commit: changed selinux policy to support fifos (named pipes)
by Rich Megginson
To ssh://git.fedorahosted.org/git/389/ds.git
c177c34..b2e2a3f master -> master
commit b2e2a3f5294707e1ccf2b25fd281ce3653dac819
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Mon Nov 23 09:48:50 2009 -0800
Allow dirsrv_t to log to a fifo in SELinux policy.
This patch changes the SELinux dirsrv policy to allow ns-slapd to
log to a fifo file.
Author: nkinder (Thanks!)
Tested on RHEL5 i386
diff --git a/selinux/dirsrv.if b/selinux/dirsrv.if
index 80b478f..b8e1a7f 100644
--- a/selinux/dirsrv.if
+++ b/selinux/dirsrv.if
@@ -77,6 +77,7 @@ interface(`dirsrv_manage_log',`
allow $1 dirsrv_var_log_t:dir manage_dir_perms;
allow $1 dirsrv_var_log_t:file manage_file_perms;
+ allow $1 dirsrv_var_log_t:fifo_file: manage_fifo_file_perms;
')
#######################################
diff --git a/selinux/dirsrv.te b/selinux/dirsrv.te
index 60901f2..ef09fb2 100644
--- a/selinux/dirsrv.te
+++ b/selinux/dirsrv.te
@@ -105,6 +105,7 @@ files_var_lib_filetrans(dirsrv_t,dirsrv_var_lib_t, {
file dir sock_file })
# log files
manage_files_pattern(dirsrv_t, dirsrv_var_log_t, dirsrv_var_log_t)
+manage_fifo_files_pattern(dirsrv_t, dirsrv_var_log_t, dirsrv_var_log_t)
allow dirsrv_t dirsrv_var_log_t:dir { setattr };
logging_log_filetrans(dirsrv_t,dirsrv_var_log_t,{ sock_file file dir })
13 years, 10 months
Pushed - Add bounds checking to DN unescape function
by Nathan Kinder
I've pushed this patch under the one-line commit rule. It's also an
issue Noriko and I discussed in private, so she's familiar with the fix
(it's actually a slight variation on a fix she wrote).
13 years, 10 months
Please review: port windows console to 64-bit, 2008, VC9, etc.
by Rich Megginson
1) upgrade doesn't work - so the package will manually remove the old
package and any shortcuts left behind
2) includes the VC runtime merge modules - the old trick of including
the vc runtime .dll doesn't work any more
3) removed all of the brand/vendor/version/etc. specific stuff from the
.wxs file - these are now all supplied and passed in to the build process
4) the package file name is now <brand>-Console-<version>-<platform>.msi
to make it easier to identify, and is more consistent with package
naming on other platforms
13 years, 10 months
passsync
by John Dennis
I looked, albeit it quickly, on the 389 web site for details on how
passsync works, but I didn't find any details only a how-to, so if the
answers to these questions are documented you could just point me to the
doc.
The question arose in the context of one of our field people who wants
to use FreeRADIUS backed against a 389 LDAP server which is pulling
passwords from AD using passsync.
FreeRADIUS needs ntlm hashes, but it can compute the ntlm hash from a
cleartext password if one is available (but it's better if the ntlm hash
is available in an attribute).
My understanding is that passsync will update 389 with a cleartext
password only. Is that correct? Is it possible to have passsync also
update the ntlm hash by either pulling from AD or by computing it from
the cleartext at the moment it's writing the cleartext into the 389
attributes?
The next relevant issue is how password prefix's are handled. I don't
know if this is a standard or just a convention, but passwords can be
prefixed with their format enclosed in braces, e.g. {clear}, {crypt},
{md5}, etc.
It turns out that FreeRADIUS when it queries a password will only
recognize a clear text password vs. hash if it's prefixed with {clear}
or {cleartext}. Is passsync capable of prepending the password type when
it updates the password attribute?
--
John Dennis <jdennis(a)redhat.com>
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
13 years, 10 months
Problem building 389-ds-base on openSUSE
by Peter Nixon
Hi Guys
I have been attempting to build 389-ds-base 1.2.4 on openSUSE and have found
the configure script makes some assumptions about Berkley DB that are not
valid on SUSE.
The configure script fails with the following error:
configure: checking for db...
checking for --with-db... no
checking for db.h... using /usr/include/db.h
checking for db_create in -ldb-.... no
configure: error: /usr/include/db.h is version . but libdb-. not found
error: Bad exit status from /var/tmp/rpm-tmp.83160 (%build)
On openSUSE the db packages are the following:
# rpm -ql libdb-4_5
/usr/lib/libdb-4.5.so
# rpm -ql libdb-4_5-devel
/usr/include/db.h
/usr/include/db4
/usr/include/db4/db.h
/usr/include/db4/db_185.h
/usr/include/db_185.h
/usr/lib/libdb-4.5.a
/usr/lib/libdb-4.so
/usr/lib/libdb.a
/usr/lib/libdb.so
# cat /usr/include/db.h
#include <db4/db.h>
# cat /etc/SuSE-release
openSUSE 11.2 (i586)
VERSION = 11.2
The attached patch solves this problem for me, but is almost certain to break
things on Fedora. Hopefully someone with better m4 foo than I can fix it
up...
Regards
--
Peter Nixon
http://peternixon.net/
13 years, 10 months