[PATCH] NSS: Add individual timeouts for entry types
by Stephen Gallagher
This patch makes several changes, making the code more manageable by
reducing the places we need to look for cache values, as well as
improving the granularity of our cache settings.
1) Add four new options: entry_cache_user_timeout,
entry_cache_group_timeout, entry_cache_netgroup_timeout and
entry_cache_service_timeout. If they are unspecified, they will be
populated internally with the value of entry_cache_timeout (or its
default in turn of 5400).
2) These new cache values are stored as members of the sss_domain_info
structure, which we have available pretty much everywhere in the
providers.
3) It removes 'entry_cache_timeout' from the dp_opt lists for both the
LDAP and IPA identity providers, in preference to the sss_domain_info
structure.
4) The proxy provider no longer reads the entry_cache_timeout into its
own proxy_id_ctx either, in preference to the sss_domain_info structure.
There are also two minor additional fixes I included while adding these
features. There were two places in the code where we were incorrectly
using the entry_cache_timeout as the timeout value of an LDAP operation.
Thus, it was possible to be stuck waiting 90 minutes (by default) for an
LDAP server to reply. (This was only possible during nested group
processing on FreeIPA servers, I believe).
11 years, 1 month
A patched sudo package available for testing
by Jakub Hrozek
Hi,
With the patches that landed on the list today, the sudo support in SSSD is
finally feature-complete. Rudimentary testing can be performed using the
sss_sudo_cli test binary that is built in-tree, but the user needs a
patched sudo package to fully test the feature.
With Daniel's permission, I have put the test packages on my fedorapeople
space. It is code that has not yet been upstreamed, it is experimental
and intended as a developer-preview only. Please DO NOT run this in
production.
The source RPM:
http://jhrozek.fedorapeople.org/sudo-sssd/sudo-1.8.3p1-2.fc15.src.rpm
The patch:
http://jhrozek.fedorapeople.org/sudo-sssd/sudo-1.8.3p1-sssd-support.patch
Make sure that you have the libsss_sudo and libsss_sudo-devel packages
installed.
After installing sudo, edit /etc/nsswitch.conf and change the "sudoers"
line to include "sss", for example "sudoers: files sss".
Edit sssd.conf and include the sudo search base that points to sudo
rules stored on your LDAP server. Restart sssd.
When you log in as a user that is included in a sudo rule, run "sudo -l"
and you should see the list of the rules. sudo should keep running even
if your LDAP server is inaccesible.
If you encounter any issues, please either file a ticket or reply to
sssd-devel.
Happy testing!
11 years, 1 month
Re: [SSSD] SUDO Integration - in-memory cache
by Jakub Hrozek
Resending, hopefully the mailman issues are gone now..
On Fri, Jan 27, 2012 at 11:39:17AM +0100, Jakub Hrozek wrote:
> On Thu, Jan 26, 2012 at 04:35:04PM +0100, Pavel Březina wrote:
> > Dne 25.1.2012 20:50, Jakub Hrozek napsal(a):
> > >On Wed, Jan 25, 2012 at 08:44:40PM +0100, Jakub Hrozek wrote:
> > >>On Tue, Jan 24, 2012 at 03:10:32PM +0100, Pavel Březina wrote:
> > >>>https://fedorahosted.org/sssd/ticket/1111
> > >>>
> > >>>Requires cn=defaults patches.
> > >>>
> > >>>Please note, that the new sudo responder option (cache_timeout) will
> > >>>be added to SSSDConfig.py as a part of #1144.
> > >>
> > >>Nack,
> > >>
> > >>Please name the new option "sudo_cache_timeout" to avoid name-clash with
> > >>the general cache timeout. Cache timeouts are being separated in 1.8
> > >>anyway.
> >
> > Done.
> >
> > >>Nitpick: sudosrc_cache.c has the diacritics in your surname mangled.
> >
> > I don't know how that happened, I hope that it is alright this time.
> >
> > >>I would prefer to have a different prefix than res_ in struct
> > >>sudo_cache_entry. I realize that res is a common name used for
> > >>sysdb_attrs but that's largely used as a shorthand for "result". Simply
> > >>using "rules" and "num_rules" would be nicer.
> >
> > Done.
> >
> > >>The way FQDN-only domains are skipped is different from the
> > >>"cn=defaults" patch (and I prefer that approach). In this patch,
> > >>only the first domain is checked for being FQDN-only,
> >
> > I'm sorry, I don't follow. Could you provide me some more information?
> > However, I've corrected a bug in sudosrv_cache_lookup() where I was
> > passing dctx->domain instead of domain as a parameter. It is fixed
> > in this patch.
> >
> >
> > I think it would
> > >>be better to move the check into the loop, or (and that probably better)
> > >>move the cache into sudosrv_get_rules().
> >
> > Are you getting at this situation?
> > - We have domains A and B
> > - User x@B
> > - x@B calls 'sudo cmd' which stores rules for this user into sysdb
> > and into in-memory cache
> > - we create user x@A
> > - x@A uses sudo but it would use the rules for x@B until the
> > in-memory cache is expired
> >
> > Your solution would certainly work for this situation but there
> > wouldn't be the need of in-memory cache anymore, we can use just
> > sysdb.
> >
> > The purpose of having in-memory cache is for the sudo request to be
> > as fast as possible. And I would like to point out that it is still
> > just a cache - and cache doesn't have to be necessary current.
> >
> > >>Also please remove the FIXME from sudosrv_get_rules().
> >
> > Thank you. I've also removed the other cache related FIXME, because
> > I believe it is sorted out this way. Please, correct me if I'm
> > wrong.
> >
> >
> > >One more thing - the new option needs to be documented in man pages and
> > >settable by the configAPI.
> >
> > Unfortunately it is not that simple. This affects the config tests
> > as it requires support of a new responder in the tests. It will be
> > done in #1144.
> >
> > Thank you for the review.
> >
>
> I should have bring this up sooner but I this it is much cleaner that
> the entries are deleted with a tevent timer after their TTL is over than
> checking if they are valid when reading them from the hash.
>
> The cache logic can then be reduced to looking up an entry in the hash.
>
> Check out pam_initgr_cache_remove() for an example.
11 years, 1 month
[PATCHES][PRELIMINARY] Support of SELinux user maps in SSSD
by Jan Zelený
Hi,
I'm sending all patches implementing support for SELinux user maps. Some
support patches are included as well.
#0001:
Implemented support for multiple search bases in HBAC rules and services. As
discussed before, this is not strictly needed, but I did it anyway to unify
the approach to multiple search bases. Just a reminder: the plan is to use
these structures and then limit maximal number of search bases to 1 since
there is no support in IPA server for more bases anyway.
#0002:
This fixes minor regression brought by my previous patch which is already
pushed (multiple search bases in IPA hosts).
#0003:
Add generic routines to retrieve IPA configuration object. These routines will
be used in other parts of the code.
#0004:
Rewrite retrieval of password migration flag from IPA config to user previously
implemented generic IPA config interface.
#0005:
Some sysdb netgroup attributes will be used in SELinux user maps. They will
also have the same semantics, therefore they should be renamed and then re-
used.
#0006:
Some sysdb routines for SELinux support. Please note that some routines are
written in very generic way - I'd like to use them also elsewhere in the
current code, perhaps as a part of some sysdb refactoring.
#0007:
Utility functions for SELinux map matching against information about current
user and host.
#0008:
SELinux user maps support in IPA provider. Also generig data provider related
code is here. I'm considering splitting this patch in two or three. Let me
know your opinion.
#0009:
Responder support of SELinux user maps - retrieve all applicable maps from
sysbd and create content of the user mapping file
/etc/selinux/<policy>/logins/<usernale>
#0010:
Get the file content from PAM responder and write it to the file. I'm not
completely sure whether or not to implement some kind of locking to prevent
possible race conditions when reading/writing to this file.
Thanks in advance for the review. Any advices how to improve the code will be
appreciated.
Jan
11 years, 1 month
SUDO: provide manual pages
by Jakub Hrozek
Unfortunately Pavel did not have enough time to finish all the sudo
related tickets that would change strings and therefore must be done in
time for 1.7.9.
I've been pulling patches from his personal git tree, finishing and
polishing them up as appropriate. Attached are two patches that build
sudo-related manual pages.
https://fedorahosted.org/sssd/ticket/1109
[PATCH 1/2] SUDO Integration - manual page
This is Pavel's original patch. I just removed documentation on one
option that is not yet in master and squashed it into the appropriate
patch that I will send for review later.
[PATCH 2/2] Include sudo manual pages only conditionally
Sudo is still an experimental feature. We don't want to document it for
builds that do not include the sudo feature.
I used the "profiling" feature of DocBook to achieve that:
http://www.sagehill.net/docbookxsl/Profiling.html
Each subsequent experimental feature would then just add a new CONDS+=
to the Makefile and mark the optional section with the standard DocBook
"condition" parameter.
The patch also marks the sections in the man page as experimental.
11 years, 1 month
[PATCH] Fixed startup problem in IPA provider
by Jan Zelený
Because of wrong place where ldap_service_search_base is in attribute array in
IPA provider, the backend won't start (its trying to load another attribute
instead of the search base).
The patch has been pushed to master under the one-liner rule.
Jan
11 years, 1 month