[SSSD] [PATCH] GPO: Fix crash with GPO and missing security descriptor

Lukas Slebodnik lslebodn at redhat.com
Wed Apr 29 19:20:24 UTC 2015


On (29/04/15 14:48), Stephen Gallagher wrote:
>On Wed, 2015-04-29 at 18:50 +0200, Lukas Slebodnik wrote:
>> On (29/04/15 08:00), Stephen Gallagher wrote:
>> > I'm not aware of any situation where this would be a sensible 
>> > reply,
>> > so this should be fine (and at worst, safe).
>> > 
>> > I suspect (but since Yassir isn't here any more cannot confirm) 
>> > that
>> > the original intent here was to skip this GPO, but that wasn't
>> > correctly implemented. Good thing too, as it would have been a
>> > security bug as previously noted.
>> > 
>> > Given that this is fairly likely to be hit, I suggest that we need 
>> > to
>> > open an RFE bug upstream and then change the message to refer to 
>> > it. I
>> > suggest the following:
>> > 
>> > "BUG: No attrs found for GPO [%s]. This was likely caused by the 
>> > GPO
>> > entry being a referred to another domain controller. SSSD does not 
>> > yet
>> > support this configuration. See [insert SSSD bug number] for more
>> > information."
>> 
>> Updated patch attached.
>> 
>> LS
>
>Ack. Tested with my reproduction environment and the user was denied
>login and the logs showed the message as expected.

Thank you very much for testing and reproducer.
Dan will appreciate it :-)

LS



More information about the sssd-devel mailing list