[SSSD] [PATCH] GPO: Fix crash with GPO and missing security descriptor

Jakub Hrozek jhrozek at redhat.com
Thu Apr 30 07:44:37 UTC 2015


On Wed, Apr 29, 2015 at 02:48:12PM -0400, Stephen Gallagher wrote:
> On Wed, 2015-04-29 at 18:50 +0200, Lukas Slebodnik wrote:
> > On (29/04/15 08:00), Stephen Gallagher wrote:
> > > I'm not aware of any situation where this would be a sensible 
> > > reply,
> > > so this should be fine (and at worst, safe).
> > > 
> > > I suspect (but since Yassir isn't here any more cannot confirm) 
> > > that
> > > the original intent here was to skip this GPO, but that wasn't
> > > correctly implemented. Good thing too, as it would have been a
> > > security bug as previously noted.
> > > 
> > > Given that this is fairly likely to be hit, I suggest that we need 
> > > to
> > > open an RFE bug upstream and then change the message to refer to 
> > > it. I
> > > suggest the following:
> > > 
> > > "BUG: No attrs found for GPO [%s]. This was likely caused by the 
> > > GPO
> > > entry being a referred to another domain controller. SSSD does not 
> > > yet
> > > support this configuration. See [insert SSSD bug number] for more
> > > information."
> > 
> > Updated patch attached.
> > 
> > LS
> 
> Ack. Tested with my reproduction environment and the user was denied
> login and the logs showed the message as expected.

* CI: http://sssd-ci.duckdns.org/logs/job/13/63/summary.html
* master: 03e5f1528184a558fd990e66f083157b404dce08
* sssd-1-12: 7c8c34c1ad152892f93d8e01336258bfd0bc35b9



More information about the sssd-devel mailing list