[SSSD] [PATCH] GPO: Fix incorrect strerror on GPO access denial
Stephen Gallagher
sgallagh at redhat.com
Thu Jun 11 14:44:49 UTC 2015
On Thu, 2015-06-11 at 16:19 +0200, Lukas Slebodnik wrote:
> On (11/06/15 09:35), Stephen Gallagher wrote:
> > On Thu, 2015-06-11 at 09:19 -0400, Stephen Gallagher wrote:
> > > We're attempting to use strerror() to print the result from
> > > ad_gpo_access_check(), but that function returns an extended SSSD
> > > errno.
> > >
> > > This resulted in "Unknown Error" being printed to the logs.
> >
> > And now with the patch attached...
>
> > From 108c6e9f47560a53d2d044c0399e66528615d73d Mon Sep 17 00:00:00
> > 2001
> > From: Stephen Gallagher <sgallagh at redhat.com>
> > Date: Thu, 11 Jun 2015 09:17:02 -0400
> > Subject: [PATCH] GPO: Fix incorrect strerror on GPO access denial
> >
> > We're attempting to use strerror() to print the result from
> > ad_gpo_access_check(), but that function returns an extended SSSD
> > errno
> > ---
> > src/providers/ad/ad_gpo.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
> > index
> > 4e7afb12a73313ece00c6ffdd24cfad1b73a831d..995bd083b27710814350bef8d1e43b874d5a8a27
> > 100644
> > --- a/src/providers/ad/ad_gpo.c
> > +++ b/src/providers/ad/ad_gpo.c
> > @@ -1446,11 +1446,11 @@ ad_gpo_perform_hbac_processing(TALLOC_CTX
> > *mem_ctx,
> > deny_size);
> >
> > if (ret != EOK) {
> > DEBUG(SSSDBG_OP_FAILURE,
> > "GPO access check failed: [%d](%s)\n",
> > - ret, strerror(ret));
> > + ret, sss_strerror(ret));
> > goto done;
> > }
>
> You can also replace strerror on line 1152 after
> ad_gpo_extract_policy_setting
> 1178 after
> ad_gpo_extract_policy_setting
> 1673 after
> sdap_id_op_connect_recv
> 1995 after
> ad_gpo_filter_gpos_by_cse_guid
> 2044 after
> sysdb_gpo_delete_gpo_result_object
> 2136 after
> sysdb_gpo_get_gpo_by_guid
> 4037 after
> ad_gpo_parse_gpo_child_response
>
> But strerror can be replaced on all places with sss_strerror
> because in value is not within sssd error code range then strerror is
> called.
To be clear, is this a Nack? I was really only trying to address a
specific message that was proving to be misleading. If you really want
me to replace all instances of strerror(), that's a bigger effort.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150611/55e56b14/attachment.sig>
More information about the sssd-devel
mailing list