[SSSD] [PATCH] Patches related to restricting domain access from PAM services
Pavel Reichl
preichl at redhat.com
Thu Dec 11 18:43:14 UTC 2014
On 12/11/2014 11:41 AM, Jakub Hrozek wrote:
> From 077971dc3d8cefc8df123ed1e1018f06d7679545 Mon Sep 17 00:00:00 2001
> From: Jakub Hrozek<jhrozek at redhat.com>
> Date: Thu, 11 Dec 2014 11:19:58 +0100
> Subject: [PATCH 3/4] MAN: Misspelled username in pam_trusted_users is not
> fatal
>
> The man page claimed that failing to resolve an user name results in
> failure to start SSSD, but it's not the case and shouldn't be, because
> marking a user as trusted only elevates privileges, so it's safe to
> ignore that failure.
> ---
> src/man/sssd.conf.5.xml | 5 -----
> 1 file changed, 5 deletions(-)
>
> diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
> index 3525d78caff28fd05cc18061d023fec3c50d1a47..2002ccc7caf7013ead5b97c463fba46b734090ae 100644
> --- a/src/man/sssd.conf.5.xml
> +++ b/src/man/sssd.conf.5.xml
> @@ -907,11 +907,6 @@ fallback_homedir =/home/%u
> the PAM responder even in case it is not in the
> pam_trusted_users list.
> </para>
> - <para>
> - Also please note that if there is a user name in
> - pam_trusted_users list which fails to be resolved
> - it will cause that SSSD will not be started.
> - </para>
> </listitem>
> </varlistentry>
> <varlistentry>
> -- 1.9.3
Hello Jakub,
patches LGTM, I have just a little problem with 3rd patch - actually I
think that the man page describes what really happens - this is form my
sss_pam.log:
(Thu Dec 11 18:35:21 2014) [sssd[pam]] [sss_process_init] (0x0400):
Responder Initialization complete
(Thu Dec 11 18:35:21 2014) [sssd[pam]] [sss_user_by_name_or_uid]
(0x0040): [xxxxxxxxx] is neither a valid UID nor a user name which could
be resolved by getpwnam().
(Thu Dec 11 18:35:21 2014) [sssd[pam]] [csv_string_to_uid_array]
(0x0040): List item [xxxxxxxxx] is neither a valid UID nor a user name
which could be resolved by getpwnam().
(Thu Dec 11 18:35:21 2014) [sssd[pam]] [get_trusted_uids] (0x0010):
Failed to set allowed UIDs.
(Thu Dec 11 18:35:21 2014) [sssd[pam]] [pam_process_init] (0x0010):
get_trusted_uids failed: 22:[Invalid argument].
(Thu Dec 11 18:35:21 2014) [sssd[pam]] [sss_responder_ctx_destructor]
(0x0400): Responder is being shut down
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20141211/6a717bd4/attachment.html>
More information about the sssd-devel
mailing list