[SSSD] [PATCH] [HBAC]: Better libhbac debuging

Petr Cech pcech at redhat.com
Mon Aug 31 11:18:52 UTC 2015


On 08/27/2015 10:42 AM, Pavel Reichl wrote:
>> * SSSDBG_TRACE_ALL produces:
>>
>> ...hbac_evaluator.c:150] [< hbac_evaluate()
>> ...hbac_evaluator.c:410]   REQUEST:
>> ...hbac_evaluator.c:391]     service [sshd]
>> ...hbac_evaluator.c:400]     service_group (none)
>> ...hbac_evaluator.c:391]     user [csikos]
>> ...hbac_evaluator.c:395]     user_group:
> I think it could be useful to move user and might be user_group to less
> verbose level - I think it could be hard to navigate in less verbose
> logs otherwise, do you agree?
>> ...hbac_evaluator.c:397]       [ipausers]
>> ...hbac_evaluator.c:391]     targethost [albireo.cygnus.dev]
>> ...hbac_evaluator.c:400]     targethost_group (none)
>> ...hbac_evaluator.c:391]     srchost [192.168.122.106]
>> ...hbac_evaluator.c:400]     srchost_group (none)
>> ...hbac_evaluator.c:417]     request time Fri Jul 24 14:29:36 2015
>> ...hbac_evaluator.c:454]   RULE [szabo_allowed] [ENABLED]:
>> ...hbac_evaluator.c:456]     services:
>> ...hbac_evaluator.c:427]       category [0] [NONE]
>> ...hbac_evaluator.c:435]       services_names (none)
>> ...hbac_evaluator.c:440]       services_groups:
>> ...hbac_evaluator.c:442]         [Sudo]
>> ...hbac_evaluator.c:462]     users:

Hi Pavel,

there is better example. Do you have any suggestion how to improve the 
levels?

Regards

Petr
-------------- next part --------------
0x0080

(Mon Aug 31 06:57:09 2015) [sssd[be[cygnus.dev]]] [ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule [Test_rule]
(Mon Aug 31 06:57:09 2015) [sssd[be[cygnus.dev]]] [ipa_hbac_evaluate_rules] (0x0080): Access denied by HBAC rules


0x0100

(Mon Aug 31 06:58:33 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:152] [< hbac_evaluate()
(Mon Aug 31 06:58:33 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:172] DISALLOWED by rule [szabo_allowed].
(Mon Aug 31 06:58:33 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:179] ALLOWED by rule [Test_rule].
(Mon Aug 31 06:58:33 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:213] hbac_evaluate() >]
(Mon Aug 31 06:58:34 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:152] [< hbac_evaluate()
(Mon Aug 31 06:58:34 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:172] DISALLOWED by rule [szabo_allowed].
(Mon Aug 31 06:58:34 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:172] DISALLOWED by rule [Test_rule].
(Mon Aug 31 06:58:34 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:213] hbac_evaluate() >]


0x2000

(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:152] [< hbac_evaluate()
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:409]   REQUEST:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:390]     service [sshd]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:399]     service_group (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:390]     user [csikos]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:394]     user_group:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:396]       [ipausers]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:390]     targethost [albireo.cygnus.dev]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:399]     targethost_group (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:390]     srchost [192.168.122.106]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:399]     srchost_group (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:416]     request time Mon Aug 31 11:03:04 2015
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:455]   RULE [szabo_allowed] [ENABLED]:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:457]     services:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:435]       services_names (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:440]       services_groups:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:442]         [Sudo]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:464]     users:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:435]       users_names (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445]       users_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:471]     targethosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430]       targethosts_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432]         [albireo.cygnus.dev]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445]       targethosts_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:478]     srchosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0x1] [ALL]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:172] DISALLOWED by rule [szabo_allowed].
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:455]   RULE [Test_rule] [ENABLED]:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:457]     services:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430]       services_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432]         [login]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432]         [sshd]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432]         [su]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445]       services_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:464]     users:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430]       users_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432]         [csikos]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445]       users_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:471]     targethosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430]       targethosts_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432]         [albireo.cygnus.dev]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445]       targethosts_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:478]     srchosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0x1] [ALL]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:179] ALLOWED by rule [Test_rule].
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:213] hbac_evaluate() >]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [ipa_hbac_evaluate_rules] (0x0080): Access granted by HBAC rule [Test_rule]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:152] [< hbac_evaluate()
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:409]   REQUEST:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:390]     service [systemd-user]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:399]     service_group (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:390]     user [csikos]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:394]     user_group:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:396]       [ipausers]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:390]     targethost [albireo.cygnus.dev]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:399]     targethost_group (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:399]     srchost_group (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:416]     request time Mon Aug 31 11:03:04 2015
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:455]   RULE [szabo_allowed] [ENABLED]:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:457]     services:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:435]       services_names (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:440]       services_groups:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:442]         [Sudo]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:464]     users:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:435]       users_names (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445]       users_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:471]     targethosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430]       targethosts_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432]         [albireo.cygnus.dev]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445]       targethosts_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:478]     srchosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0x1] [ALL]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:172] DISALLOWED by rule [szabo_allowed].
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:455]   RULE [Test_rule] [ENABLED]:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:457]     services:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430]       services_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432]         [login]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432]         [sshd]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432]         [su]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445]       services_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:464]     users:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430]       users_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432]         [csikos]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445]       users_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:471]     targethosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0] [NONE]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:430]       targethosts_names:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:432]         [albireo.cygnus.dev]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:445]       targethosts_groups (none)
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:478]     srchosts:
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x2000): [../src/providers/ipa/hbac_evaluator.c:427]       category [0x1] [ALL]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:172] DISALLOWED by rule [Test_rule].
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [hbac] (0x0100): [../src/providers/ipa/hbac_evaluator.c:213] hbac_evaluate() >]
(Mon Aug 31 07:03:04 2015) [sssd[be[cygnus.dev]]] [ipa_hbac_evaluate_rules] (0x0080): Access denied by HBAC rules


More information about the sssd-devel mailing list