URL: https://github.com/SSSD/sssd/pull/815 Author: pzirnik Title: #815: fix to not ignore/drop sudo "defaults" rule Action: opened
PR body: """ The "cn=defaults" rule does not require to have a sudoUser attribute, however with latest changes the defaults rule get dropped because of the missing sudoUser attribute. According to sudo ldap schema the attribute sudoUser is only a MAY not a MUST. Also when using the old pam/nss ldap library this is not an issue. I have seen no "cn=defaults" rule until now that does have a sudoUser attribute set, so i count this as a regression. My proposed patch does skip sysdb_sudo_add_lowered_users() if the rule name matches "defaults", which looks like the best possible approach for now. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/815/head:pr815 git checkout pr815
From d81da1e123c090e603cd54224d9e4907b56dc56b Mon Sep 17 00:00:00 2001 From: Paul Zirnik <[email protected]> Date: Fri, 17 May 2019 12:06:26 +0200 Subject: [PATCH] fix to not ignore/drop sudo "defaults" rule --- src/db/sysdb_sudo.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/db/sysdb_sudo.c b/src/db/sysdb_sudo.c index 19ed97b866..fffc4a350a 100644 --- a/src/db/sysdb_sudo.c +++ b/src/db/sysdb_sudo.c @@ -957,9 +957,12 @@ sysdb_sudo_store_rule(struct sss_domain_info *domain, DEBUG(SSSDBG_TRACE_FUNC, "Adding sudo rule %s\n", name); - ret = sysdb_sudo_add_lowered_users(domain, rule); - if (ret != EOK) { - return ret; + /* skip default rules, because they do not have a sudoUser */ + if (strcasecmp(name,"defaults")) { + ret = sysdb_sudo_add_lowered_users(domain, rule); + if (ret != EOK) { + return ret; + } } ret = sysdb_sudo_add_sss_attrs(rule, name, cache_timeout, now);
_______________________________________________ sssd-devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
