From 227dcb12f8cb8bc5f6968bc87d44e1a0bdb08c69 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Thu, 13 May 2010 10:40:52 -0400
Subject: Don't report a fatal error for an HBAC denial

---
 src/providers/ipa/ipa_access.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/providers/ipa/ipa_access.c')

diff --git a/src/providers/ipa/ipa_access.c b/src/providers/ipa/ipa_access.c
index af761fa0..58f937b8 100644
--- a/src/providers/ipa/ipa_access.c
+++ b/src/providers/ipa/ipa_access.c
@@ -91,7 +91,7 @@ static void ipa_access_reply(struct be_req *be_req, int pam_status)
     pd = talloc_get_type(be_req->req_data, struct pam_data);
     pd->pam_status = pam_status;
 
-    if (pam_status == PAM_SUCCESS) {
+    if (pam_status == PAM_SUCCESS || pam_status == PAM_PERM_DENIED) {
         be_req->fn(be_req, DP_ERR_OK, pam_status, NULL);
     } else {
         be_req->fn(be_req, DP_ERR_FATAL, pam_status, NULL);
-- 
cgit