GPO: Duplicated error message for unreadable GPO

[elkoniu]

In case of unreadable GPO error message has been produced
twice - using sss_log() and DEBUG(). Message priority was
set to SSSDBG_CRIT_FAILURE which is not true in this case
and sidefect was message broadcast over users terminals.

Error message duplication has been removed and error
level changed to SSSDBG_MINOR_FAILURE.

Resolves:
https://pagure.io/SSSD/sssd/issue/4133

[pbrezina]

Doesn't it always deny access if unreadable GPO is found?

[pbrezina]

We already discussed this on IRC. TLDR this is a critical error unless it is specifically set to ignore it, because it denies access when GPO entry is potentially misconfigured/malformed. In my opinion we should keep logging it to syslog (sss_log()) but provide a correct priority level from SSS_LOG_* instead of incorrectly using SSSDBG_CRIT_FAILURE which translates to emergency syslog level and thus printing the messages also to terminal.

[mzidek-gh]

Just a note that I also agree with @pbrezina that we should keep logging this in syslog. This is indication of potentially serious misconfiguration, so I do not mind if it is loud (but changing the debug message to MINOR from CRIT is OK).

[elkoniu]

Thanks for input - I changed log level to SSS_LOG_ERR and kept syslog logging as suggested.

[pbrezina]

Thank you. Ack.

[pbrezina]

This patch definitely makes sense so I'm going to push it tomorrow if there are no objections. But I'd like @mzidek-gh to answer questions in the ticket before closing the ticket.

[pbrezina]

• master
  • 9188aa1 - GPO: Duplicated error message for unreadable GPO