Emit journal alert about ldap_sudo_search_base only if sudo provider is enabled - #9079
Open
scabrero wants to merge 2 commits into
Open
Emit journal alert about ldap_sudo_search_base only if sudo provider is enabled#9079scabrero wants to merge 2 commits into
scabrero wants to merge 2 commits into
Conversation
Signed-off-by: Samuel Cabrero <scabrero@suse.com>
When ldap_sudo_search_base falls back to the root DN, a log alert is always raised, even if the sudo provider is explicitly disabled by setting sudo_provider to 'none'. This produces unnecessary noise in monitoring systems. Until now, the only way to avoid the alert was to point ldap_sudo_search_base at some subtree, which makes little sense when sudo is not used at all. Setting sudo_provider to 'none' is the more natural way to silence the alert, and it has the added benefit of fully disabling the sudo data provider. Only emit the alert when the sudo target is actually enabled. Signed-off-by: Samuel Cabrero <scabrero@suse.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The recent patch for CVE-2026-14474 introduced a syslog alert that is emitted whenever
ldap_sudo_search_baseis not configured. The problem is that this alert triggers even when the sudo provider is not being used at all and is explicitly disabled viasudo_provider = none. This creates unnecessary noise in monitoring systems.This PR fixes the issue by checking if the sudo provider has been explicitly disabled in order to skip emitting the alert. The domain log message will continue to be recorded in all cases.