[SSSD] [PATCH] [HBAC]: Better libhbac debuging
Petr Cech
pcech at redhat.com
Mon Aug 31 11:18:52 UTC 2015
On 08/27/2015 10:42 AM, Pavel Reichl wrote:
>> * SSSDBG_TRACE_ALL produces:
>>
>> ...hbac_evaluator.c:150] [< hbac_evaluate()
>> ...hbac_evaluator.c:410] REQUEST:
>> ...hbac_evaluator.c:391] service [sshd]
>> ...hbac_evaluator.c:400] service_group (none)
>> ...hbac_evaluator.c:391] user [csikos]
>> ...hbac_evaluator.c:395] user_group:
> I think it could be useful to move user and might be user_group to less
> verbose level - I think it could be hard to navigate in less verbose
> logs otherwise, do you agree?
>> ...hbac_evaluator.c:397] [ipausers]
>> ...hbac_evaluator.c:391] targethost [albireo.cygnus.dev]
>> ...hbac_evaluator.c:400] targethost_group (none)
>> ...hbac_evaluator.c:391] srchost [192.168.122.106]
>> ...hbac_evaluator.c:400] srchost_group (none)
>> ...hbac_evaluator.c:417] request time Fri Jul 24 14:29:36 2015
>> ...hbac_evaluator.c:454] RULE [szabo_allowed] [ENABLED]:
>> ...hbac_evaluator.c:456] services:
>> ...hbac_evaluator.c:427] category [0] [NONE]
>> ...hbac_evaluator.c:435] services_names (none)
>> ...hbac_evaluator.c:440] services_groups:
>> ...hbac_evaluator.c:442] [Sudo]
>> ...hbac_evaluator.c:462] users:
Hi Pavel,
there is better example. Do you have any suggestion how to improve the
levels?
Regards
Petr
-------------- next part --------------
0x0080
(Mon Aug 31 06:57:09 2015) [sssd[be[cygnus.dev]]] [ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule [Test_rule]
(Mon Aug 31 06:57:09 2015) [sssd[be[cygnus.dev]]] [ipa_hbac_evaluate_rules] (0x0080): Access denied by HBAC rules
0x0100
(Mon Aug 31 06:58:33 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:152] [< hbac_evaluate()
(Mon Aug 31 06:58:33 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:172] DISALLOWED by rule [szabo_allowed].
(Mon Aug 31 06:58:33 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:179] ALLOWED by rule [Test_rule].
(Mon Aug 31 06:58:33 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:213] hbac_evaluate() >]
(Mon Aug 31 06:58:34 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:152] [< hbac_evaluate()
(Mon Aug 31 06:58:34 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:172] DISALLOWED by rule [szabo_allowed].
(Mon Aug 31 06:58:34 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:172] DISALLOWED by rule [Test_rule].
(Mon Aug 31 06:58:34 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:213] hbac_evaluate() >]
0x2000
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:152] [< hbac_evaluate()
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:409] REQUEST:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:390] service [sshd]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:399] service_group (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:390] user [csikos]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:394] user_group:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:396] [ipausers]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:390] targethost [albireo.cygnus.dev]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:399] targethost_group (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:390] srchost [192.168.122.106]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:399] srchost_group (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:416] request time Mon Aug 31 11:03:04 2015
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:455] RULE [szabo_allowed] [ENABLED]:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:457] services:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:435] services_names (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:440] services_groups:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:442] [Sudo]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:464] users:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:435] users_names (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445] users_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:471] targethosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430] targethosts_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432] [albireo.cygnus.dev]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445] targethosts_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:478] srchosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0x1] [ALL]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:172] DISALLOWED by rule [szabo_allowed].
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:455] RULE [Test_rule] [ENABLED]:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:457] services:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430] services_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432] [login]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432] [sshd]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432] [su]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445] services_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:464] users:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430] users_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432] [csikos]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445] users_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:471] targethosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430] targethosts_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432] [albireo.cygnus.dev]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445] targethosts_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:478] srchosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0x1] [ALL]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:179] ALLOWED by rule [Test_rule].
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:213] hbac_evaluate() >]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule [Test_rule]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:152] [< hbac_evaluate()
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:409] REQUEST:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:390] service [systemd-user]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:399] service_group (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:390] user [csikos]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:394] user_group:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:396] [ipausers]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:390] targethost [albireo.cygnus.dev]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:399] targethost_group (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:399] srchost_group (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:416] request time Mon Aug 31 11:03:04 2015
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:455] RULE [szabo_allowed] [ENABLED]:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:457] services:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:435] services_names (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:440] services_groups:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:442] [Sudo]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:464] users:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:435] users_names (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445] users_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:471] targethosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430] targethosts_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432] [albireo.cygnus.dev]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445] targethosts_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:478] srchosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0x1] [ALL]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:172] DISALLOWED by rule [szabo_allowed].
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:455] RULE [Test_rule] [ENABLED]:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:457] services:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430] services_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432] [login]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432] [sshd]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432] [su]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445] services_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:464] users:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430] users_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432] [csikos]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445] users_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:471] targethosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430] targethosts_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432] [albireo.cygnus.dev]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445] targethosts_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:478] srchosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427] category [0x1] [ALL]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:172] DISALLOWED by rule [Test_rule].
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:213] hbac_evaluate() >]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [ipa_hbac_evaluate_rules] (0x0080): Access denied by HBAC rules
More information about the sssd-devel
mailing list