[PATCH] Fix queuing bug in proxy provider
by Stephen Gallagher
We weren't zeroing out the proxy_auth_ctx when we created it, so
the 'running' element was sometimes being filled with garbage data
that exceeded the maximum number of child processes. This meant
that no requests were ever sent to the child processes.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
13 years, 11 months
[PATCH] Use new schema for HBAC service checks
by Sumit Bose
Hi,
here are two patches for the IPA access provider. The first one checks
if the rule is enable or not the second should fix #475 by using the new
service attribute and object in the IPA schema. Although the code should
handle service groups it currently does not work, because the IPA server
does not set the memberOf attribute to the service objects. If this is
fixed on the server side service groups should work, too.
There are some areas of the code which are begging for refactoring, but
I think this is a post-1.2 task.
bye,
Sumit
13 years, 11 months
[PATCHES] Handle proxy provider PAM requests in a child process
by Stephen Gallagher
Blocker for the 1.2.0 release on Monday. Please review immediately.
These patches depend on Sumit's "Remove signal event if child was
terminated by a signal" patch.
Patch 0001: Make parse_args() public. (From Sumit)
Patch 0002: Make data provider id_callback public.
Patch 0003: Fix error reporting for be_pam_handler
Patch 0004: Proxy provider PAM handling in child process
This patch adds a new tevent_req to the proxy provider, which will
spawn short-lived child processes to handle PAM requests. These
processes then call the proxied PAM stack and return the results
via SBUS method reply. Once it is returned, the parent process
kills the child.
There is a maximum of ten child processes running simultaneously,
after which requests will be queued for sending once a child slot
frees up. The maximum processes will be made configurable at a
later date (as this would violate string freeze).
Most of the content of proxy_child.c remains from Sumit's earlier work
on this problem. The changes in proxy.c are a complete rewrite.
Resolves:
https://fedorahosted.org/sssd/ticket/471
https://bugzilla.redhat.com/show_bug.cgi?id=590134
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
13 years, 11 months
[PATCH] Do not modify IPA_DOMAIN when setting Kerberos realm
by Sumit Bose
Hi,
dp_opt_get_string() does not return a new copy of the string but just a
reference to the stored value. Modifying the return value will modify
the stored value. This patch copies the value before upper-casing it for
the Kerberos realm.
bye,
Sumit
13 years, 11 months
[PATCH] Remove signal event if child was terminated by a signal
by Sumit Bose
Hi,
currently we remove the signal event and call the callbacks only if the
child finished normally, i.e. not killed by a signal. This patch changes
this and updates ipa_dyndns_child_handler(), currently the only
callback, accordingly.
bye,
Sumit
13 years, 11 months
[patch] Avoid bashism in the configure script
by Petter Reinholdtsen
I tried to build sssd version 1.1.92 in Debian/Sid, and the build
failed. While investigating, I ran across bashism in the configure
script. /bin/sh in Debian is dash, and its test command do not
recognize the '==' bashism. Here is a patch to try to solve the ones
I found.
--- sssd-1.1.92.orig/src/conf_macros.m4
+++ sssd-1.1.92/src/conf_macros.m4
@@ -123,7 +123,7 @@
[],
with_manpages=yes
)
- if test x"$with_manpages" == xyes; then
+ if test x"$with_manpages" = xyes; then
HAVE_MANPAGES=1
AC_SUBST(HAVE_MANPAGES)
fi
@@ -167,7 +167,7 @@
[],
with_python_bindings=yes
)
- if test x"$with_python_bindings" == xyes; then
+ if test x"$with_python_bindings" = xyes; then
HAVE_PYTHON_BINDINGS=1
AC_SUBST(HAVE_PYTHON_BINDINGS)
fi
@@ -183,7 +183,7 @@
[],
with_selinux=yes
)
- if test x"$with_selinux" == xyes; then
+ if test x"$with_selinux" = xyes; then
HAVE_SELINUX=1
AC_SUBST(HAVE_SELINUX)
AC_DEFINE_UNQUOTED(HAVE_SELINUX, 1, [Build with SELinux support])
@@ -212,7 +212,7 @@
[],
with_nscd=yes
)
- if test x"$with_nscd" == xyes; then
+ if test x"$with_nscd" = xyes; then
AC_DEFINE_UNQUOTED(HAVE_NSCD, 1, [flush nscd cache after local domain operations])
fi
])
@@ -226,7 +226,7 @@
[],
with_semanage=yes
)
- if test x"$with_semanage" == xyes; then
+ if test x"$with_semanage" = xyes; then
HAVE_SEMANAGE=1
AC_SUBST(HAVE_SEMANAGE)
AC_DEFINE_UNQUOTED(HAVE_SEMANAGE, 1, [Build with SELinux support])
--- sssd-1.1.92.orig/src/external/platform.m4
+++ sssd-1.1.92/src/external/platform.m4
@@ -3,10 +3,10 @@
)
osname=""
if test x"$with_os" != x ; then
- if test x"$with_os" == xfedora -o \
- x"$with_os" == xredhat -o \
- x"$with_os" == xsuse -o \
- x"$with_os" == xdebian ; then
+ if test x"$with_os" = xfedora || \
+ test x"$with_os" = xredhat || \
+ test x"$with_os" = xsuse || \
+ test x"$with_os" = xdebian ; then
osname=$with_os
else
AC_MSG_ERROR([Illegal value -$with_os- for option --with-os])
@@ -27,10 +27,10 @@
AC_MSG_NOTICE([Detected operating system type: $osname])
fi
-AM_CONDITIONAL([HAVE_FEDORA], [test x"$osname" == xfedora])
-AM_CONDITIONAL([HAVE_REDHAT], [test x"$osname" == xredhat])
-AM_CONDITIONAL([HAVE_SUSE], [test x"$osname" == xsuse])
-AM_CONDITIONAL([HAVE_DEBIAN], [test x"$osname" == xdebian])
+AM_CONDITIONAL([HAVE_FEDORA], [test x"$osname" = xfedora])
+AM_CONDITIONAL([HAVE_REDHAT], [test x"$osname" = xredhat])
+AM_CONDITIONAL([HAVE_SUSE], [test x"$osname" = xsuse])
+AM_CONDITIONAL([HAVE_DEBIAN], [test x"$osname" = xdebian])
AC_CHECK_MEMBERS([struct ucred.pid, struct ucred.uid, struct ucred.gid], , ,
[[#define _GNU_SOURCE
Happy hacking,
--
Petter Reinholdtsen
13 years, 11 months
[PATCH] 0001-Copy-edit-and-format-review-sssd.conf.patch
by David O'Brien
Now that this file is taking on the nature of a help file, I've
attempted to improve its readability, with:
1. Minor layout changes (whitespace between sections)
2. Spell check, inc. s/backend/back end (standardization)
3. General copy-edit
Pretty trivial stuff.
--
David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane
"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.
13 years, 11 months