[PATCH] SBUS: Fix warning declaration shadows a global declaration
by Lukas Slebodnik
ehlo,
While I was testing some patches on epl6 I found a new warning.
src/sbus/sssd_dbus_meta.c: In function 'sbus_meta_find_signal':
src/sbus/sssd_dbus_meta.c:43: warning: declaration of 'signal' shadows a global
declaration
/usr/include/signal.h:101: warning: shadowed declaration is here
patch is attached
LS
9 years, 10 months
[PATCH] IFP: Add a GetGroupsList method
by Jakub Hrozek
Hi,
the attached two patches add a GetGroupsList method that adelton's
mod_lookup_identity uses.
The first patch is a one-liner that I don't think harms the current
sysdb_initgroups() users in any way, also all the sysdb tests pass.
The second patch adds the new method.
9 years, 10 months
[PATCH] IFP: Per-attribute ACL for users
by Jakub Hrozek
This patch depends on all the GetUserAttr patches.
Introduces a new option called user_attributes that allows to specify
which user attributes are allowed to be queried from the IFP responder.
By default only the default POSIX set is allowed, this option allows to
either add other attributes (+attrname) or remove them from the default
set (-attrname).
9 years, 10 months
[PATCH] IFP: Add GetUserAttrs call
by Jakub Hrozek
Hi,
the attached patches upstream functionality that mod_lookup_identity has
been using for a while, but which we couldn't push to master due to the
pending sbus changes. Now that these are accepted, it's time to merge
the DBus methods themselves. Previously, mod_lookup_identity relied on a
private branch with quite a bit of ad-hoc code.
Please note that when the work in progress to expose users, groups and
domains is merged as well, this interface will become obsolete in favor
of the objects. But we shouldn't let a released version of
mod_lookup_identity rely on unreleased sssd code any longer. Moreover,
all patches except the last one will be used even later on and there's
no fixed timeline on converting mod_lookup_identity.
[PATCH 1/6] SBUS: two trivial style fixes
SSIA
[PATCH 2/6] SBUS: Add a convenience function
Adds a convenience function that constructs a DBusError internally and
as such can be used to mark an sbus request as failed without having
to create a DBusError instance by the caller. The error message must be
either allocated on top of dbus_req or a constant, DBus itself doesn't
copy the error message! This is reflected in the doxygen docstring.
[PATCH 3/6] IFP: Add utility functions
Adds a number of utility functions, most importanly ifp_req_create().
The ifp_req is a structure that will be passed along with the ifp
request and contains the sbus request and some ifp-specific data, like
caller ID or the responder context.
[PATCH 4/6] IFP: use a list of allowed_uids for authentication
Similar to the PAC responder, the InfoPipe uses a list of UIDs that are
allowed to communicate with the IFP responder.
[PATCH 5/6] IFP: Initialize negative cache timeout
In order to avoid hitting the back end with repetitive requests, the
InfoPipe responder needs a negative cache, too. This patch follows the
convention set by other responders, where the negative cache timeouts are
read from the [nss] section. This is not ideal, however, and ticket #2318
tracks moving the configuration to the [ifp] section primarily.
The timeout is also a separate parameter in the NSS context. We should
consider moving it to the negcache context instead (#2317).
[PATCH 6/6] IFP: Add GetUserAttrs call
Adds a DBus method that allows the caller to retrieve attributes of a
user. The synopsis of the call is as follows:
<method name="GetUserAttr">
<arg type="s" name="user" direction="in"/>
<arg type="as" name="attr" direction="in"/>
<arg type="a{sv}" name="values" direction="out"/>
</method>
The return value is an array (one attribute per array member) of
dictionaries. The key of the dictionary is the attribute name, the value
is a variant containing the attribute values as strings.
If an attribute does not exist or is not permitted to be read, no error
is returned. If the users does not exist, the method returns an error.
In future patches this function will be marked as obsolete in favor of
object-oriented approach.
ifp_user_get_attr_unpack_msg is a separate function to allow extending
it in a later patch.
The function to check the cache validity duplicates quite a bit of code
with the NSS responder. The refactoring would be nice to get done along
with #843. I have a patch in my private branch, but it's not complete,
sorry.
9 years, 10 months
[PATCH] SPEC: Remove duplicate sssd_ifp.
by Lukas Slebodnik
ehlo
I wanted to test dbus with sss(ifp responder). but I had a problem with
starting sssd. It was small problem with upstream packaging.
[sssd] [monitor_service_init] (0x0400): Initializing D-BUS Service
[sssd] [mt_svc_exit_handler] (0x0040): Child [ifp] exited with code [3]
[sssd] [mt_svc_exit_handler] (0x0010): Process [ifp], definitely stopped!
[sssd[ifp]] [sysbus_init] (0x0040): DBus error message: Connection ":1.522"
is not allowed to own the service "org.freedesktop.sssd.infopipe" due to
security policies in the configuration file
[sssd[ifp]] [ifp_process_init] (0x0020): Failed to connect to the system message bus
[sssd[ifp]] [sss_responder_ctx_destructor] (0x0400): Responder is being shut down
The file sssd_ifp was installed by two subpackages: sssd-common and sssd-dbus
I din't have instaled file org.freedesktop.sssd.infopipe.conf, because it is
in package sssd-dbus. Missing conf file caused problem with starting
the ifp service.
Simple patch is attached.
LS
9 years, 10 months