fidencio's pull request #11: "SECRETS: Don't remove a container when it has children" was synchronize
See the full pull-request at https://github.com/SSSD/sssd/pull/11 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/11/head:pr11 git checkout pr11
From e5478ec65b13dbcfb093a4486ade0ca1ef3f7616 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <fiden...@redhat.com> Date: Thu, 1 Sep 2016 12:04:30 +0200 Subject: [PATCH] SECRETS: Don't remove a container when it has children MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's return and log an error in case the container to be removed has children. The approach taken introduced at least one new search in every delete operation. As far as I understand searching in the BASE scope is quite cheap and that's the reason I decided to just do the search in the ONELEVEL scope when the deleted dn is for sure a container. Resolves: https://fedorahosted.org/sssd/ticket/3167 Signed-off-by: Fabiano Fidêncio <fiden...@redhat.com> --- src/responder/secrets/local.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/src/responder/secrets/local.c b/src/responder/secrets/local.c index ac3049b..9d2a997 100644 --- a/src/responder/secrets/local.c +++ b/src/responder/secrets/local.c @@ -372,13 +372,41 @@ int local_db_delete(TALLOC_CTX *mem_ctx, const char *req_path) { struct ldb_dn *dn; + static const char *attrs[] = { NULL }; + struct ldb_result *res = NULL; int ret; ret = local_db_dn(mem_ctx, lctx->ldb, req_path, &dn); if (ret != EOK) return ret; - ret = ldb_delete(lctx->ldb, dn); - return sysdb_error_to_errno(ret); + ret = ldb_search(lctx->ldb, mem_ctx, &res, dn, LDB_SCOPE_BASE, + attrs, LOCAL_CONTAINER_FILTER); + if (ret != EOK) return ret; + + if (res->count == 1) { + talloc_free(res); + res = NULL; + + ret = ldb_search(lctx->ldb, mem_ctx, &res, dn, LDB_SCOPE_ONELEVEL, + attrs, LOCAL_SIMPLE_FILTER); + if (ret != EOK) return ret; + + if (res->count != 0) { + ret = EINVAL; + DEBUG(SSSDBG_OP_FAILURE, + "Failed to remove '%s': Container is not empty\n", + ldb_dn_get_linearized(dn)); + + goto done; + } + } + + ret = sysdb_error_to_errno(ldb_delete(lctx->ldb, dn)); + +done: + talloc_free(res); + + return ret; } int local_db_create(TALLOC_CTX *mem_ctx,
_______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org
