[PATCH] Collect krb5 trace on high debug levels
by Jakub Hrozek
https://fedorahosted.org/sssd/ticket/1539
If the SSSD domain is running with SSSDBG_TRACE_ALL, then we also set
Kerberos tracing with krb5_set_trace_filename.
There's one catch, though. The krb5_child and ldap_child logs are only
writable by root, but the krb5_child process drops privileges to the
user before priming his ccache. With this patch applied and debug_level
set to 10, the krb5_child process doesn't drop privileges..
I personally think that's fine, because running with debug_level 10
provides a LOT of debugging so it should only be configured for
debugging anyway. Also we don't drop privileges in other scenarios..
I could maybe add a new param to the child or add heuristics to drop
privileges after the debugging is set but that seemed like an over
engineering when this feature is only useful for hardcode debugging.
11 years, 6 months
[PATCH] Remove libsss_sudo.pc and move libsss_sudo.so out of devel subpackage
by Jakub Hrozek
Hi,
I noticed during the work on provider packaging that we still ship the
libsss_sudo.pc file and that we only ship the libsss_sudo.so library in
the -devel package. I think that's wrong. We might also want to move
libsss_sudo out of LDPATH in the future, but that's not really important
now (and it would require coordination with sudo).
I decided to keep libsss_sudo-devel around because it still contains the
developer documentation.
11 years, 6 months
[PATCH] do not call dp callbacks when responder is shutting down
by Pavel Březina
https://fedorahosted.org/sssd/ticket/1514
See the commit message and ticket comments for more information.
This patch introduces one of the possible solutions, but I suggest to
consider actually changing memory hierarchy in responders.
Currently, the hierarchy looks like this:
main_ctx->specific_ctx->rctx, where specific_ctx is one of the pam, nss,
sudo, etc. contexts.
Does anybody know why it is not main_ctx->rctx->specific_ctx? This would
solve the issue as well and I personally think that it is more logical.
11 years, 6 months