[SSSD] [PATCH] GPO: Fix crash with GPO and missing security descriptor

Stephen Gallagher sgallagh at redhat.com
Wed Apr 29 18:48:12 UTC 2015


On Wed, 2015-04-29 at 18:50 +0200, Lukas Slebodnik wrote:
> On (29/04/15 08:00), Stephen Gallagher wrote:
> > I'm not aware of any situation where this would be a sensible 
> > reply,
> > so this should be fine (and at worst, safe).
> > 
> > I suspect (but since Yassir isn't here any more cannot confirm) 
> > that
> > the original intent here was to skip this GPO, but that wasn't
> > correctly implemented. Good thing too, as it would have been a
> > security bug as previously noted.
> > 
> > Given that this is fairly likely to be hit, I suggest that we need 
> > to
> > open an RFE bug upstream and then change the message to refer to 
> > it. I
> > suggest the following:
> > 
> > "BUG: No attrs found for GPO [%s]. This was likely caused by the 
> > GPO
> > entry being a referred to another domain controller. SSSD does not 
> > yet
> > support this configuration. See [insert SSSD bug number] for more
> > information."
> 
> Updated patch attached.
> 
> LS

Ack. Tested with my reproduction environment and the user was denied
login and the logs showed the message as expected.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150429/10554bd6/attachment.sig>


More information about the sssd-devel mailing list