URL: https://github.com/SSSD/sssd/pull/138 Author: justin-stephenson Title: #138: IPA: Skip conflict entries associated with sudo rules Action: opened
PR body: """ SSSD retrieves sudo rule information from the IPA LDAP tree, conflict entries will cause problems for SSSD and disallow sudo access when SSSD code is parsing entries associated with sudo rules. This PR sets a skip_entry boolean when it is appropriate and skips over these conflict entries.
Ticket: https://fedorahosted.org/sssd/ticket/3288
Reproducer steps: Create host conflict entry and associate it with a sudo rule that is assigned to certain hosts, attempt to sudo as IDM user. I had some difficulty attempting to force replication issues causing the creation of a conflict entry, the below manual ldapmodify steps will work also:
- Retrieve the DN of the sudoRule
`# ipa sudorule-find --all --raw | grep 'dn: ' dn: ipaUniqueID=e9025c46-ddab-11e6-9096-525400af7498,cn=sudorules,cn=sudo,dc=jstephen,dc=local`
- Run ldapmodify similar to below
dn: ipaUniqueID=e9025c46-ddab-11e6-9096-525400af7498,cn=sudorules,cn=sudo,dc=jstephen,dc=local changetype: modify add: memberHost memberHost: fqdn=testhost.jstephen.local+nsuniqueid=cb3d7383-ddb511e6-8c9996c1-71a1e36a,cn=computers,cn=accounts,dc=jstephen,dc=local """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/138/head:pr138 git checkout pr138
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
centos-ci commented: """ Can one of the admins verify this patch? """
See the full comment at https://github.com/SSSD/sssd/pull/138#issuecomment-275256026
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
centos-ci commented: """ Can one of the admins verify this patch? """
See the full comment at https://github.com/SSSD/sssd/pull/138#issuecomment-275256029
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
sumit-bose commented: """ ok to test """
See the full comment at https://github.com/SSSD/sssd/pull/138#issuecomment-275330980
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
Label: +Changes requested
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
jhrozek commented: """ Hi Justin, thank you very much for th epatches and sorry the review took so long.
In general I like the approach, an extra parameter is probably the right way since the conv_ functions return a string themselves. There is one compilation error though: ``` /sssd/src/providers/ipa/ipa_sudo_conversion.c: In function ‘convert_runasextusergroup’: /sssd/src/providers/ipa/ipa_sudo_conversion.c:877:33: warning: parameter ‘skip_entry’ set but not used [-Wunused-but-set-parameter] bool *skip_entry) ^~~~~~~~~~ ```
I think just removing the parameter is OK since we don't check for unused parameters. """
See the full comment at https://github.com/SSSD/sssd/pull/138#issuecomment-277067646
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
jhrozek commented: """ Hi Justin, thank you very much for th epatches and sorry the review took so long.
In general I like the approach, an extra parameter is probably the right way since the conv_ functions return a string themselves. There is one compilation error though: ``` /sssd/src/providers/ipa/ipa_sudo_conversion.c: In function ‘convert_runasextusergroup’: /sssd/src/providers/ipa/ipa_sudo_conversion.c:877:33: warning: parameter ‘skip_entry’ set but not used [-Wunused-but-set-parameter] bool *skip_entry) ^~~~~~~~~~ ```
I think just removing the parameter is OK since we don't check for unused parameters. """
See the full comment at https://github.com/SSSD/sssd/pull/138#issuecomment-277067646
URL: https://github.com/SSSD/sssd/pull/138 Author: justin-stephenson Title: #138: IPA: Skip conflict entries associated with sudo rules Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/138/head:pr138 git checkout pr138
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
justin-stephenson commented: """ Thanks a lot for the patch review Jakub, PR updated as you requested. """
See the full comment at https://github.com/SSSD/sssd/pull/138#issuecomment-277340528
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
Label: -Changes requested
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
jhrozek commented: """ I also ran IPA upstream automated tests in addition to some manual testing and no new regressions were found -> ACK
Thank you for the patch! """
See the full comment at https://github.com/SSSD/sssd/pull/138#issuecomment-277784097
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
Label: +Accepted
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
lslebodn commented: """ The first two matches need to be squashed otherwise it would break possibility to use git bisect ``` ./src/providers/ipa/ipa_sudo_conversion.c: In function ‘convert_attributes’: ./src/providers/ipa/ipa_sudo_conversion.c:914:91: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types] {SYSDB_IPA_SUDORULE_HOST, SYSDB_SUDO_CACHE_AT_HOST , convert_host}, ^~~~~~~~~~~~ ./src/providers/ipa/ipa_sudo_conversion.c:914:91: note: (near initialization for ‘table[1].conv_fn’) ./src/providers/ipa/ipa_sudo_conversion.c:915:91: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types] {SYSDB_IPA_SUDORULE_USER, SYSDB_SUDO_CACHE_AT_USER , convert_user_fqdn}, ^~~~~~~~~~~~~~~~~ ./src/providers/ipa/ipa_sudo_conversion.c:915:91: note: (near initialization for ‘table[2].conv_fn’) ./src/providers/ipa/ipa_sudo_conversion.c:916:91: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types] {SYSDB_IPA_SUDORULE_RUNASUSER, SYSDB_SUDO_CACHE_AT_RUNASUSER , convert_user}, ^~~~~~~~~~~~ ./src/providers/ipa/ipa_sudo_conversion.c:916:91: note: (near initialization for ‘table[3].conv_fn’) ./src/providers/ipa/ipa_sudo_conversion.c:917:91: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types] {SYSDB_IPA_SUDORULE_RUNASGROUP, SYSDB_SUDO_CACHE_AT_RUNASGROUP , convert_group}, ^~~~~~~~~~~~~ ./src/providers/ipa/ipa_sudo_conversion.c:917:91: note: (near initialization for ‘table[4].conv_fn’) ./src/providers/ipa/ipa_sudo_conversion.c:922:91: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types] {SYSDB_IPA_SUDORULE_CMDCATEGORY, SYSDB_SUDO_CACHE_AT_COMMAND , convert_cat}, ^~~~~~~~~~~ ./src/providers/ipa/ipa_sudo_conversion.c:922:91: note: (near initialization for ‘table[9].conv_fn’) ./src/providers/ipa/ipa_sudo_conversion.c:923:91: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types] {SYSDB_IPA_SUDORULE_HOSTCATEGORY, SYSDB_SUDO_CACHE_AT_HOST , convert_cat}, ^~~~~~~~~~~ ./src/providers/ipa/ipa_sudo_conversion.c:923:91: note: (near initialization for ‘table[10].conv_fn’) ./src/providers/ipa/ipa_sudo_conversion.c:924:91: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types] {SYSDB_IPA_SUDORULE_USERCATEGORY, SYSDB_SUDO_CACHE_AT_USER , convert_cat}, ^~~~~~~~~~~ ./src/providers/ipa/ipa_sudo_conversion.c:924:91: note: (near initialization for ‘table[11].conv_fn’) ./src/providers/ipa/ipa_sudo_conversion.c:925:91: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types] {SYSDB_IPA_SUDORULE_RUNASUSERCATEGORY, SYSDB_SUDO_CACHE_AT_RUNASUSER , convert_cat}, ^~~~~~~~~~~ .src/providers/ipa/ipa_sudo_conversion.c:925:91: note: (near initialization for ‘table[12].conv_fn’) .src/providers/ipa/ipa_sudo_conversion.c:926:91: error: initialization from incompatible pointer type [-Werror=incompatible-pointer-types] {SYSDB_IPA_SUDORULE_RUNASGROUPCATEGORY, SYSDB_SUDO_CACHE_AT_RUNASGROUP , convert_cat}, ^~~~~~~~~~~ ./src/providers/ipa/ipa_sudo_conversion.c:926:91: note: (near initialization for ‘table[13].conv_fn’) ``` """
See the full comment at https://github.com/SSSD/sssd/pull/138#issuecomment-278003621
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
Label: -Accepted
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
Label: +Changes requested
URL: https://github.com/SSSD/sssd/pull/138 Author: justin-stephenson Title: #138: IPA: Skip conflict entries associated with sudo rules Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/138/head:pr138 git checkout pr138
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
justin-stephenson commented: """ Hi Lukas, I squashed the two patches together but now there is a check failing. Could you help me understand if I am missing something? """
See the full comment at https://github.com/SSSD/sssd/pull/138#issuecomment-278051485
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
lslebodn commented: """ That was just a problem with repositories otherwise installation of dependencies would not fail. ``` install-deps: failure 00:00:30 ci-install-deps.log FAILURE ```
"""
See the full comment at https://github.com/SSSD/sssd/pull/138#issuecomment-278054313
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
lslebodn commented: """ master: * 1404f3aa541849d880cce591584ba1580014cb50 * d0aae3c1e87e2e51ab178b7b343261443094a974
sssd-1-14: * db0c5135add7c93638794abd8c7f04a1c5d74186 * c4c47ca961029dbbccf7aab0794c31ab97bc10e0
LS
"""
See the full comment at https://github.com/SSSD/sssd/pull/138#issuecomment-278055669
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
Label: +Pushed
URL: https://github.com/SSSD/sssd/pull/138 Title: #138: IPA: Skip conflict entries associated with sudo rules
Label: -Changes requested
URL: https://github.com/SSSD/sssd/pull/138 Author: justin-stephenson Title: #138: IPA: Skip conflict entries associated with sudo rules Action: closed
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/138/head:pr138 git checkout pr138
sssd-devel@lists.fedorahosted.org
-
fidencio -
jhrozek
-
justin-stephenson
-
lslebodn