[SSSD] [PATCH] Fix sysdb_search_selinux_usermap_by_username return value

Jakub Hrozek jhrozek at redhat.com
Fri Jul 20 18:28:36 UTC 2012


On Fri, Jul 20, 2012 at 01:40:40PM +0200, Jan Zelený wrote:
> Dne pátek 20 července 2012 13:23:48, Jakub Hrozek napsal(a):
> > On Fri, Jul 20, 2012 at 12:30:16PM +0200, Jan Zelený wrote:
> > > Dne pátek 20 července 2012 11:48:49, Jakub Hrozek napsal(a):
> > > > There was a logic bug in sysdb_search_selinux_usermap_by_username that
> > > > resulted in returning the value the variable "ret" had after the last
> > > > call
> > > > to sysdb_attrs_get_uint32_t, which in cases the last rule processed did
> > > > not have the requested attributes led to using the default user context.
> > > > 
> > > > I think this would fix the strange bug Rob was seeing yesterday, but I
> > > > still need to verify that.
> > > 
> > > Is there a patch please?
> > 
> > Yes :)
> 
> Thank you.
> 
> Ack to the patch. It fixes potential problem when the last user map in the list 
> won't have hostPriority attribute. Although I find this to be nearly impossible 
> scenario, It's good to be as defensive as possible.
> 
> If you managed to induce such scenario, please send me a reproducer, I'd like 
> to take a look on that.
> 
> Jan

It was being triggered by the logic bug in sss_selinux_match fixed in
the other thread.

Pushed to master.



More information about the sssd-devel mailing list