[SSSD] [PATCH] GPO: Fix crash with GPO and missing security descriptor
Lukas Slebodnik
lslebodn at redhat.com
Wed Apr 29 19:20:24 UTC 2015
On (29/04/15 14:48), Stephen Gallagher wrote:
>On Wed, 2015-04-29 at 18:50 +0200, Lukas Slebodnik wrote:
>> On (29/04/15 08:00), Stephen Gallagher wrote:
>> > I'm not aware of any situation where this would be a sensible
>> > reply,
>> > so this should be fine (and at worst, safe).
>> >
>> > I suspect (but since Yassir isn't here any more cannot confirm)
>> > that
>> > the original intent here was to skip this GPO, but that wasn't
>> > correctly implemented. Good thing too, as it would have been a
>> > security bug as previously noted.
>> >
>> > Given that this is fairly likely to be hit, I suggest that we need
>> > to
>> > open an RFE bug upstream and then change the message to refer to
>> > it. I
>> > suggest the following:
>> >
>> > "BUG: No attrs found for GPO [%s]. This was likely caused by the
>> > GPO
>> > entry being a referred to another domain controller. SSSD does not
>> > yet
>> > support this configuration. See [insert SSSD bug number] for more
>> > information."
>>
>> Updated patch attached.
>>
>> LS
>
>Ack. Tested with my reproduction environment and the user was denied
>login and the logs showed the message as expected.
Thank you very much for testing and reproducer.
Dan will appreciate it :-)
LS
More information about the sssd-devel
mailing list