[SSSD] [PATCH] Handle malformed HBAC rules, deprecate and/or remove the ipa_hbac_treat_deny_as option

Jakub Hrozek jhrozek at redhat.com
Tue Mar 17 15:19:14 UTC 2015


Hi,

In some cases, like broken replication, we might encounter malformed
objects in the cache when evaluating HBAC rules. Unless deny rules are
in effect, we can skip those -- as implemented in the first three
patches.

The fourth patch is meant for the 1-12 branch to signal the
ipa_hbac_treat_deny_as option should not be used anymore. And finally
the last patch removes the option completely. The last patch is only
suggested for the master branch.
-------------- next part --------------
>From 4e335c86bf5674574636d78f4d251dfaf84ee909 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 16 Mar 2015 10:35:59 +0100
Subject: [PATCH 1/5] IPA: Use custom error codes when validating HBAC rules

https://fedorahosted.org/sssd/ticket/2603

Instead of reusing EINVAL/ENOENT, use more descriptive error codes. This
will be useful in the next patch where we act on certain codes.
---
 src/providers/ipa/ipa_hbac_common.c   | 10 +++++-----
 src/providers/ipa/ipa_hbac_hosts.c    | 16 ++++++++--------
 src/providers/ipa/ipa_hbac_services.c | 16 ++++++++--------
 src/providers/ipa/ipa_hbac_users.c    | 16 ++++++++--------
 src/util/util_errors.c                |  2 ++
 src/util/util_errors.h                |  2 ++
 6 files changed, 33 insertions(+), 29 deletions(-)

diff --git a/src/providers/ipa/ipa_hbac_common.c b/src/providers/ipa/ipa_hbac_common.c
index 7d68aa5125682e1b43012ac978d42a0bbd2c5d55..d537db1ea591589ad687a432fb0ebba3dd4fa42a 100644
--- a/src/providers/ipa/ipa_hbac_common.c
+++ b/src/providers/ipa/ipa_hbac_common.c
@@ -567,7 +567,7 @@ hbac_eval_user_element(TALLOC_CTX *mem_ctx,
 
         ret = get_ipa_groupname(users->groups, sysdb, member_dn,
                                 &users->groups[num_groups]);
-        if (ret != EOK && ret != ENOENT) {
+        if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) {
             DEBUG(SSSDBG_MINOR_FAILURE, "Parse error on [%s]\n", member_dn);
             goto done;
         } else if (ret == EOK) {
@@ -676,9 +676,9 @@ hbac_eval_service_element(TALLOC_CTX *mem_ctx,
         ret = get_ipa_servicegroupname(tmp_ctx, sysdb,
                                        (const char *)el->values[i].data,
                                        &name);
-        if (ret != EOK && ret != ENOENT) goto done;
+        if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) goto done;
 
-        /* ENOENT means we had a memberOf entry that wasn't a
+        /* ERR_UNEXPECTED_ENTRY_TYPE means we had a memberOf entry that wasn't a
          * service group. We'll just ignore those (could be
          * HBAC rules)
          */
@@ -783,9 +783,9 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
         ret = get_ipa_hostgroupname(tmp_ctx, sysdb,
                                     (const char *)el->values[i].data,
                                     &name);
-        if (ret != EOK && ret != ENOENT) goto done;
+        if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) goto done;
 
-        /* ENOENT means we had a memberOf entry that wasn't a
+        /* ERR_UNEXPECTED_ENTRY_TYPE means we had a memberOf entry that wasn't a
          * host group. We'll just ignore those (could be
          * HBAC rules)
          */
diff --git a/src/providers/ipa/ipa_hbac_hosts.c b/src/providers/ipa/ipa_hbac_hosts.c
index 656e0e5654a2390093fb5a7c4d7254b87be0589f..d331cdfabb489914658487734042086361c7e7b1 100644
--- a/src/providers/ipa/ipa_hbac_hosts.c
+++ b/src/providers/ipa/ipa_hbac_hosts.c
@@ -362,14 +362,14 @@ get_ipa_hostgroupname(TALLOC_CTX *mem_ctx,
     }
 
     if (!ldb_dn_validate(dn)) {
-        ret = EINVAL;
+        ret = ERR_MALFORMED_ENTRY;
         goto done;
     }
 
     if (ldb_dn_get_comp_num(dn) < 4) {
         /* RDN, hostgroups, accounts, and at least one DC= */
         /* If it's fewer, it's not a group DN */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -379,7 +379,7 @@ get_ipa_hostgroupname(TALLOC_CTX *mem_ctx,
         /* Shouldn't happen if ldb_dn_validate()
          * passed, but we'll be careful.
          */
-        ret = EINVAL;
+        ret = ERR_MALFORMED_ENTRY;
         goto done;
     }
 
@@ -387,7 +387,7 @@ get_ipa_hostgroupname(TALLOC_CTX *mem_ctx,
         /* RDN has the wrong attribute name.
          * It's not a host.
          */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -395,7 +395,7 @@ get_ipa_hostgroupname(TALLOC_CTX *mem_ctx,
     hostgroup_comp_name = ldb_dn_get_component_name(dn, 1);
     if (strcasecmp("cn", hostgroup_comp_name) != 0) {
         /* The second component name is not "cn" */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -404,7 +404,7 @@ get_ipa_hostgroupname(TALLOC_CTX *mem_ctx,
                     (const char *) hostgroup_comp_val->data,
                     hostgroup_comp_val->length) != 0) {
         /* The second component value is not "hostgroups" */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -412,7 +412,7 @@ get_ipa_hostgroupname(TALLOC_CTX *mem_ctx,
     account_comp_name = ldb_dn_get_component_name(dn, 2);
     if (strcasecmp("cn", account_comp_name) != 0) {
         /* The third component name is not "cn" */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -421,7 +421,7 @@ get_ipa_hostgroupname(TALLOC_CTX *mem_ctx,
                     (const char *) account_comp_val->data,
                     account_comp_val->length) != 0) {
         /* The third component value is not "accounts" */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
diff --git a/src/providers/ipa/ipa_hbac_services.c b/src/providers/ipa/ipa_hbac_services.c
index 3040ce68a68520d7eee0ec478ee0adbfb80eb083..35ee003effb5ac933843cbc3bd662f81a58246ad 100644
--- a/src/providers/ipa/ipa_hbac_services.c
+++ b/src/providers/ipa/ipa_hbac_services.c
@@ -606,14 +606,14 @@ get_ipa_servicegroupname(TALLOC_CTX *mem_ctx,
     }
 
     if (!ldb_dn_validate(dn)) {
-        ret = EINVAL;
+        ret = ERR_MALFORMED_ENTRY;
         goto done;
     }
 
     if (ldb_dn_get_comp_num(dn) < 4) {
         /* RDN, services, hbac, and at least one DC= */
         /* If it's fewer, it's not a group DN */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -623,7 +623,7 @@ get_ipa_servicegroupname(TALLOC_CTX *mem_ctx,
         /* Shouldn't happen if ldb_dn_validate()
          * passed, but we'll be careful.
          */
-        ret = EINVAL;
+        ret = ERR_MALFORMED_ENTRY;
         goto done;
     }
 
@@ -631,7 +631,7 @@ get_ipa_servicegroupname(TALLOC_CTX *mem_ctx,
         /* RDN has the wrong attribute name.
          * It's not a service.
          */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -639,7 +639,7 @@ get_ipa_servicegroupname(TALLOC_CTX *mem_ctx,
     svc_comp_name = ldb_dn_get_component_name(dn, 1);
     if (strcasecmp("cn", svc_comp_name) != 0) {
         /* The second component name is not "cn" */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -648,7 +648,7 @@ get_ipa_servicegroupname(TALLOC_CTX *mem_ctx,
                     (const char *) svc_comp_val->data,
                     svc_comp_val->length) != 0) {
         /* The second component value is not "hbacservicegroups" */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -656,7 +656,7 @@ get_ipa_servicegroupname(TALLOC_CTX *mem_ctx,
     hbac_comp_name = ldb_dn_get_component_name(dn, 2);
     if (strcasecmp("cn", hbac_comp_name) != 0) {
         /* The third component name is not "cn" */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -665,7 +665,7 @@ get_ipa_servicegroupname(TALLOC_CTX *mem_ctx,
                     (const char *) hbac_comp_val->data,
                     hbac_comp_val->length) != 0) {
         /* The third component value is not "hbac" */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
diff --git a/src/providers/ipa/ipa_hbac_users.c b/src/providers/ipa/ipa_hbac_users.c
index ebf4bf9d591135e19492a89e2fab4aac05f873d9..a8d52ffa51ba1a04cf0101cb00537c58d1a4848d 100644
--- a/src/providers/ipa/ipa_hbac_users.c
+++ b/src/providers/ipa/ipa_hbac_users.c
@@ -60,14 +60,14 @@ get_ipa_groupname(TALLOC_CTX *mem_ctx,
     }
 
     if (!ldb_dn_validate(dn)) {
-        ret = EINVAL;
+        ret = ERR_MALFORMED_ENTRY;
         goto done;
     }
 
     if (ldb_dn_get_comp_num(dn) < 4) {
         /* RDN, groups, accounts, and at least one DC= */
         /* If it's fewer, it's not a group DN */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -77,7 +77,7 @@ get_ipa_groupname(TALLOC_CTX *mem_ctx,
         /* Shouldn't happen if ldb_dn_validate()
          * passed, but we'll be careful.
          */
-        ret = EINVAL;
+        ret = ERR_MALFORMED_ENTRY;
         goto done;
     }
 
@@ -85,7 +85,7 @@ get_ipa_groupname(TALLOC_CTX *mem_ctx,
         /* RDN has the wrong attribute name.
          * It's not a group.
          */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -93,7 +93,7 @@ get_ipa_groupname(TALLOC_CTX *mem_ctx,
     group_comp_name = ldb_dn_get_component_name(dn, 1);
     if (strcasecmp("cn", group_comp_name) != 0) {
         /* The second component name is not "cn" */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -102,7 +102,7 @@ get_ipa_groupname(TALLOC_CTX *mem_ctx,
                     (const char *) group_comp_val->data,
                     group_comp_val->length) != 0) {
         /* The second component value is not "groups" */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -110,7 +110,7 @@ get_ipa_groupname(TALLOC_CTX *mem_ctx,
     account_comp_name = ldb_dn_get_component_name(dn, 2);
     if (strcasecmp("cn", account_comp_name) != 0) {
         /* The third component name is not "cn" */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
@@ -119,7 +119,7 @@ get_ipa_groupname(TALLOC_CTX *mem_ctx,
                     (const char *) account_comp_val->data,
                     account_comp_val->length) != 0) {
         /* The third component value is not "accounts" */
-        ret = ENOENT;
+        ret = ERR_UNEXPECTED_ENTRY_TYPE;
         goto done;
     }
 
diff --git a/src/util/util_errors.c b/src/util/util_errors.c
index 923f0a865e9ce22cf368c6796d0479c5a8053f45..ac08f6277def4ada16ec61e7843ac482bc1b1e7c 100644
--- a/src/util/util_errors.c
+++ b/src/util/util_errors.c
@@ -70,6 +70,8 @@ struct err_string error_to_str[] = {
     { "Username format not allowed by re_expression" }, /* ERR_REGEX_NOMATCH */
     { "Time specification not supported" }, /* ERR_TIMESPEC_NOT_SUPPORTED */
     { "Invalid SSSD configuration detected." }, /* ERR_INVALID_CONFIG */
+    { "Malformed cache entry" }, /* ERR_MALFORMED_ENTRY */
+    { "Unexpected cache entry type" }, /* ERR_UNEXPECTED_ENTRY_TYPE */
     { "ERR_LAST" } /* ERR_LAST */
 };
 
diff --git a/src/util/util_errors.h b/src/util/util_errors.h
index 54d474f969e5e86764481f5905351668a300665d..c03274ce24275ffb6b3493d6eb74e072d17a61a0 100644
--- a/src/util/util_errors.h
+++ b/src/util/util_errors.h
@@ -92,6 +92,8 @@ enum sssd_errors {
     ERR_REGEX_NOMATCH,
     ERR_TIMESPEC_NOT_SUPPORTED,
     ERR_INVALID_CONFIG,
+    ERR_MALFORMED_ENTRY,
+    ERR_UNEXPECTED_ENTRY_TYPE,
     ERR_LAST            /* ALWAYS LAST */
 };
 
-- 
2.1.0

-------------- next part --------------
>From ad15274b40c70722b2b0be9f56fb2c098793e8fa Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 16 Mar 2015 11:00:09 +0100
Subject: [PATCH 2/5] IPA: Drop useless sysdb parameter

https://fedorahosted.org/sssd/ticket/2603

It's better to dereference the domain structure.
---
 src/providers/ipa/ipa_hbac_common.c | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/src/providers/ipa/ipa_hbac_common.c b/src/providers/ipa/ipa_hbac_common.c
index d537db1ea591589ad687a432fb0ebba3dd4fa42a..8436b7e2d1e9b745e3265c319669cf196f610ee1 100644
--- a/src/providers/ipa/ipa_hbac_common.c
+++ b/src/providers/ipa/ipa_hbac_common.c
@@ -401,21 +401,18 @@ done:
 
 static errno_t
 hbac_eval_user_element(TALLOC_CTX *mem_ctx,
-                       struct sysdb_ctx *sysdb,
                        struct sss_domain_info *domain,
                        const char *username,
                        struct hbac_request_element **user_element);
 
 static errno_t
 hbac_eval_service_element(TALLOC_CTX *mem_ctx,
-                          struct sysdb_ctx *sysdb,
                           struct sss_domain_info *domain,
                           const char *servicename,
                           struct hbac_request_element **svc_element);
 
 static errno_t
 hbac_eval_host_element(TALLOC_CTX *mem_ctx,
-                       struct sysdb_ctx *sysdb,
                        struct sss_domain_info *domain,
                        const char *hostname,
                        struct hbac_request_element **host_element);
@@ -455,16 +452,16 @@ hbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,
             ret = ENOMEM;
             goto done;
         }
-        ret = hbac_eval_user_element(eval_req, user_dom->sysdb, user_dom,
+        ret = hbac_eval_user_element(eval_req, user_dom,
                                      pd->user, &eval_req->user);
     } else {
-        ret = hbac_eval_user_element(eval_req, domain->sysdb, domain,
+        ret = hbac_eval_user_element(eval_req, domain,
                                      pd->user, &eval_req->user);
     }
     if (ret != EOK) goto done;
 
     /* Get the PAM service and service groups */
-    ret = hbac_eval_service_element(eval_req, domain->sysdb, domain,
+    ret = hbac_eval_service_element(eval_req, domain,
                                     pd->service, &eval_req->service);
     if (ret != EOK) goto done;
 
@@ -480,7 +477,7 @@ hbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,
         rhost = pd->rhost;
     }
 
-    ret = hbac_eval_host_element(eval_req, domain->sysdb, domain,
+    ret = hbac_eval_host_element(eval_req, domain,
                                  rhost, &eval_req->srchost);
     if (ret != EOK) goto done;
 
@@ -493,7 +490,7 @@ hbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,
         goto done;
     }
 
-    ret = hbac_eval_host_element(eval_req, domain->sysdb, domain,
+    ret = hbac_eval_host_element(eval_req, domain,
                                  thost, &eval_req->targethost);
     if (ret != EOK) goto done;
 
@@ -508,7 +505,6 @@ done:
 
 static errno_t
 hbac_eval_user_element(TALLOC_CTX *mem_ctx,
-                       struct sysdb_ctx *sysdb,
                        struct sss_domain_info *domain,
                        const char *username,
                        struct hbac_request_element **user_element)
@@ -565,7 +561,7 @@ hbac_eval_user_element(TALLOC_CTX *mem_ctx,
     for (i = 0; i < el->num_values; i++) {
         member_dn = (const char *)el->values[i].data;
 
-        ret = get_ipa_groupname(users->groups, sysdb, member_dn,
+        ret = get_ipa_groupname(users->groups, domain->sysdb, member_dn,
                                 &users->groups[num_groups]);
         if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) {
             DEBUG(SSSDBG_MINOR_FAILURE, "Parse error on [%s]\n", member_dn);
@@ -603,7 +599,6 @@ done:
 
 static errno_t
 hbac_eval_service_element(TALLOC_CTX *mem_ctx,
-                          struct sysdb_ctx *sysdb,
                           struct sss_domain_info *domain,
                           const char *servicename,
                           struct hbac_request_element **svc_element)
@@ -636,7 +631,7 @@ hbac_eval_service_element(TALLOC_CTX *mem_ctx,
     }
 
     /* Look up the service to get its originalMemberOf entries */
-    ret = sysdb_search_entry(tmp_ctx, sysdb, svc_dn,
+    ret = sysdb_search_entry(tmp_ctx, domain->sysdb, svc_dn,
                              LDB_SCOPE_BASE, NULL,
                              memberof_attrs,
                              &count, &msgs);
@@ -673,7 +668,7 @@ hbac_eval_service_element(TALLOC_CTX *mem_ctx,
     }
 
     for (i = j = 0; i < el->num_values; i++) {
-        ret = get_ipa_servicegroupname(tmp_ctx, sysdb,
+        ret = get_ipa_servicegroupname(tmp_ctx, domain->sysdb,
                                        (const char *)el->values[i].data,
                                        &name);
         if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) goto done;
@@ -702,7 +697,6 @@ done:
 
 static errno_t
 hbac_eval_host_element(TALLOC_CTX *mem_ctx,
-                       struct sysdb_ctx *sysdb,
                        struct sss_domain_info *domain,
                        const char *hostname,
                        struct hbac_request_element **host_element)
@@ -743,7 +737,7 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
     }
 
     /* Look up the host to get its originalMemberOf entries */
-    ret = sysdb_search_entry(tmp_ctx, sysdb, host_dn,
+    ret = sysdb_search_entry(tmp_ctx, domain->sysdb, host_dn,
                              LDB_SCOPE_BASE, NULL,
                              memberof_attrs,
                              &count, &msgs);
@@ -780,7 +774,7 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
     }
 
     for (i = j = 0; i < el->num_values; i++) {
-        ret = get_ipa_hostgroupname(tmp_ctx, sysdb,
+        ret = get_ipa_hostgroupname(tmp_ctx, domain->sysdb,
                                     (const char *)el->values[i].data,
                                     &name);
         if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) goto done;
-- 
2.1.0

-------------- next part --------------
>From 1ae252d169cb0a42363b9bb0df9d24e59922b590 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 16 Mar 2015 11:12:25 +0100
Subject: [PATCH 3/5] IPA: Only treat malformed HBAC rules as fatal if deny
 rules are enabled

https://fedorahosted.org/sssd/ticket/2603

If deny rules are not in effect, we can skip malformed HBAC rules
because at worst we will deny access. If deny rules are in effect, we
need to error out to be on the safe side and avoid skipping a deny rule.
---
 src/providers/ipa/ipa_hbac_common.c | 68 +++++++++++++++++++++++++++++--------
 1 file changed, 54 insertions(+), 14 deletions(-)

diff --git a/src/providers/ipa/ipa_hbac_common.c b/src/providers/ipa/ipa_hbac_common.c
index 8436b7e2d1e9b745e3265c319669cf196f610ee1..a7e338e995de0f2e4142132c056476bc301d80cc 100644
--- a/src/providers/ipa/ipa_hbac_common.c
+++ b/src/providers/ipa/ipa_hbac_common.c
@@ -403,18 +403,21 @@ static errno_t
 hbac_eval_user_element(TALLOC_CTX *mem_ctx,
                        struct sss_domain_info *domain,
                        const char *username,
+                       bool deny_rules,
                        struct hbac_request_element **user_element);
 
 static errno_t
 hbac_eval_service_element(TALLOC_CTX *mem_ctx,
                           struct sss_domain_info *domain,
                           const char *servicename,
+                          bool deny_rules,
                           struct hbac_request_element **svc_element);
 
 static errno_t
 hbac_eval_host_element(TALLOC_CTX *mem_ctx,
                        struct sss_domain_info *domain,
                        const char *hostname,
+                       bool deny_rules,
                        struct hbac_request_element **host_element);
 
 static errno_t
@@ -452,17 +455,20 @@ hbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,
             ret = ENOMEM;
             goto done;
         }
-        ret = hbac_eval_user_element(eval_req, user_dom,
-                                     pd->user, &eval_req->user);
+        ret = hbac_eval_user_element(eval_req, user_dom, pd->user,
+                                     hbac_ctx->get_deny_rules,
+                                     &eval_req->user);
     } else {
-        ret = hbac_eval_user_element(eval_req, domain,
-                                     pd->user, &eval_req->user);
+        ret = hbac_eval_user_element(eval_req, domain, pd->user,
+                                     hbac_ctx->get_deny_rules,
+                                     &eval_req->user);
     }
     if (ret != EOK) goto done;
 
     /* Get the PAM service and service groups */
-    ret = hbac_eval_service_element(eval_req, domain,
-                                    pd->service, &eval_req->service);
+    ret = hbac_eval_service_element(eval_req, domain, pd->service,
+                                    hbac_ctx->get_deny_rules,
+                                    &eval_req->service);
     if (ret != EOK) goto done;
 
     /* Get the source host */
@@ -477,8 +483,9 @@ hbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,
         rhost = pd->rhost;
     }
 
-    ret = hbac_eval_host_element(eval_req, domain,
-                                 rhost, &eval_req->srchost);
+    ret = hbac_eval_host_element(eval_req, domain, rhost,
+                                 hbac_ctx->get_deny_rules,
+                                 &eval_req->srchost);
     if (ret != EOK) goto done;
 
     /* The target host is always the current machine */
@@ -490,8 +497,9 @@ hbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,
         goto done;
     }
 
-    ret = hbac_eval_host_element(eval_req, domain,
-                                 thost, &eval_req->targethost);
+    ret = hbac_eval_host_element(eval_req, domain, thost,
+                                 hbac_ctx->get_deny_rules,
+                                 &eval_req->targethost);
     if (ret != EOK) goto done;
 
     *request = talloc_steal(mem_ctx, eval_req);
@@ -507,6 +515,7 @@ static errno_t
 hbac_eval_user_element(TALLOC_CTX *mem_ctx,
                        struct sss_domain_info *domain,
                        const char *username,
+                       bool deny_rules,
                        struct hbac_request_element **user_element)
 {
     errno_t ret;
@@ -564,8 +573,15 @@ hbac_eval_user_element(TALLOC_CTX *mem_ctx,
         ret = get_ipa_groupname(users->groups, domain->sysdb, member_dn,
                                 &users->groups[num_groups]);
         if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) {
-            DEBUG(SSSDBG_MINOR_FAILURE, "Parse error on [%s]\n", member_dn);
-            goto done;
+            if (deny_rules) {
+                DEBUG(SSSDBG_OP_FAILURE, "Parse error on [%s]: %s\n",
+                      member_dn, sss_strerror(ret));
+                goto done;
+            } else {
+                DEBUG(SSSDBG_MINOR_FAILURE,
+                      "Skipping malformed entry [%s]\n", member_dn);
+                continue;
+            }
         } else if (ret == EOK) {
             DEBUG(SSSDBG_TRACE_LIBS, "Added group [%s] for user [%s]\n",
                       users->groups[num_groups], users->name);
@@ -601,6 +617,7 @@ static errno_t
 hbac_eval_service_element(TALLOC_CTX *mem_ctx,
                           struct sss_domain_info *domain,
                           const char *servicename,
+                          bool deny_rules,
                           struct hbac_request_element **svc_element)
 {
     errno_t ret;
@@ -671,7 +688,18 @@ hbac_eval_service_element(TALLOC_CTX *mem_ctx,
         ret = get_ipa_servicegroupname(tmp_ctx, domain->sysdb,
                                        (const char *)el->values[i].data,
                                        &name);
-        if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) goto done;
+        if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) {
+            if (deny_rules) {
+                DEBUG(SSSDBG_OP_FAILURE, "Parse error on [%s]: %s\n",
+                                         (const char *)el->values[i].data,
+                                         sss_strerror(ret));
+                goto done;
+            } else {
+                DEBUG(SSSDBG_MINOR_FAILURE, "Skipping malformed entry [%s]\n",
+                                            (const char *)el->values[i].data);
+                continue;
+            }
+        }
 
         /* ERR_UNEXPECTED_ENTRY_TYPE means we had a memberOf entry that wasn't a
          * service group. We'll just ignore those (could be
@@ -699,6 +727,7 @@ static errno_t
 hbac_eval_host_element(TALLOC_CTX *mem_ctx,
                        struct sss_domain_info *domain,
                        const char *hostname,
+                       bool deny_rules,
                        struct hbac_request_element **host_element)
 {
     errno_t ret;
@@ -777,7 +806,18 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
         ret = get_ipa_hostgroupname(tmp_ctx, domain->sysdb,
                                     (const char *)el->values[i].data,
                                     &name);
-        if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) goto done;
+        if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) {
+            if (deny_rules) {
+                DEBUG(SSSDBG_OP_FAILURE, "Parse error on [%s]: %s\n",
+                                         (const char *)el->values[i].data,
+                                         sss_strerror(ret));
+                goto done;
+            } else {
+                DEBUG(SSSDBG_MINOR_FAILURE, "Skipping malformed entry [%s]\n",
+                                            (const char *)el->values[i].data);
+                continue;
+            }
+        }
 
         /* ERR_UNEXPECTED_ENTRY_TYPE means we had a memberOf entry that wasn't a
          * host group. We'll just ignore those (could be
-- 
2.1.0

-------------- next part --------------
>From b4d21bfae0fe194c05c25a699a15ba046b656e2d Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 16 Mar 2015 11:28:25 +0100
Subject: [PATCH 4/5] IPA: Deprecate the ipa_hbac_treat_deny_as option

https://fedorahosted.org/sssd/ticket/2603

Deny rules have not been supported by the IPA server since 2.1. We
should deprecate the ipa_hbac_treat_deny_as option.
---
 src/providers/ipa/ipa_access.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/providers/ipa/ipa_access.c b/src/providers/ipa/ipa_access.c
index 2ebaec337eedd205bab7c7cbb2a77568616062d0..d1ae18999d0b1c7637ab6de52b0290cde1c40e87 100644
--- a/src/providers/ipa/ipa_access.c
+++ b/src/providers/ipa/ipa_access.c
@@ -178,6 +178,10 @@ static void ipa_hbac_check(struct tevent_req *req)
         hbac_ctx->get_deny_rules = false;
     } else {
         hbac_ctx->get_deny_rules = true;
+        sss_log(SSS_LOG_NOTICE,
+                "WARNING: Using deny rules is deprecated, the option "
+                "ipa_hbac_treat_deny_as will be removed in the next "
+                "upstream version\n");
     }
 
     ret = hbac_retry(hbac_ctx);
-- 
2.1.0

-------------- next part --------------
>From f87069ab5f3a56bb2fdf648e043b6abc718b4f5e Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 16 Mar 2015 11:48:39 +0100
Subject: [PATCH 5/5] IPA: Remove the ipa_hbac_treat_deny_as option

https://fedorahosted.org/sssd/ticket/2603

Since deny rules are no longer supported on the server, the client
should no longer support them either. Remove the option.
---
 src/config/SSSDConfig/__init__.py.in    |  1 -
 src/config/etc/sssd.api.d/sssd-ipa.conf |  1 -
 src/man/sssd-ipa.5.xml                  | 28 -------------------
 src/providers/ipa/ipa_access.c          | 14 ----------
 src/providers/ipa/ipa_access.h          |  1 -
 src/providers/ipa/ipa_common.h          |  1 -
 src/providers/ipa/ipa_hbac_common.c     | 49 ++++++---------------------------
 src/providers/ipa/ipa_hbac_rules.c      | 29 ++++++-------------
 src/providers/ipa/ipa_hbac_rules.h      |  1 -
 src/providers/ipa/ipa_opts.h            |  1 -
 src/providers/ipa/ipa_selinux.c         |  2 +-
 11 files changed, 19 insertions(+), 109 deletions(-)

diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index dbbffebf38977e526cf2944510a2f60da7edf33a..31c9c648045f1e2b031c6f9b2196b44e9c4c4313 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -160,7 +160,6 @@ option_strings = {
     'ipa_hbac_search_base' : _("Search base for HBAC related objects"),
     'ipa_hbac_refresh' : _("The amount of time between lookups of the HBAC rules against the IPA server"),
     'ipa_selinux_refresh' : _("The amount of time in seconds between lookups of the SELinux maps against the IPA server"),
-    'ipa_hbac_treat_deny_as' : _("If DENY rules are present, either DENY_ALL or IGNORE"),
     'ipa_hbac_support_srchost' : _("If set to false, host argument given by PAM will be ignored"),
     'ipa_automount_location' : _("The automounter location this IPA client is using"),
     'ipa_master_domain_search_base': _("Search base for object containing info about IPA domain"),
diff --git a/src/config/etc/sssd.api.d/sssd-ipa.conf b/src/config/etc/sssd.api.d/sssd-ipa.conf
index 2a3b7ef1519e3476cb4b432336da0c359b1844ba..230bdd7df3e7512eab9096c136624cdd7923ed96 100644
--- a/src/config/etc/sssd.api.d/sssd-ipa.conf
+++ b/src/config/etc/sssd.api.d/sssd-ipa.conf
@@ -159,7 +159,6 @@ krb5_use_enterprise_principal = bool, None, false
 [provider/ipa/access]
 ipa_hbac_refresh = int, None, false
 ipa_selinux_refresh = int, None, false
-ipa_hbac_treat_deny_as = str, None, false
 ipa_hbac_support_srchost = bool, None, false
 ipa_host_object_class = str, None, false
 ipa_host_name = str, None, false
diff --git a/src/man/sssd-ipa.5.xml b/src/man/sssd-ipa.5.xml
index 77cb9aac5704a8959049edf5137a0aa55a1edc1f..0716b6235f93965170983856b930799bfded6258 100644
--- a/src/man/sssd-ipa.5.xml
+++ b/src/man/sssd-ipa.5.xml
@@ -500,34 +500,6 @@
                 </varlistentry>
 
                 <varlistentry>
-                    <term>ipa_hbac_treat_deny_as (string)</term>
-                    <listitem>
-                        <para>
-                            This option specifies how to treat the deprecated
-                            DENY-type HBAC rules. As of FreeIPA v2.1, DENY
-                            rules are no longer supported on the server. All
-                            users of FreeIPA will need to migrate their rules
-                            to use only the ALLOW rules. The client will
-                            support two modes of operation during this
-                            transition period:
-                        </para>
-                        <para>
-                            <emphasis>DENY_ALL</emphasis>: If any HBAC DENY
-                            rules are detected, all users will be denied
-                            access.
-                        </para>
-                        <para>
-                            <emphasis>IGNORE</emphasis>: SSSD will ignore any
-                            DENY rules. Be very careful with this option, as
-                            it may result in opening unintended access.
-                        </para>
-                        <para>
-                            Default: DENY_ALL
-                        </para>
-                    </listitem>
-                </varlistentry>
-
-                <varlistentry>
                     <term>ipa_server_mode (boolean)</term>
                     <listitem>
                         <para>
diff --git a/src/providers/ipa/ipa_access.c b/src/providers/ipa/ipa_access.c
index d1ae18999d0b1c7637ab6de52b0290cde1c40e87..3198e2bd2a4c8355eeccc129c85ae3d7d67f61b0 100644
--- a/src/providers/ipa/ipa_access.c
+++ b/src/providers/ipa/ipa_access.c
@@ -114,7 +114,6 @@ static void ipa_hbac_check(struct tevent_req *req)
     struct be_ctx *be_ctx;
     struct pam_data *pd;
     struct hbac_ctx *hbac_ctx = NULL;
-    const char *deny_method;
     struct ipa_access_ctx *ipa_access_ctx;
     int ret;
 
@@ -172,18 +171,6 @@ static void ipa_hbac_check(struct tevent_req *req)
         goto fail;
     }
 
-    deny_method = dp_opt_get_string(hbac_ctx->ipa_options,
-                                    IPA_HBAC_DENY_METHOD);
-    if (strcasecmp(deny_method, "IGNORE") == 0) {
-        hbac_ctx->get_deny_rules = false;
-    } else {
-        hbac_ctx->get_deny_rules = true;
-        sss_log(SSS_LOG_NOTICE,
-                "WARNING: Using deny rules is deprecated, the option "
-                "ipa_hbac_treat_deny_as will be removed in the next "
-                "upstream version\n");
-    }
-
     ret = hbac_retry(hbac_ctx);
     if (ret != EOK) {
         goto fail;
@@ -471,7 +458,6 @@ static void hbac_get_rule_info_step(struct tevent_req *req)
 
     /* Get the list of applicable rules */
     req = ipa_hbac_rule_info_send(hbac_ctx,
-                                  hbac_ctx->get_deny_rules,
                                   be_ctx->ev,
                                   sdap_id_op_handle(hbac_ctx->sdap_op),
                                   hbac_ctx->sdap_ctx->opts,
diff --git a/src/providers/ipa/ipa_access.h b/src/providers/ipa/ipa_access.h
index d3b78b0f86f78161dccd95bfeb14e07d45bb0eb8..024b57e7e3bcdfcf07ad5f6a159656aa780130cf 100644
--- a/src/providers/ipa/ipa_access.h
+++ b/src/providers/ipa/ipa_access.h
@@ -64,7 +64,6 @@ struct hbac_ctx {
     struct sysdb_attrs *ipa_host;
 
     /* Rules */
-    bool get_deny_rules;
     size_t rule_count;
     struct sysdb_attrs **rules;
 
diff --git a/src/providers/ipa/ipa_common.h b/src/providers/ipa/ipa_common.h
index 33085197c2a4807d4546289ead4c30d891d0d2c0..fb36c702bee2e21860d64e2030f6a0c2b85f564e 100644
--- a/src/providers/ipa/ipa_common.h
+++ b/src/providers/ipa/ipa_common.h
@@ -47,7 +47,6 @@ enum ipa_basic_opt {
     IPA_KRB5_REALM,
     IPA_HBAC_REFRESH,
     IPA_SELINUX_REFRESH,
-    IPA_HBAC_DENY_METHOD,
     IPA_HBAC_SUPPORT_SRCHOST,
     IPA_AUTOMOUNT_LOCATION,
     IPA_RANGES_SEARCH_BASE,
diff --git a/src/providers/ipa/ipa_hbac_common.c b/src/providers/ipa/ipa_hbac_common.c
index a7e338e995de0f2e4142132c056476bc301d80cc..72a620ef0971a8bc657bd7bda3f61b4abdd614ee 100644
--- a/src/providers/ipa/ipa_hbac_common.c
+++ b/src/providers/ipa/ipa_hbac_common.c
@@ -403,21 +403,18 @@ static errno_t
 hbac_eval_user_element(TALLOC_CTX *mem_ctx,
                        struct sss_domain_info *domain,
                        const char *username,
-                       bool deny_rules,
                        struct hbac_request_element **user_element);
 
 static errno_t
 hbac_eval_service_element(TALLOC_CTX *mem_ctx,
                           struct sss_domain_info *domain,
                           const char *servicename,
-                          bool deny_rules,
                           struct hbac_request_element **svc_element);
 
 static errno_t
 hbac_eval_host_element(TALLOC_CTX *mem_ctx,
                        struct sss_domain_info *domain,
                        const char *hostname,
-                       bool deny_rules,
                        struct hbac_request_element **host_element);
 
 static errno_t
@@ -456,18 +453,15 @@ hbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,
             goto done;
         }
         ret = hbac_eval_user_element(eval_req, user_dom, pd->user,
-                                     hbac_ctx->get_deny_rules,
                                      &eval_req->user);
     } else {
         ret = hbac_eval_user_element(eval_req, domain, pd->user,
-                                     hbac_ctx->get_deny_rules,
                                      &eval_req->user);
     }
     if (ret != EOK) goto done;
 
     /* Get the PAM service and service groups */
     ret = hbac_eval_service_element(eval_req, domain, pd->service,
-                                    hbac_ctx->get_deny_rules,
                                     &eval_req->service);
     if (ret != EOK) goto done;
 
@@ -484,7 +478,6 @@ hbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,
     }
 
     ret = hbac_eval_host_element(eval_req, domain, rhost,
-                                 hbac_ctx->get_deny_rules,
                                  &eval_req->srchost);
     if (ret != EOK) goto done;
 
@@ -498,7 +491,6 @@ hbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,
     }
 
     ret = hbac_eval_host_element(eval_req, domain, thost,
-                                 hbac_ctx->get_deny_rules,
                                  &eval_req->targethost);
     if (ret != EOK) goto done;
 
@@ -515,7 +507,6 @@ static errno_t
 hbac_eval_user_element(TALLOC_CTX *mem_ctx,
                        struct sss_domain_info *domain,
                        const char *username,
-                       bool deny_rules,
                        struct hbac_request_element **user_element)
 {
     errno_t ret;
@@ -573,15 +564,9 @@ hbac_eval_user_element(TALLOC_CTX *mem_ctx,
         ret = get_ipa_groupname(users->groups, domain->sysdb, member_dn,
                                 &users->groups[num_groups]);
         if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) {
-            if (deny_rules) {
-                DEBUG(SSSDBG_OP_FAILURE, "Parse error on [%s]: %s\n",
-                      member_dn, sss_strerror(ret));
-                goto done;
-            } else {
-                DEBUG(SSSDBG_MINOR_FAILURE,
-                      "Skipping malformed entry [%s]\n", member_dn);
-                continue;
-            }
+            DEBUG(SSSDBG_MINOR_FAILURE,
+                    "Skipping malformed entry [%s]\n", member_dn);
+            continue;
         } else if (ret == EOK) {
             DEBUG(SSSDBG_TRACE_LIBS, "Added group [%s] for user [%s]\n",
                       users->groups[num_groups], users->name);
@@ -617,7 +602,6 @@ static errno_t
 hbac_eval_service_element(TALLOC_CTX *mem_ctx,
                           struct sss_domain_info *domain,
                           const char *servicename,
-                          bool deny_rules,
                           struct hbac_request_element **svc_element)
 {
     errno_t ret;
@@ -689,16 +673,9 @@ hbac_eval_service_element(TALLOC_CTX *mem_ctx,
                                        (const char *)el->values[i].data,
                                        &name);
         if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) {
-            if (deny_rules) {
-                DEBUG(SSSDBG_OP_FAILURE, "Parse error on [%s]: %s\n",
-                                         (const char *)el->values[i].data,
-                                         sss_strerror(ret));
-                goto done;
-            } else {
-                DEBUG(SSSDBG_MINOR_FAILURE, "Skipping malformed entry [%s]\n",
-                                            (const char *)el->values[i].data);
-                continue;
-            }
+            DEBUG(SSSDBG_MINOR_FAILURE, "Skipping malformed entry [%s]\n",
+                                        (const char *)el->values[i].data);
+            continue;
         }
 
         /* ERR_UNEXPECTED_ENTRY_TYPE means we had a memberOf entry that wasn't a
@@ -727,7 +704,6 @@ static errno_t
 hbac_eval_host_element(TALLOC_CTX *mem_ctx,
                        struct sss_domain_info *domain,
                        const char *hostname,
-                       bool deny_rules,
                        struct hbac_request_element **host_element)
 {
     errno_t ret;
@@ -807,16 +783,9 @@ hbac_eval_host_element(TALLOC_CTX *mem_ctx,
                                     (const char *)el->values[i].data,
                                     &name);
         if (ret != EOK && ret != ERR_UNEXPECTED_ENTRY_TYPE) {
-            if (deny_rules) {
-                DEBUG(SSSDBG_OP_FAILURE, "Parse error on [%s]: %s\n",
-                                         (const char *)el->values[i].data,
-                                         sss_strerror(ret));
-                goto done;
-            } else {
-                DEBUG(SSSDBG_MINOR_FAILURE, "Skipping malformed entry [%s]\n",
-                                            (const char *)el->values[i].data);
-                continue;
-            }
+            DEBUG(SSSDBG_MINOR_FAILURE, "Skipping malformed entry [%s]\n",
+                                        (const char *)el->values[i].data);
+            continue;
         }
 
         /* ERR_UNEXPECTED_ENTRY_TYPE means we had a memberOf entry that wasn't a
diff --git a/src/providers/ipa/ipa_hbac_rules.c b/src/providers/ipa/ipa_hbac_rules.c
index 497eee612be8e2a93c91f9b7fc598e1793b84949..ffef6dc4ce4229f2063d1b00308892bd3765f398 100644
--- a/src/providers/ipa/ipa_hbac_rules.c
+++ b/src/providers/ipa/ipa_hbac_rules.c
@@ -49,7 +49,6 @@ ipa_hbac_rule_info_done(struct tevent_req *subreq);
 
 struct tevent_req *
 ipa_hbac_rule_info_send(TALLOC_CTX *mem_ctx,
-                        bool get_deny_rules,
                         struct tevent_context *ev,
                         struct sdap_handle *sh,
                         struct sdap_options *opts,
@@ -116,25 +115,15 @@ ipa_hbac_rule_info_send(TALLOC_CTX *mem_ctx,
     state->attrs[13] = IPA_HOST_CATEGORY;
     state->attrs[14] = NULL;
 
-    if (get_deny_rules) {
-        rule_filter = talloc_asprintf(tmp_ctx,
-                                      "(&(objectclass=%s)"
-                                      "(%s=%s)(|(%s=%s)(%s=%s)",
-                                      IPA_HBAC_RULE,
-                                      IPA_ENABLED_FLAG, IPA_TRUE_VALUE,
-                                      IPA_HOST_CATEGORY, "all",
-                                      IPA_MEMBER_HOST, host_dn_clean);
-    } else {
-        rule_filter = talloc_asprintf(tmp_ctx,
-                                      "(&(objectclass=%s)"
-                                      "(%s=%s)(%s=%s)"
-                                      "(|(%s=%s)(%s=%s)",
-                                      IPA_HBAC_RULE,
-                                      IPA_ENABLED_FLAG, IPA_TRUE_VALUE,
-                                      IPA_ACCESS_RULE_TYPE, IPA_HBAC_ALLOW,
-                                      IPA_HOST_CATEGORY, "all",
-                                      IPA_MEMBER_HOST, host_dn_clean);
-    }
+    rule_filter = talloc_asprintf(tmp_ctx,
+                                  "(&(objectclass=%s)"
+                                  "(%s=%s)(%s=%s)"
+                                  "(|(%s=%s)(%s=%s)",
+                                  IPA_HBAC_RULE,
+                                  IPA_ENABLED_FLAG, IPA_TRUE_VALUE,
+                                  IPA_ACCESS_RULE_TYPE, IPA_HBAC_ALLOW,
+                                  IPA_HOST_CATEGORY, "all",
+                                  IPA_MEMBER_HOST, host_dn_clean);
     if (rule_filter == NULL) {
         ret = ENOMEM;
         goto immediate;
diff --git a/src/providers/ipa/ipa_hbac_rules.h b/src/providers/ipa/ipa_hbac_rules.h
index 31ff304804668fd7c3b204eac00370da1248a2ad..732ea483e5385d20a7874370fa7b07270e562b98 100644
--- a/src/providers/ipa/ipa_hbac_rules.h
+++ b/src/providers/ipa/ipa_hbac_rules.h
@@ -26,7 +26,6 @@
 /* From ipa_hbac_rules.c */
 struct tevent_req *
 ipa_hbac_rule_info_send(TALLOC_CTX *mem_ctx,
-                        bool get_deny_rules,
                         struct tevent_context *ev,
                         struct sdap_handle *sh,
                         struct sdap_options *opts,
diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h
index 66af648583e552d7edd932f6bb5a2c3bef107e51..f2f164bc3cc6b6e13c30dbc6f5b37a03b4c5e289 100644
--- a/src/providers/ipa/ipa_opts.h
+++ b/src/providers/ipa/ipa_opts.h
@@ -44,7 +44,6 @@ struct dp_option ipa_basic_opts[] = {
     { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING},
     { "ipa_hbac_refresh", DP_OPT_NUMBER, { .number = 5 }, NULL_NUMBER },
     { "ipa_selinux_refresh", DP_OPT_NUMBER, { .number = 5 }, NULL_NUMBER },
-    { "ipa_hbac_treat_deny_as", DP_OPT_STRING, { "DENY_ALL" }, NULL_STRING },
     { "ipa_hbac_support_srchost", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "ipa_automount_location", DP_OPT_STRING, { "default" }, NULL_STRING },
     { "ipa_ranges_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
diff --git a/src/providers/ipa/ipa_selinux.c b/src/providers/ipa/ipa_selinux.c
index 516e31a196731fdff9e8bc9452cbc97e1abd807d..3e9efee325f518846dff8b87d4f513b5e5a5ff89 100644
--- a/src/providers/ipa/ipa_selinux.c
+++ b/src/providers/ipa/ipa_selinux.c
@@ -1557,7 +1557,7 @@ static void ipa_get_selinux_maps_done(struct tevent_req *subreq)
 
         DEBUG(SSSDBG_TRACE_FUNC, "SELinux maps referenced an HBAC rule. "
               "Need to refresh HBAC rules\n");
-        subreq = ipa_hbac_rule_info_send(state, false, state->be_ctx->ev,
+        subreq = ipa_hbac_rule_info_send(state, state->be_ctx->ev,
                                          sdap_id_op_handle(state->op),
                                          id_ctx->sdap_id_ctx->opts,
                                          state->selinux_ctx->hbac_search_bases,
-- 
2.1.0



More information about the sssd-devel mailing list