[PATCHES] Better default logging of access denials
by Sumit Bose
Hi,
in trac ticket #751 it was requested to add syslog messages telling the
admin why access was denied for a specific user with LDAP access
provider.
The following two patches add this for the check based on the shadow
expire attribute and the authorized service check.
bye,
Sumit
13 years, 4 months
[PATCHES] Enumeration fixes
by Sumit Bose
Hi,
based on an issue found by Shanks (#757) I had a closer look at some
parts of the enumeration code in the nss responder and found a different
issue (#758) and some non functional code.
0001: should fix #758.
0002: should fix #757. If only the local provider was configured the
code did not return to the main loop during execution and the callback
of the corresponding tevent request was never called.I think this is a
regression from the introduction of the synchronous sysdb interface. To
fix it I added a timer event which just calls *_step() again to make
sure we always return to the main loop at least once. Of someone knows
of a more elegant solution I'm all ears. Btw. the code cries for
refactoring.
0003: the code arround last_user_enum and last_group_enum was not
functional anymore and the enumeration timeout is handled by
*_result_timeout().
13 years, 4 months
[PATCH] Fix boolean comparison against string
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
These two macros are only ever used as the default value for a call to
confdb_get_bool(), which is expecting a boolean value here. By
coincidence, this resulted in the same behavior as expected (because the
memory location of the string != 0), but it is still incorrect.
Coverity 10082 and 100083
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk0iEQ8ACgkQeiVVYja6o6NHhwCfXUeIr//jaWzvw2+xnUCQTalZ
418AoI4IwukB726gJJQoeFvx99rNIpje
=iJMC
-----END PGP SIGNATURE-----
13 years, 4 months
[PATCHES] Patches for Coverity issues in ding-libs INI
by Dmitri Pal
Hello,
10034
Patch attached
10041
No patch. It is currently fixed on master and on 0.1.x the code is not used.
This issue should be dismissed.
10042
No patch. It is currently fixed on master and on 0.1.x the code is not used.
This issue should be dismissed.
10044
Patch attached
10048
Patch attached. Patch was developed on master but since this code has not changed for a long time
the patch should also apply to the 0.1.x branch. The patch name is "COLLECTION-Initializing-variables-in-test".
10071
Patch attached.
10072
Patch attached.
10073
Patch attached.
10076
Patch attached.
10077
Patch attached.
Also there is an attempt to sort out issues 10078 - 10079. See patch
comments.
The only remaining Coverity issue is:
10075
I want to redo the way we deal with paths to config files across the whole test.
Stay tuned for the patch.
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
13 years, 4 months
SSSD.CONF: Disable caching of Authorization data
by JR Aquino
Might someone be able to tell me how I can completely disable caching in sssd.conf?
I've tweaked the entry cache vars but I don't seem to be getting immediate db searches.
I'm trying to account for:
User exists in hbac posix group.
User is removed from hbac posix group
Should deny ssh login, but instead its permitted.
If I rudely delete all the caches from /var/lib/sss/db/* It will properly deny me access.
Disabling caching or at least disabling the caching of hbac level data would be what I am after.
Thanks!!!
-JR
13 years, 4 months