[SSSD] [PATCH] GPO: Fix crash with GPO and missing security descriptor
Stephen Gallagher
sgallagh at redhat.com
Wed Apr 29 18:48:12 UTC 2015
On Wed, 2015-04-29 at 18:50 +0200, Lukas Slebodnik wrote:
> On (29/04/15 08:00), Stephen Gallagher wrote:
> > I'm not aware of any situation where this would be a sensible
> > reply,
> > so this should be fine (and at worst, safe).
> >
> > I suspect (but since Yassir isn't here any more cannot confirm)
> > that
> > the original intent here was to skip this GPO, but that wasn't
> > correctly implemented. Good thing too, as it would have been a
> > security bug as previously noted.
> >
> > Given that this is fairly likely to be hit, I suggest that we need
> > to
> > open an RFE bug upstream and then change the message to refer to
> > it. I
> > suggest the following:
> >
> > "BUG: No attrs found for GPO [%s]. This was likely caused by the
> > GPO
> > entry being a referred to another domain controller. SSSD does not
> > yet
> > support this configuration. See [insert SSSD bug number] for more
> > information."
>
> Updated patch attached.
>
> LS
Ack. Tested with my reproduction environment and the user was denied
login and the logs showed the message as expected.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150429/10554bd6/attachment.sig>
More information about the sssd-devel
mailing list