[SSSD] [PATCH] skip rule on error instead of failing completely

Jakub Hrozek jhrozek at redhat.com
Mon Aug 5 14:57:41 UTC 2013


On Mon, Aug 05, 2013 at 04:55:39PM +0200, Jakub Hrozek wrote:
> On Fri, Jul 26, 2013 at 01:46:04PM +0200, Pavel Březina wrote:
> > On 07/26/2013 01:31 PM, Jakub Hrozek wrote:
> > >On Fri, Jul 26, 2013 at 12:34:47PM +0200, Pavel Březina wrote:
> > >>https://fedorahosted.org/sssd/ticket/2031
> > >
> > >> From fecd2799c21dc78fcb098e786b1c7e879e943c5b Mon Sep 17 00:00:00 2001
> > >>From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina at redhat.com>
> > >>Date: Fri, 26 Jul 2013 12:25:01 +0200
> > >>Subject: [PATCH 1/2] sudo: skip rule on error instead of failing completely
> > >>
> > >>https://fedorahosted.org/sssd/ticket/2031
> > >>---
> > >>  src/providers/ldap/sdap_sudo_cache.c | 4 +++-
> > >>  1 file changed, 3 insertions(+), 1 deletion(-)
> > >>
> > >>diff --git a/src/providers/ldap/sdap_sudo_cache.c b/src/providers/ldap/sdap_sudo_cache.c
> > >>index 3c438b9307c310cd4eec030ad628ce28a66ba726..9a2d326e0e11cf90279d8327afaf6a0ab76cac85 100644
> > >>--- a/src/providers/ldap/sdap_sudo_cache.c
> > >>+++ b/src/providers/ldap/sdap_sudo_cache.c
> > >>@@ -135,7 +135,9 @@ sdap_save_native_sudorule_list(TALLOC_CTX *mem_ctx,
> > >>                                          domain, map, replies[i],
> > >>                                          cache_timeout, now, &usn_value);
> > >>          if (ret != EOK) {
> > >>-            goto fail;
> > >>+            DEBUG(SSSDBG_OP_FAILURE, ("Failed to save sudo rule, "
> > >>+                                      "will continue with next...\n"));
> > >>+            continue;
> > >>          }
> > >>
> > >>          /* find highest usn */
> > >>--
> > >>1.7.11.7
> > >>
> > >
> > >> From 09546d945e2b4932550c9d267c2146ac4c901e59 Mon Sep 17 00:00:00 2001
> > >>From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina at redhat.com>
> > >>Date: Fri, 26 Jul 2013 12:29:37 +0200
> > >>Subject: [PATCH 2/2] sudo: print better debug message when a rule has
> > >>  multiple cn values
> > >>
> > >>---
> > >>  src/providers/ldap/sdap_sudo_cache.c | 6 +++++-
> > >>  1 file changed, 5 insertions(+), 1 deletion(-)
> > >>
> > >>diff --git a/src/providers/ldap/sdap_sudo_cache.c b/src/providers/ldap/sdap_sudo_cache.c
> > >>index 9a2d326e0e11cf90279d8327afaf6a0ab76cac85..aaaa1e2aa545864c01acd160c211ecfffce874e2 100644
> > >>--- a/src/providers/ldap/sdap_sudo_cache.c
> > >>+++ b/src/providers/ldap/sdap_sudo_cache.c
> > >>@@ -69,7 +69,11 @@ sdap_save_native_sudorule(TALLOC_CTX *mem_ctx,
> > >>
> > >>      ret = sysdb_attrs_get_string(attrs, map[SDAP_AT_SUDO_NAME].sys_name,
> > >>                                   &rule_name);
> > >>-    if (ret != EOK) {
> > >>+    if (ret == ERANGE) {
> > >>+        DEBUG(SSSDBG_OP_FAILURE, ("Warning: found rule that contains none "
> > >>+              "or multiple CN values. It will be skipped.\n"));
> > >>+        return ret;
> > >>+    } else if (ret != EOK) {
> > >>          DEBUG(SSSDBG_OP_FAILURE, ("Could not get rule name [%d]: %s\n",
> > >>                ret, strerror(ret)));
> > >>          return ret;
> > >>--
> > >>1.7.11.7
> > >>
> > >
> > >Can you make either of those DEBUG messages more verbose? I think we
> > >should make it clear that we have not processed all the rules.
> > 
> > New patches are attached.
> > 
> > >Also I wonder if we should support multiple names by looking at RDN
> > >value and picking the one that matches the RDN? That's what we do for
> > >users and groups anyway.
> > 
> > Yes, ctrianta will file a bug/rfe and we'll do that as separate patch.
> > 
> > >What is the sudo rule name used for (except for cn=defaults) ?
> > 
> > Only administrative purpose.
> > 
> 
> Looks good to me now. Ack!

Pushed to master and sssd-1-10



More information about the sssd-devel mailing list