DESKPROFILE: Add checks for user and host category

[fidencio]

freeipa-deskprofile-plugin can have both user and host category set as
"all" and when it happens, no users and groups or hosts or hostgroups
are going to be set.

Let's treat this expected (but so far missed) situation on SSSD side.

Resolves:
https://pagure.io/SSSD/sssd/issue/3449

Signed-off-by: Fabiano Fidêncio fidencio@redhat.com

[fidencio]

Steps to reproduce the issue:

1. git clone https://github.com/fidencio/fleet-commander-vagans
2. In the project's folder do: cd fleet-commander; vagrant up
3. Once the VMs are provisioned, access cockpit: https://master.ipa.example:9090/
4. Click in the "FleetCommander" tab
5. Close the windows that will open
6. Click in "Add Profile"
7. Add a profile without filling out Hosts and Hostgroups
8. From the fleet-commander folder, do: vagrant ssh ipaclient
   8.1: ssh to the machine using admin's user: ssh -l admin localhost
   8.2: Close the admin session
   8.3 A root, take a look at journalctl -xe and a message about a crash will be seen.

With the patch, 8.3 won't happen and your profile will be downloaded to /var/lib/deskprofile/ipa.example/admin/

NOTE: If your way to test it is through a fedpkg build, be aware of: https://bugzilla.redhat.com/show_bug.cgi?id=1536854

[jhrozek]

Just change the string comparison, please.

[jhrozek]

I have one nitpick here, the IPA HBAC code checks the category with strcasecmp, can we do the same here? Otherwise LGTM and the code was demonstrated to me (and a room full of people) to work

[fidencio]

Patch has been updated, thanks for the review.

[jhrozek]

I have no more requests, thank you, ack.

[jhrozek]

Gah, no, sorry, I found another nitpick :-(

[jhrozek]

The allocations you added are not checked against ENOMEM. Which reminds me to also run Coverity..becuase Coverity might complain that we check talloc retval N times, but not here.

[fidencio]

Here are the changes introduced in the last patch:

[ffidenci@pessoa x86_64]$ git diff
diff --git a/src/providers/ipa/ipa_deskprofile_rules_util.c b/src/providers/ipa/ipa_deskprofile_rules_util.c
index ffcb5c846..01b7d0527 100644
--- a/src/providers/ipa/ipa_deskprofile_rules_util.c
+++ b/src/providers/ipa/ipa_deskprofile_rules_util.c
@@ -779,7 +779,22 @@ ipa_deskprofile_rules_save_rule_to_disk(
 
     if (usercat != NULL && strcasecmp(usercat, "all") == 0) {
         user_prio = talloc_strdup(tmp_ctx, rule_prio);
+        if (user_prio == NULL) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Failed to allocate the user priority "
+                  "when user category is \"all\"\n");
+            ret = ENOMEM;
+            goto done;
+        }
+
         group_prio = talloc_strdup(tmp_ctx, rule_prio);
+        if (group_prio == NULL) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Failed to allocate the group priority "
+                  "when user category is \"all\"\n");
+            ret = ENOMEM;
+            goto done;
+        }
     } else {
         ret = ipa_deskprofile_rule_check_memberuser(tmp_ctx, domain, rule,
                                                     rule_name, rule_prio,
@@ -795,7 +810,22 @@ ipa_deskprofile_rules_save_rule_to_disk(
 
     if (hostcat != NULL && strcasecmp(hostcat, "all") == 0) {
         host_prio = talloc_strdup(tmp_ctx, rule_prio);
+        if (host_prio == NULL) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Failed to allocate the host priority "
+                  "when host category is \"all\"\n");
+            ret = ENOMEM;
+            goto done;
+        }
+
         hostgroup_prio = talloc_strdup(tmp_ctx, rule_prio);
+        if (hostgroup_prio == NULL) {
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Failed to allocate the hostgroup priority "
+                  "when host category is \"all\"\n");
+            ret = ENOMEM;
+            goto done;
+        }
     } else {
         ret = ipa_deskprofile_rule_check_memberhost(tmp_ctx, domain, rule,
                                                     rule_name, rule_prio,

[jhrozek]

OK, Coverity came clean, thank you.

[jhrozek]

• master: b72e444