[SSSD] [PATCH] PAM: Check for trusted domain before sending the request to BE

Sumit Bose sbose at redhat.com
Tue Nov 25 16:55:18 UTC 2014


On Mon, Nov 24, 2014 at 04:38:20PM +0100, Jakub Hrozek wrote:
> Hi,
> 
> When I was working on https://fedorahosted.org/sssd/ticket/2501 I
> noticed several things I didn't like. Most importnantly, the checks were
> done on several places -- I think security decisions should be done at
> one place only ideally so any changes don't miss other calls.
> 
> I'll be sending other patches soon, but this one is important to get in
> soon.
> 
> In particular, the issue would hit when you try to authenticate as a
> user from a domain that is second on the list. In pam_dom_forwarder, we
> might change the pd->dom pointer, bypassing the check done previously.
> 
> Additionally, the restricted domains are only checked if the process is
> trusted. Shall I split that to a new patch?
> 
> Please also let me know if the performance implication outlined in the
> ticket seems like an important one.

ACK

bye,
Sumit



More information about the sssd-devel mailing list