[PATCHES] Do not call sss_cmd_done in function check_cache
by Lukas Slebodnik
ehlo,
Attached patches should fix https://fedorahosted.org/sssd/ticket/1980
The first patch adds check after sysdb_getnetgr. If sysdb_getnetgr returns more
result than 1, sssd will return error. sysdb_getpwnam has already had
this check.
The second patch removes function call sss_cmd_done inside of check_cache,
because function is sss_cmd_done is called in parent functions.
This was a reason of sssd crash.
How to reproduce this crash.
1.Add Netgroup to sysdb cache with base cn=Netgroups,cn=<domain>,cn=sysdb
This netgroup should have the same attribute (name or nameAlias or memberOf)
as another netgroup.
2. call sudo with user, which is member of ^^^ netgroup.
Those patches fix only sssd crash, but we should find out:
Why were those netgroups stored in sysdb.
LS
10 years, 8 months
[PATCH] Minor man page patches
by Jakub Hrozek
Hi,
attached are three man page patches.
[PATCH 1/3] MAN: clarify the default access provider for AD
https://fedorahosted.org/sssd/ticket/1965
After we added a section that clarified what access_provider=ad did,
some users were confused and thought that "ad" was also the default
access provider if "id_provider=ad" was specified.
[PATCH 2/3] MAN: IP addresss does not work when used for ad_server
https://fedorahosted.org/sssd/ticket/1998
Currently using IP address as value of ad_server is not supported, so
the man pages should not mention that as an option.
[PATCH 3/3] MAN: Clarify the min_id/max_id limits further
https://fedorahosted.org/sssd/ticket/2005
Some users were confused by our description of min_id/max_id and thought
the limits only applied to returning entries from the NSS responder.
However, the limits are actually enforced on the back end side, so the
entries are not even saved to cache.
10 years, 8 months
[PATCH] Netgroups should ignore the 'use_fully_qualified_names' setting
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Netgroups often have memberNisNetgroup entries included in them
that will never process correctly if we require fully-qualified
names on the nested lookup. This patch alters the behavior of
netgroup lookups to check *all* domains for an unqualified
netgroup name, instead of only the ones not requiring fully-
qualified names.
Fixes https://fedorahosted.org/sssd/ticket/2013
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlHevGMACgkQeiVVYja6o6OilgCfXOHz5jYR3HWT7HvVagHisOT+
RD8AnRnmBCY6IfzbzsuNLLUZ0KSlVUiy
=dmJA
-----END PGP SIGNATURE-----
10 years, 9 months