[PATCHES] Enable sending DEBUG logs to journald
by Stephen Gallagher
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
All of these patches require Nikolai's "DEBUG Macro Refactoring v3"
patches to be applied first.
Patch 0001: Allow debug_fn to process __FILE__ and __LINE__
In preparation for enabling journald support for the DEBUG logs, we
will need to be able to pass in certain additional arguments that will
be required, specifically the code file and line number.
We will be able to optionally enable this in the file-based logs as well
if we so choose, but for right now we will avoid breaking the log
format on disk.
Patch 0002: Enable sending structured debug logs to journald
We are now able to send structured debug logs to journald, tagged with
the code file, line number and domain that the log pertains to. To
enable this functionality, SSSD must be configured at build-time with
- --with-syslog=journald and must be launched without -f/--debug-to-files
This behavior is nearly identical to how SSSD will function today on a
systemd-based system if --debug-to-files is disabled, since it will
redirect stdout and stderr into journald. This patch merely enhances
the situation to send structured logs instead of simple string messages.
Patch 0003: BUILD: Build with journald support by default on Fedora
The journal provided by systemd gives us structured logging
capabilities that we should be taking advantage of.
Note: this patch explicitly does not change the systemd unit file for
SSSD. Right now, an administrator will need to manually remove the
'-f' from ExecStart in the unit file to send debug logs to journald. I
suspect we'll want to discuss this before we make it the default. This
patch DOES change the default for sss_log messages to use
sd_journal_send() instead of straight log() for those messages that we
traditionally sent to the syslog (such as login events). This is code
that has been in place for some time now, but has not been the default
because we hadn't build with --with-syslog=journald.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlK0v0QACgkQeiVVYja6o6NwxgCfWnU4IbYyJPXxPe83zWjjsCHt
cG8AnitRgM9CAUjHM2ofYg3TgcUxCyCC
=Fara
-----END PGP SIGNATURE-----
9 years, 8 months
[PATCH] LDAP: Try all attributes when saving an entry
by Jakub Hrozek
Hi,
this bug was reported on #sssd by a user. He was running some flavor of
IBM Tivoli where the entries only had an "ID", not separate "UID" and
"GID". But due to a bug in sssd he couldn't use the same value for both,
this configuration:
ldap_user_uid_number = idAttribute
ldap_user_gid_number = idAttribute
only saved the ID into UID and left GID empty. It appears we have a long
standing bug in sdap_parse where we only consider first match. If this
patch is accepted, I would also like to refactor sdap_parse in master
because currently it is a 250-lines long function with multiple
branches..
9 years, 8 months
[PATCH v2 0/5] NFSv4 rpc.idmapd plugin
by Noam Meltzer
Hello sssd-devel & linux-nfs,
This is v2 of the patch set. It is now sent to linux-nfs as weel, following
Steve Dickson request.
The code in the next 5 patches implements the design document:
https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
The changes in the code (compared to v1) are following the review done in
sssd-devel.
I believe that there are still two items in dispute (no final verdict was given
in the sssd mailing list) but this new patch set will give a chance to have a
cleaner look on things.
--
Noam Meltzer
Linux Software Engineer
PRIMARY DATA
P.O. Box 12650, Herzliya Pituach 4673300
9 Hamenofim St. Akerstein Towers, Tower A, 5th fl. Herzliya
Office: +972-77-8981888 | Fax: +972-3-7617140 | Mobile: +972-54-5873843
Email: noam(a)primarydata.com
--
Noam Meltzer (5):
NEW CLIENT: plugin for NFSv4 rpc.idmapd
NFSv4 client: (private) headers from libnfsidmap
NFSv4 client: add to build system
NFSv4 client: man page
NFSv4 client: add to RPM spec
Makefile.am | 19 ++
configure.ac | 10 +
contrib/sssd.spec.in | 8 +
src/conf_macros.m4 | 30 ++
src/external/libnfsidmap.m4 | 17 +
src/man/Makefile.am | 4 +-
src/man/include/seealso.xml | 4 +
src/man/sss_rpcidmapd.5.xml | 97 ++++++
src/sss_client/common.c | 5 +
src/sss_client/nfs/nfsidmap_internal.h | 78 +++++
src/sss_client/nfs/sss_nfs_client.c | 569 +++++++++++++++++++++++++++++++++
src/sss_client/sss_cli.h | 2 +
12 files changed, 842 insertions(+), 1 deletion(-)
create mode 100644 src/external/libnfsidmap.m4
create mode 100644 src/man/sss_rpcidmapd.5.xml
create mode 100644 src/sss_client/nfs/nfsidmap_internal.h
create mode 100644 src/sss_client/nfs/sss_nfs_client.c
--
1.8.5.3
9 years, 9 months
[sssd][patches] NSS: netgroups minor fixes
by Pavel Reichl
Hello,
while working on https://fedorahosted.org/sssd/ticket/2102 I noticed a
few minor problems regarding netgroups.
1st patch:
First check returned value then it is safe to access results.
2nd patch:
It is my opinion that function lookup_netgr_step is too long and can be
safely (with minimum of changes) divided into 2 separate functions.
3rd patch:
Pavel Brezina asked me to solve memory leak in lookup_netgr_step.
4th patch:
Fixes two code style issues.
Thank for review!
Pavel Reichl
9 years, 9 months
[PATCH] pam_sss: add ignore_unknown_user option
by Pete Fritchman
https://fedorahosted.org/sssd/ticket/2232
FreeBSD's openpam doesn't have a built in way of ignoring an unknown
user (e.g. treating PAM_USER_UNKNOWN as a pass for a required module,
like Linux's user_unknown=ignore tag), so there needs to be an
ignore_unknown_user flag built in to the PAM module. This patch makes
pam_sss return PAM_IGNORE instead of PAM_USER_UNKNOWN when
ignore_unknown_user is passed in from the PAM config. FWIW, this is
how pam_ldap works on FreeBSD with local accounts, too.
This patch allows us to keep pam_sss marked as required for the PAM
"account" facility (to enforce HBAC rules) but still allow local users
to log in.
jhrozek suggested posting the patch here for review, so thanks in
advance for looking it over!
--
petef
9 years, 10 months
[PATCH] IFP: Add GetUserAttrs call
by Jakub Hrozek
Hi,
the attached patches upstream functionality that mod_lookup_identity has
been using for a while, but which we couldn't push to master due to the
pending sbus changes. Now that these are accepted, it's time to merge
the DBus methods themselves. Previously, mod_lookup_identity relied on a
private branch with quite a bit of ad-hoc code.
Please note that when the work in progress to expose users, groups and
domains is merged as well, this interface will become obsolete in favor
of the objects. But we shouldn't let a released version of
mod_lookup_identity rely on unreleased sssd code any longer. Moreover,
all patches except the last one will be used even later on and there's
no fixed timeline on converting mod_lookup_identity.
[PATCH 1/6] SBUS: two trivial style fixes
SSIA
[PATCH 2/6] SBUS: Add a convenience function
Adds a convenience function that constructs a DBusError internally and
as such can be used to mark an sbus request as failed without having
to create a DBusError instance by the caller. The error message must be
either allocated on top of dbus_req or a constant, DBus itself doesn't
copy the error message! This is reflected in the doxygen docstring.
[PATCH 3/6] IFP: Add utility functions
Adds a number of utility functions, most importanly ifp_req_create().
The ifp_req is a structure that will be passed along with the ifp
request and contains the sbus request and some ifp-specific data, like
caller ID or the responder context.
[PATCH 4/6] IFP: use a list of allowed_uids for authentication
Similar to the PAC responder, the InfoPipe uses a list of UIDs that are
allowed to communicate with the IFP responder.
[PATCH 5/6] IFP: Initialize negative cache timeout
In order to avoid hitting the back end with repetitive requests, the
InfoPipe responder needs a negative cache, too. This patch follows the
convention set by other responders, where the negative cache timeouts are
read from the [nss] section. This is not ideal, however, and ticket #2318
tracks moving the configuration to the [ifp] section primarily.
The timeout is also a separate parameter in the NSS context. We should
consider moving it to the negcache context instead (#2317).
[PATCH 6/6] IFP: Add GetUserAttrs call
Adds a DBus method that allows the caller to retrieve attributes of a
user. The synopsis of the call is as follows:
<method name="GetUserAttr">
<arg type="s" name="user" direction="in"/>
<arg type="as" name="attr" direction="in"/>
<arg type="a{sv}" name="values" direction="out"/>
</method>
The return value is an array (one attribute per array member) of
dictionaries. The key of the dictionary is the attribute name, the value
is a variant containing the attribute values as strings.
If an attribute does not exist or is not permitted to be read, no error
is returned. If the users does not exist, the method returns an error.
In future patches this function will be marked as obsolete in favor of
object-oriented approach.
ifp_user_get_attr_unpack_msg is a separate function to allow extending
it in a later patch.
The function to check the cache validity duplicates quite a bit of code
with the NSS responder. The refactoring would be nice to get done along
with #843. I have a patch in my private branch, but it's not complete,
sorry.
9 years, 10 months
[PATCH] SPEC: Remove duplicate sssd_ifp.
by Lukas Slebodnik
ehlo
I wanted to test dbus with sss(ifp responder). but I had a problem with
starting sssd. It was small problem with upstream packaging.
[sssd] [monitor_service_init] (0x0400): Initializing D-BUS Service
[sssd] [mt_svc_exit_handler] (0x0040): Child [ifp] exited with code [3]
[sssd] [mt_svc_exit_handler] (0x0010): Process [ifp], definitely stopped!
[sssd[ifp]] [sysbus_init] (0x0040): DBus error message: Connection ":1.522"
is not allowed to own the service "org.freedesktop.sssd.infopipe" due to
security policies in the configuration file
[sssd[ifp]] [ifp_process_init] (0x0020): Failed to connect to the system message bus
[sssd[ifp]] [sss_responder_ctx_destructor] (0x0400): Responder is being shut down
The file sssd_ifp was installed by two subpackages: sssd-common and sssd-dbus
I din't have instaled file org.freedesktop.sssd.infopipe.conf, because it is
in package sssd-dbus. Missing conf file caused problem with starting
the ifp service.
Simple patch is attached.
LS
9 years, 10 months
[PATCH] DBus: Automatic pack/unpack of method handler arguments
by Stef Walter
Here's the next set of DBus patches. This implements automatic packing
and unpacking of arguments for method handlers.
This means adding a handler to a vtable is now type safe and checked by
the compiler. Type safe reply xxx_finish() are also generated. Together
these avoid the complexity and the pitfalls of building and parsing DBus
messages via varargs (such as dbus_bool_t != bool).
Handlers have their pack/unpack method handlers automatically generated
unless they have this annotation in their DBus XML definition:
<annotation name="org.freedesktop.sssd.RawHandler" value="true"/>
Only simple argument types, and arrays of them are supported. More
complex arguments can continue to be handled via the "RawHandler"
annotation. sbus_codegen will force you to add this annotation for
methods that have complex arguments. In later work we could add commit
for more complex, but common arguments such as dictionaries.
Because so many of the internal sssd DBus methods do strange things with
their arguments, I haven't migrated them to automatic packing and
unpacking of arguments. They are all now marked with the above
"RawHandler" annotation. At some point someone could pick through these
and see which ones are candidates for moving away from "RawHandler".
You can find this as a branch here:
https://github.com/stefwalter/sssd/commits/dbus-invoke
Cheers,
Stef
9 years, 10 months