[SSSD] [PATCH] SUDO: Provide a sudo DP request based on the internal_req

Stephen Gallagher sgallagh at redhat.com
Mon Jan 23 20:15:24 UTC 2012


On Mon, 2012-01-23 at 21:00 +0100, Jakub Hrozek wrote:
> On Mon, Jan 23, 2012 at 07:02:06PM +0100, Pavel Březina wrote:
> > Dne 23.1.2012 18:32, Jakub Hrozek napsal(a):
> > >On Mon, Jan 23, 2012 at 10:19:37AM -0500, Stephen Gallagher wrote:
> > >>On Mon, 2012-01-23 at 16:08 +0100, Jakub Hrozek wrote:
> > >>>On Mon, Jan 23, 2012 at 03:55:26PM +0100, Pavel Březina wrote:
> > >>>>Dne 23.1.2012 15:39, Jakub Hrozek napsal(a):
> > >>>>>On Mon, Jan 23, 2012 at 10:23:36AM +0100, Pavel Březina wrote:
> > >>>>>>Dne 23.1.2012 02:24, Stephen Gallagher napsal(a):
> > >>>>>>>Also, when you call sss_dp_issue_request(), you're passing 'state' as
> > >>>>>>>the pvt data for sss_dp_get_sudoers_msg(), but you meant to pass 'info',
> > >>>>>>>I think.
> > >>>>>>
> > >>>>>>Shouldn't we start using tallog_get_type_abort() to detect these situations?
> > >>>>>>
> > >>>>>
> > >>>>>I'm not sure we should ever abort, except for situations like options
> > >>>>>mismatch (those can be potentially very dangerous).
> > >>>>
> > >>>>We can set up our own 'abort' function using talloc_set_abort_fn().
> > >>>>For example: we can create an abort function that would kill sssd if
> > >>>>it is under development but prints DEBUG messages in users version.
> > >>>>
> > >>>
> > >>>I like this idea if we can get around the requirement of having to
> > >>>support an old talloc version.
> > >>>
> > >>>>This function is not yet documented.
> > >>>
> > >>>You can send a patch to man talloc :-)
> > >>
> > >>I'm all for this. Please file an enhancement ticket to track it.
> > >
> > >A new patch rebased on top of the recent changes to enums is attached.
> > 
> > Just a nitpick - shouldn't enum sss_dp_type be named sss_dp_sudo_type?
> > Otherwise ack.
> 
> It should and is in the attached patch.
> 
> > 
> > Good work!
> > 
> > Would it make sense to completely replace BE_REQ_SUDO with this
> > enum? I would certainly like it and I can do it as a part of my
> > cn=defaults patches where I'm refactoring SUDO DP so it is easier to
> > implement new responder request.
> 
> Not so sure, I still like the division betwen SSS_DP_* on the responder
> side and BE_REQ_* on the back end side.
> 
> I'd like to hear other opinions, though.

On the back-end, remember that BE_REQ_* is ANDed with BE_REQ_FAST where
appropriate. So we can't just use the enum.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120123/fda47422/attachment.sig>


More information about the sssd-devel mailing list