[SSSD] [PATCH] skip rule on error instead of failing completely

Pavel Březina pbrezina at redhat.com
Fri Jul 26 11:46:04 UTC 2013


On 07/26/2013 01:31 PM, Jakub Hrozek wrote:
> On Fri, Jul 26, 2013 at 12:34:47PM +0200, Pavel Březina wrote:
>> https://fedorahosted.org/sssd/ticket/2031
>
>>  From fecd2799c21dc78fcb098e786b1c7e879e943c5b Mon Sep 17 00:00:00 2001
>> From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina at redhat.com>
>> Date: Fri, 26 Jul 2013 12:25:01 +0200
>> Subject: [PATCH 1/2] sudo: skip rule on error instead of failing completely
>>
>> https://fedorahosted.org/sssd/ticket/2031
>> ---
>>   src/providers/ldap/sdap_sudo_cache.c | 4 +++-
>>   1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/src/providers/ldap/sdap_sudo_cache.c b/src/providers/ldap/sdap_sudo_cache.c
>> index 3c438b9307c310cd4eec030ad628ce28a66ba726..9a2d326e0e11cf90279d8327afaf6a0ab76cac85 100644
>> --- a/src/providers/ldap/sdap_sudo_cache.c
>> +++ b/src/providers/ldap/sdap_sudo_cache.c
>> @@ -135,7 +135,9 @@ sdap_save_native_sudorule_list(TALLOC_CTX *mem_ctx,
>>                                           domain, map, replies[i],
>>                                           cache_timeout, now, &usn_value);
>>           if (ret != EOK) {
>> -            goto fail;
>> +            DEBUG(SSSDBG_OP_FAILURE, ("Failed to save sudo rule, "
>> +                                      "will continue with next...\n"));
>> +            continue;
>>           }
>>
>>           /* find highest usn */
>> --
>> 1.7.11.7
>>
>
>>  From 09546d945e2b4932550c9d267c2146ac4c901e59 Mon Sep 17 00:00:00 2001
>> From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina at redhat.com>
>> Date: Fri, 26 Jul 2013 12:29:37 +0200
>> Subject: [PATCH 2/2] sudo: print better debug message when a rule has
>>   multiple cn values
>>
>> ---
>>   src/providers/ldap/sdap_sudo_cache.c | 6 +++++-
>>   1 file changed, 5 insertions(+), 1 deletion(-)
>>
>> diff --git a/src/providers/ldap/sdap_sudo_cache.c b/src/providers/ldap/sdap_sudo_cache.c
>> index 9a2d326e0e11cf90279d8327afaf6a0ab76cac85..aaaa1e2aa545864c01acd160c211ecfffce874e2 100644
>> --- a/src/providers/ldap/sdap_sudo_cache.c
>> +++ b/src/providers/ldap/sdap_sudo_cache.c
>> @@ -69,7 +69,11 @@ sdap_save_native_sudorule(TALLOC_CTX *mem_ctx,
>>
>>       ret = sysdb_attrs_get_string(attrs, map[SDAP_AT_SUDO_NAME].sys_name,
>>                                    &rule_name);
>> -    if (ret != EOK) {
>> +    if (ret == ERANGE) {
>> +        DEBUG(SSSDBG_OP_FAILURE, ("Warning: found rule that contains none "
>> +              "or multiple CN values. It will be skipped.\n"));
>> +        return ret;
>> +    } else if (ret != EOK) {
>>           DEBUG(SSSDBG_OP_FAILURE, ("Could not get rule name [%d]: %s\n",
>>                 ret, strerror(ret)));
>>           return ret;
>> --
>> 1.7.11.7
>>
>
> Can you make either of those DEBUG messages more verbose? I think we
> should make it clear that we have not processed all the rules.

New patches are attached.

> Also I wonder if we should support multiple names by looking at RDN
> value and picking the one that matches the RDN? That's what we do for
> users and groups anyway.

Yes, ctrianta will file a bug/rfe and we'll do that as separate patch.

> What is the sudo rule name used for (except for cn=defaults) ?

Only administrative purpose.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-sudo-skip-rule-on-error-instead-of-failing-completel.patch
Type: text/x-patch
Size: 1149 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130726/82f0453c/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-sudo-print-better-debug-message-when-a-rule-has-mult.patch
Type: text/x-patch
Size: 1209 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130726/82f0453c/attachment-0001.bin>


More information about the sssd-devel mailing list