[SSSD] [PATCH] Patches related to restricting domain access from PAM services

Pavel Reichl preichl at redhat.com
Fri Dec 12 15:33:33 UTC 2014


On 12/12/2014 01:43 PM, Jakub Hrozek wrote:
> On Thu, Dec 11, 2014 at 07:43:14PM +0100, Pavel Reichl wrote:
>> On 12/11/2014 11:41 AM, Jakub Hrozek wrote:
>>>  From 077971dc3d8cefc8df123ed1e1018f06d7679545 Mon Sep 17 00:00:00 2001
>>> From: Jakub Hrozek<jhrozek at redhat.com>
>>> Date: Thu, 11 Dec 2014 11:19:58 +0100
>>> Subject: [PATCH 3/4] MAN: Misspelled username in pam_trusted_users is not
>>>   fatal
>>>
>>> The man page claimed that failing to resolve an user name results in
>>> failure to start SSSD, but it's not the case and shouldn't be, because
>>> marking a user as trusted only elevates privileges, so it's safe to
>>> ignore that failure.
>>> ---
>>>   src/man/sssd.conf.5.xml | 5 -----
>>>   1 file changed, 5 deletions(-)
>>>
>>> diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
>>> index 3525d78caff28fd05cc18061d023fec3c50d1a47..2002ccc7caf7013ead5b97c463fba46b734090ae 100644
>>> --- a/src/man/sssd.conf.5.xml
>>> +++ b/src/man/sssd.conf.5.xml
>>> @@ -907,11 +907,6 @@ fallback_homedir =/home/%u
>>>                               the PAM responder even in case it is not in the
>>>                               pam_trusted_users list.
>>>                           </para>
>>> -                        <para>
>>> -                            Also please note that if there is a user name in
>>> -                            pam_trusted_users list which fails to be resolved
>>> -                            it will cause that SSSD will not be started.
>>> -                        </para>
>>>                       </listitem>
>>>                   </varlistentry>
>>>                   <varlistentry>
>>> -- 1.9.3
>> Hello Jakub,
>> patches LGTM, I have just a little problem with 3rd patch - actually I think
>> that the man page describes what really happens - this is form my
>> sss_pam.log:
>>
>> (Thu Dec 11 18:35:21 2014) [sssd[pam]] [sss_process_init] (0x0400):
>> Responder Initialization complete
>> (Thu Dec 11 18:35:21 2014) [sssd[pam]] [sss_user_by_name_or_uid] (0x0040):
>> [xxxxxxxxx] is neither a valid UID nor a user name which could be resolved
>> by getpwnam().
>> (Thu Dec 11 18:35:21 2014) [sssd[pam]] [csv_string_to_uid_array] (0x0040):
>> List item [xxxxxxxxx] is neither a valid UID nor a user name which could be
>> resolved by getpwnam().
>> (Thu Dec 11 18:35:21 2014) [sssd[pam]] [get_trusted_uids] (0x0010): Failed
>> to set allowed UIDs.
>> (Thu Dec 11 18:35:21 2014) [sssd[pam]] [pam_process_init] (0x0010):
>> get_trusted_uids failed: 22:[Invalid argument].
>> (Thu Dec 11 18:35:21 2014) [sssd[pam]] [sss_responder_ctx_destructor]
>> (0x0400): Responder is being shut down
>>
>>
> Oops, I must test better next time. Attached patch just makes sure that
> we document properly what is and what is not checked.
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
ACK to all.
Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20141212/52349f67/attachment.html>


More information about the sssd-devel mailing list