Re: [SSSD] [PATCHES] New DEBUG facility
by Pavel Březina
> On Mon, 2011-08-08 at 07:51 -0400, Pavel Brezina wrote:
>> https://fedorahosted.org/sssd/ticket/925
>>
>> [PATCH 1/2] There are several new macros in util/util.h:
>>
>> - SSSDBG_* to reflect a debug level (same names as in the ticket) -
>> please, don't use magic numbers anymore
>>
>> - DEBUG_MSG(level, function, message) which will format the debug
>> message like "(time) [prg_name] [function] (level): message\n"
>>
>> - DEBUG_IS_SET(level) that you should use to check if the level is
>> allowed to be logged You can use it like: if
>> (DEBUG_IS_SET(SSSDBG_TRACE_LIBS)) {...}
>>
>
> For the most part, this patch is good (one minor nitpick: the comment
> around DEBUG_MSG identifies the DEBUG macro, not the DEBUG_MSG macro)
>
> However, it is very difficult to review. Please break this patch up into
> several:
>
> 1) Creation of the new levels and the macros for converting the old
> versions to them.
> 2) Modification of the DEBUG() macro and creation of the DEBUG_MSG()
> macro
> 3) Conversion of the old DEBUG macros to the new levels
> 4) The unit tests.
>
> This will make it much more digestible for the reviewer.
Done.
>
>> [PATCH 2/2] Changes unresolved debug level value (SSSDBG_UNRESOLVED)
>> from -1 to 0 so DEBUG macro could be reduced by one condition. Anyway,
>> it has a minor effect, every time you want to load debug_level from
>> command line parameters, you have to use following pattern:
>>
>> /* Set debug level to invalid value so we can deside if -d 0 was
>> used. */ debug_level = SSSDBG_INVALID;
>>
>> pc = poptGetContext(argv[0], argc, argv, long_options, 0);
>> while((opt = poptGetNextOpt(pc)) != -1) { ... }
>>
>> debug_level = debug_level != SSSDBG_INVALID ?
>> debug_convert_old_level(debug_level) :
>> SSSDBG_UNRESOLVED; /* Debug level should be loaded from config file. */
>
> I don't actually see any value to this patch.
Well, the value isn't really big.
-1 is 0xFFF... so you have to check against bit map like this:
(debug_level >= 0) && (level & debug_level)
...and I've been told to keep that macro as small as possible. But I'm
aware that it adds more complexity to the code so feel free to refuse
this change.
> Also, wouldn't this
> conflict with compatibility with old settings if 'debug_level = 0' had
> been explicitly set?
Actually, it wouldn't conflict. If you try to put unresolved value in
debug_level, it will be converted to 0x0010 (equiv. to 0 in old format).
It makes problem only if you need to know if the program is run with -d
0 (so we can call every child with this parameter too) or not - and
that's where the above pattern come in.
12 years, 8 months
Re: [SSSD] [PATCHES] New DEBUG facility
by Pavel Březina
> On Mon, 2011-08-08 at 07:51 -0400, Pavel Brezina wrote:
>> https://fedorahosted.org/sssd/ticket/925
>>
>> [PATCH 1/2] There are several new macros in util/util.h:
>>
>> - SSSDBG_* to reflect a debug level (same names as in the ticket) -
>> please, don't use magic numbers anymore
>>
>> - DEBUG_MSG(level, function, message) which will format the debug
>> message like "(time) [prg_name] [function] (level): message\n"
>>
>> - DEBUG_IS_SET(level) that you should use to check if the level is
>> allowed to be logged You can use it like: if
>> (DEBUG_IS_SET(SSSDBG_TRACE_LIBS)) {...}
>>
>
> For the most part, this patch is good (one minor nitpick: the comment
> around DEBUG_MSG identifies the DEBUG macro, not the DEBUG_MSG macro)
>
> However, it is very difficult to review. Please break this patch up into
> several:
>
> 1) Creation of the new levels and the macros for converting the old
> versions to them.
> 2) Modification of the DEBUG() macro and creation of the DEBUG_MSG()
> macro
> 3) Conversion of the old DEBUG macros to the new levels
> 4) The unit tests.
>
> This will make it much more digestible for the reviewer.
Done.
>
>> [PATCH 2/2] Changes unresolved debug level value (SSSDBG_UNRESOLVED)
>> from -1 to 0 so DEBUG macro could be reduced by one condition. Anyway,
>> it has a minor effect, every time you want to load debug_level from
>> command line parameters, you have to use following pattern:
>>
>> /* Set debug level to invalid value so we can deside if -d 0 was
>> used. */ debug_level = SSSDBG_INVALID;
>>
>> pc = poptGetContext(argv[0], argc, argv, long_options, 0);
>> while((opt = poptGetNextOpt(pc)) != -1) { ... }
>>
>> debug_level = debug_level != SSSDBG_INVALID ?
>> debug_convert_old_level(debug_level) :
>> SSSDBG_UNRESOLVED; /* Debug level should be loaded from config file. */
>
> I don't actually see any value to this patch.
Well, the value isn't really big.
-1 is 0xFFF... so you have to check against bit map like this:
(debug_level >= 0) && (level & debug_level)
...and I've been told to keep that macro as small as possible. But I'm
aware that it adds more complexity to the code so feel free to refuse
this change.
> Also, wouldn't this
> conflict with compatibility with old settings if 'debug_level = 0' had
> been explicitly set?
Actually, it wouldn't conflict. If you try to put unresolved value in
debug_level, it will be converted to 0x0010 (equiv. to 0 in old format).
It makes problem only if you need to know if the program is run with -d
0 (so we can call every child with this parameter too) or not - and
that's where the above pattern come in.
Pavel Březina
12 years, 8 months
using ldb-tools to modify the cache
by Michael Gliwinski
Hello all,
Is it safe to use ldbmodify / ldbdel to modify the LDB cache in
/var/lib/sssd/db/ ? Does the daemon need to be stopped?
Obviously this is only for debugging, etc. I'm currently trying to track down
a weird issue where SSSD is losing track of members of an LDAP group (i.e. all
member attribute values are OK in cache but only a subset or none of memberuid
values). I wanted to expire an entry by either deleting it or resetting
dataExpireTimestamp.
Many thanks,
--
Michael Gliwinski
Henderson Group Information Services
9-11 Hightown Avenue, Newtownabby, BT36 4RT
Phone: 028 9034 3319
**********************************************************************************************
The information in this email is confidential and may be legally privileged. It is intended solely for the addressee and access to the email by anyone else is unauthorised.
If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful.
When addressed to our clients, any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing client engagement leter or contract.
If you have received this email in error please notify support(a)henderson-group.com
John Henderson (Holdings) Ltd
Registered office: 9 Hightown Avenue, Mallusk, County Antrim, Northern Ireland, BT36 4RT.
Registered in Northern Ireland
Registration Number NI010588
Vat No.: 814 6399 12
*********************************************************************************
12 years, 8 months
[PATCH] debug_timestamps fixes
by Pavel Březina
If you set value for debug_timestamps in sssd.conf, you are not able to overwrite it via --debug-timestamps parameter.
Also sssd man page has an invalid description of this parameter.
Both fixed in this patch.
12 years, 8 months
[PATCH] Remove unused temporary context
by Jakub Hrozek
While removing an unrelated patch, Alexander noticed we had an unused
temporary talloc context. This patch removes it.
I didn't remove the done: label (in favor of just returning ret), it
cases no harm and future additions to the function might need it again.
12 years, 8 months
couple of questions about local domain
by Michael Gliwinski
Hello all,
I have a couple of questions about the SSSD local domain, hope you'll be able
to shed some light.
I realise the local domain is currently mostly intended for testing, I also
get the impression (from searching the archives) that at some point it was
meant to be more than that, however I can't find details. I have a couple of
use-cases where the local domain would be rather useful, but I'm encountering
some problems.
1) When a user is created a private group is automatically created too,
however you can't seem to add another user into that group. Is this by design
or a bug? (I've one case where I need to be able to do this)
# sss_useradd test0
# sss_useradd test1
# sss_usermod -a test1 test0
Could not modify user - check if group names are correct
2) Cross domain memberships - that would be very useful to me. Specifically
being able to add both local users and groups (i.e. /etc/passwd, /etc/group)
and LDAP users and groups to a group in SSSD local domain.
At the moment this doesn't work as sss_usermod/sss_groupmod complains it
cannot find user/group in local domain.
Are there any plans to have such functionality in SSSD local domain (esp. the
2nd point)?
PS. many thanks for the great software, I started rolling out on our servers
and all the problems we had before with nss_ldap+pam_krb5+nscd are now gone!
--
Michael Gliwinski
Henderson Group Information Services
9-11 Hightown Avenue, Newtownabby, BT36 4RT
Phone: 028 9034 3319
**********************************************************************************************
The information in this email is confidential and may be legally privileged. It is intended solely for the addressee and access to the email by anyone else is unauthorised.
If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful.
When addressed to our clients, any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing client engagement leter or contract.
If you have received this email in error please notify support(a)henderson-group.com
John Henderson (Holdings) Ltd
Registered office: 9 Hightown Avenue, Mallusk, County Antrim, Northern Ireland, BT36 4RT.
Registered in Northern Ireland
Registration Number NI010588
Vat No.: 814 6399 12
*********************************************************************************
12 years, 8 months
Announcing SSSD 1.5.12
by Stephen Gallagher
The SSSD team is proud to announce the version 1.5.12 enhancement and
bugfix release of the System Security Services Daemon.
As always, it can be downloaded from https://fedorahosted.org/sssd/
== Highlights ==
* Fixes a regression introduced in 1.5.11 with hostname resolution
* Fixes an issue where sssd_pam would leak file descriptors until
resource exhaustion
* Complete rewrite of the FreeIPA Host-Based Access Control (HBAC)
resolver
* New shared library for HBAC access-control
* Fixes for password expiration handling with LDAP auth
* New option to veto certain centrally-managed shells (Patch by John
Hodrien)
== Detailed Changelog ==
Jakub Hrozek (18):
* Use ares_search instead of ares_query for hostname resolution
* Do not add a NULL host parsed from LDAP URI
* Only print server address if one is available
* Fix indexing of skipped groups
* Set gidNumber of non-posix groups to 0 even on updates
* Explicitly ignore groups with gidNumber=0
* Wrong paramater to sysdb_attrs_add_uint32
* Change the default value of ldap_tls_cacert in IPA provider
* Provide python bindings for the HBAC evaluator library
* Fixes for python HBAC bindings
* Fix python HBAC bindings for python <= 2.4
* Remove dead code from python HBAC bindings
* Handle allocation error in python HBAC bindings
* UTF8 HBAC test
* HBAC rule validation Python bindings
* Request password control unconditionally during bind
* pyhbac: Do not convert int to bool
* Fix returning groups when gidNumber attribute is not ordered
John Hodrien (1):
* Add vetoed_shells option
Simo Sorce (1):
* sss_client: avoid leaking file descriptors
Stephen Gallagher (19):
* Bumping version to 1.5.12
* Remove incorrect private variable
* Add helper function msgs2attrs_array
* Add HBAC evaluator and tests
* Add helper functions for looking up HBAC rule components
* Remove old HBAC implementation
* Add new HBAC lookup and evaluation routines
* Add ipa_hbac_refresh option
* Add ipa_hbac_treat_deny_as option
* Treat NULL or empty rhost as unknown
* libipa_hbac: Support case-insensitive comparisons with UTF8
* Fix memory leak in ipa_hbac_evaluate_rules
* Fix incorrect NULL check in ipa_hbac_common.c
* Require matched version and release for libipa_hbac
* Add rule validator to libipa_hbac
* Allow LDAP to decide when an expiration warning is warranted
* Update translation files for SSSD 1.5.12 release
* Revert "Allow LDAP to decide when an expiration warning is warranted"
* Updating translations for SSSD 1.5.12 release
12 years, 9 months