.
          */
-        host->groups = NULL;
-        ret = EOK;
+        ret = create_empty_grouplist(host);
         goto done;
     }
 
@@ -735,8 +736,7 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
          * This rule will only match the name or
          * a host category of ALL
          */
-        host->groups = NULL;
-        ret =  EOK;
+        ret = create_empty_grouplist(host);
         goto done;
     } else if (ret != EOK) {
         goto done;
@@ -752,8 +752,7 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
          * This rule will only match the name or
          * a host category of ALL
          */
-        host->groups = NULL;
-        ret = EOK;
+        ret = create_empty_grouplist(host);
         goto done;
     }
 
-- 
1.7.7.4



More information about the sssd-devel mailing list