[PATCHES] Check nsAccountLock during IPA pam_acct_mgmt
by Stephen Gallagher
Patch 0001: Make sdap_access_send() public so the IPA provider can
consume it.
Patch 0002: Check that the user is not disabled before performing the
HBAC check. I chose to do the nsAccountLock check first because it's a
very fast operation against the cache, so if it returns PAM_PERM_DENIED
we will skip the slower HBAC checks and jump straight to denial.
12 years, 1 month
[PATCH] Fix two netgroup issues
by Jakub Hrozek
Hi,
Amith reported these two issues.
[PATCH 1/2] Save original name into the in-memory cache
We were saving the original name into the netgroup hash when the object
was first constructed but when no domain matched, we would save the cased
name. The first request that was constructed with the original name was never
marked as "ready", so another request with the same name was stuck waiting.
[PATCH 2/2]
setnetgrent return codes are handled in the _done callback, some of them
gracefully, such as ENOENT that sends an empty reply. This patch uses
tevent_req_post() to always call the callback and handle error conditions
there. In particular, Amith was able to trigger this error by requesting
a netgroup by raw name when all domains were marked as FQDN only
12 years, 1 month
[PATCH] Fix nested groups processing
by Jakub Hrozek
The attached patch fixes the crash described in
https://bugzilla.redhat.com/show_bug.cgi?id=743133#c28
The cause is actually embarassingly simple, the bug just did occur only
with specific configurations our tests didn't exercise and moreover the
default debugging didn't include enough information to triage the issue
just from the debug logs.
The root cause was that we would process all nested groups in a nesting
level in a single tevent request and we kept the number of parent groups
stored in the "state" structure. However, when moving to next group in
the nesting leve, we didn't reset the number of parents..
Instead of keeping the number of parent groups in "state" and having to
reset the count when moving to another group on the same level, the patch
keeps track of the all groups on a particular level along with their
parents and parent count in a more structured manner. This makes the
code less fragile.
The patch also adds more debugging.
12 years, 1 month