[PATCHES] Sig handlers cleanups
by Simo Sorce
While checking if our custom signal handlers properly handle errno, I
stumbled on a few cleanups, they are attached.
turns out our few signal hanlders are errno safe, and tevent signal
handling function is also fine.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
8 years, 11 months
[PATCH] krb5: Check return value of sss_krb5_princ_realm
by Lukas Slebodnik
ehlo,
yet another warning from clang static analyser.
sss_krb5_princ_realm set output parameter realm to NULL and len to 0
in case of failure. Clang static analysers repoted warning
"Null pointer passed as an argument to a 'nonnull' parameter"
in function match_principal. It was possible, that realm_name with value NULL
could be used in strncmp.
Function sss_krb5_princ_realm is used on other places for printing(formatting)
realm_name and NULL can be safely used as a argument for printf-like
functions.
Patch is attached.
LS
9 years
[PATCHES] Enable sending DEBUG logs to journald
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
All of these patches require Nikolai's "DEBUG Macro Refactoring v3"
patches to be applied first.
Patch 0001: Allow debug_fn to process __FILE__ and __LINE__
In preparation for enabling journald support for the DEBUG logs, we
will need to be able to pass in certain additional arguments that will
be required, specifically the code file and line number.
We will be able to optionally enable this in the file-based logs as well
if we so choose, but for right now we will avoid breaking the log
format on disk.
Patch 0002: Enable sending structured debug logs to journald
We are now able to send structured debug logs to journald, tagged with
the code file, line number and domain that the log pertains to. To
enable this functionality, SSSD must be configured at build-time with
- --with-syslog=journald and must be launched without -f/--debug-to-files
This behavior is nearly identical to how SSSD will function today on a
systemd-based system if --debug-to-files is disabled, since it will
redirect stdout and stderr into journald. This patch merely enhances
the situation to send structured logs instead of simple string messages.
Patch 0003: BUILD: Build with journald support by default on Fedora
The journal provided by systemd gives us structured logging
capabilities that we should be taking advantage of.
Note: this patch explicitly does not change the systemd unit file for
SSSD. Right now, an administrator will need to manually remove the
'-f' from ExecStart in the unit file to send debug logs to journald. I
suspect we'll want to discuss this before we make it the default. This
patch DOES change the default for sss_log messages to use
sd_journal_send() instead of straight log() for those messages that we
traditionally sent to the syslog (such as login events). This is code
that has been in place for some time now, but has not been the default
because we hadn't build with --with-syslog=journald.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlK0v0QACgkQeiVVYja6o6NwxgCfWnU4IbYyJPXxPe83zWjjsCHt
cG8AnitRgM9CAUjHM2ofYg3TgcUxCyCC
=Fara
-----END PGP SIGNATURE-----
9 years, 5 months
[PATCH] LDAP: Try all attributes when saving an entry
by Jakub Hrozek
Hi,
this bug was reported on #sssd by a user. He was running some flavor of
IBM Tivoli where the entries only had an "ID", not separate "UID" and
"GID". But due to a bug in sssd he couldn't use the same value for both,
this configuration:
ldap_user_uid_number = idAttribute
ldap_user_gid_number = idAttribute
only saved the ID into UID and left GID empty. It appears we have a long
standing bug in sdap_parse where we only consider first match. If this
patch is accepted, I would also like to refactor sdap_parse in master
because currently it is a 250-lines long function with multiple
branches..
9 years, 5 months
Build Fixes
by Benjamin Franzke
Hi,
These two patches add missing CFLAGS/LIBS to Makefile.am:
[PATCH 1/2] BUILD: Link libsss_ad.so to sasl libs
[PATCH 2/2] BUILD: Use OPENLDAP_CFLAGS instead of LDAP_CFLAGS
This underlinking was noticed in make check (dlopen-test).
Note:
It failed for me since my openldap build had no sasl support,
which would otherwise have pulled in libsasl2.so.
Of course, that support should be in place, but the linking should still be
fixed.
BTW: It would propably be nice to have a configure check whether
openldap has sasl support, but it seems that would need a check if
ldap_sasl_interactive_bind returns LDAP_NOT_SUPPORTED.
Regards, Ben
9 years, 6 months
[PATCH] BUILD: Link libsss_krb5_common.so to libkeyutils.so
by Benjamin Franzke
Hi List,
The symbol add_key is used by
src/providers/krb5/krb5_delayed_online_authentication.c
which is part of libsss_krb5_common.so
Fixes following error:
[sssd[be[default]]] [load_backend_module]
(0x0010): Unable to load ad module with path
(/usr/lib64/sssd/libsss_ad.so), error:
/usr/lib64/sssd/libsss_krb5_common.so: undefined symbol: add_key
-lkeyutils was passed to the libraries libsss_{krb5,ipa,ad}.so,
but when compiling with -Wl,--as-needed this flag will be ignored,
since it is not used directly. So it was unavailable to
libsss_krb5_common.so which actually needs it.
This patch removes $(KEYUTILS_LIBS) from those libraries and adds it to
libsss_krb5_common.so
Maybe libsss_krb5_common.so should be added to dlopen-tests?
But then other libraries and functions are needed as well,
which it currently inherits from libsss_{krb5,ipa,ad}.so.
BTW: are these common libraries (i mean ldap too) convenience build
libraries, or to save disk space?
If they're just for convencience maybe they should not be installed?
Regards, Ben
9 years, 7 months
[PATCH] TESTS: Link libsss_test_common with tevent
by Lukas Slebodnik
ehlo,
Static library libsss_test_common calls tevent functions directly (in module
common_tev.c), but it was not linked with tevent library.
Compilation will fail if sssd is linked with "-Wl,--as-needed"
CCLD test_utils
/usr/bin/ld: ./.libs/libsss_test_common.a(common_tev.o): undefined reference to symbol 'tevent_context_init@(a)TEVENT_0.9.9'
/usr/bin/ld: note: 'tevent_context_init@(a)TEVENT_0.9.9' is defined in DSO /usr/lib/gcc/x86_64-redhat-linux/4.8.2/../../../../lib64/libtevent.so so try adding it to the linker command line
/usr/lib/gcc/x86_64-redhat-linux/4.8.2/../../../../lib64/libtevent.so: could not read symbols: Invalid operation
clang: error: linker command failed with exit code 1 (use -v to see invocation)
nm ./libsss_test_common.a | grep tevent
U tevent_context_init
U _tevent_loop_once
U _tevent_req_create
U _tevent_req_done
U _tevent_req_error
U tevent_req_is_error
U tevent_req_post
Simple patch is attached.
LS
9 years, 9 months
ding-libs: symbol versioning is necessary
by Jan Engelhardt
I had libref_array1-0.1.1 and libini_config2-0.6.1 (which were built
from ding-libs-0.1.3) installed in the system. Few days ago I built the
new ding-libs-0.3.0.1 source which, among others, yielded a binary
libini_config3-1.0.0.1 package.
After installation of libini_config3, ldd -r
/usr/lib64/libini_config.so.3 yields:
undefined symbol: ref_array_copy (/usr/lib64/libini_config.so.3)
which is a sign that libini_config3 needs a newer libref_array1,
but the package manager did not catch it because the release
following commit 8c201905d5f0720b62d036eb2308f81f4530cfad
failed to do one of:
(1) changing the SONAME of ref_array, or
(2) using symbol versions
to indicate the new backwards-incompatibility. People, -version-info
1:0:0 => -version-info 2:0:1 is not enough! You must either
(1) -version-info 2:0:0, or
(2) -Wl,--version-script=ref_array.map
9 years, 9 months
[PATCH] nested groups unit test
by Pavel Březina
Hi,
this is the first unit test for nested groups. It covers only the most
basic situation when we are trying to resolve one group with no members.
Even though it is only one test, the patch set is quite big. This is
because it creates the possibility to mock providers related modules.
Most of the patches are just a preparation for unit testing providers.
Patches 1-5
Moves the code around to reduce number of dependencies. (E.g. you do not
want to load fail over when you are testing nested groups.)
Patch 6
Mocks basic SDAP interface.
Patch 7
Mocks sysdb objects - currently user and rfc2307bis group. You can
decide what set of attributes the object should posses. For example,
creating a user requires only basedn and name parameter, to construct
originalDN and name attributes. The rest is provided by (attrname,
value) pairs via variadic function.
E.g.:
mock_sysdb_user(mem_ctx, basedn, name, SYSDB_UIDNUM, uid, ...)
get_attr_type() translates the sysdb attribute name to proper data type.
This should be extended as needed.
Patch 8
Adds provider tests related common object files and cflags in makefile
Patch 9
New macro sss_will_return_always(fn, value). This can be used to mock
function data in such way that any call of mock() will return the value.
It was just pushed also to cmocka upstream as will_return_always().
Patch 10-11
Unit test.
Patch 12
Removes a noisy debug message.
I would like to get this reviewed before I continue with more test
cases, so the framework is tuned enough.
Off topic:
I also created new macro called fail_msg, which will make the test fail
printing a message. I didn't use this macro in the end, but it made its
way to cmocka upstream.
9 years, 9 months