[SSSD] [PATCH] GPO: Fix incorrect strerror on GPO access denial

Lukas Slebodnik lslebodn at redhat.com
Thu Jun 11 14:19:15 UTC 2015


On (11/06/15 09:35), Stephen Gallagher wrote:
>On Thu, 2015-06-11 at 09:19 -0400, Stephen Gallagher wrote:
>> We're attempting to use strerror() to print the result from
>> ad_gpo_access_check(), but that function returns an extended SSSD
>> errno.
>> 
>> This resulted in "Unknown Error" being printed to the logs.
>
>And now with the patch attached...

>From 108c6e9f47560a53d2d044c0399e66528615d73d Mon Sep 17 00:00:00 2001
>From: Stephen Gallagher <sgallagh at redhat.com>
>Date: Thu, 11 Jun 2015 09:17:02 -0400
>Subject: [PATCH] GPO: Fix incorrect strerror on GPO access denial
>
>We're attempting to use strerror() to print the result from
>ad_gpo_access_check(), but that function returns an extended SSSD errno
>---
> src/providers/ad/ad_gpo.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
>index 4e7afb12a73313ece00c6ffdd24cfad1b73a831d..995bd083b27710814350bef8d1e43b874d5a8a27 100644
>--- a/src/providers/ad/ad_gpo.c
>+++ b/src/providers/ad/ad_gpo.c
>@@ -1446,11 +1446,11 @@ ad_gpo_perform_hbac_processing(TALLOC_CTX *mem_ctx,
>                               deny_size);
> 
>     if (ret != EOK) {
>         DEBUG(SSSDBG_OP_FAILURE,
>               "GPO access check failed: [%d](%s)\n",
>-              ret, strerror(ret));
>+              ret, sss_strerror(ret));
>         goto done;
>     }

You can also replace strerror on line 1152 after ad_gpo_extract_policy_setting
                                      1178 after ad_gpo_extract_policy_setting
                                      1673 after sdap_id_op_connect_recv
                                      1995 after ad_gpo_filter_gpos_by_cse_guid
                                      2044 after sysdb_gpo_delete_gpo_result_object
                                      2136 after sysdb_gpo_get_gpo_by_guid
                                      4037 after ad_gpo_parse_gpo_child_response

But strerror can be replaced on all places with sss_strerror
because in value is not within sssd error code range then strerror is called.

LS



More information about the sssd-devel mailing list