[PATCHES] Sig handlers cleanups
by Simo Sorce
While checking if our custom signal handlers properly handle errno, I
stumbled on a few cleanups, they are attached.
turns out our few signal hanlders are errno safe, and tevent signal
handling function is also fine.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
9 years, 2 months
[PATCH] Fix usage of talloc_steal
by Lukas Slebodnik
ehlo,
talloc_steal is a macro around function _talloc_steal_loc
and returns the pointer that you pass it. It does not have any failure modes.
If the output value is ignored there are compiler warnings.
Example of warning
src/util/util.c:503:164: warning: expression result unused [-Wunused-value]
({ __typeof__(internal_ctx) __talloc_steal_ret = (__typeof__(internal_ctx))_talloc_steal_loc((table),(internal_ctx), "../sssd/src/util/util.c" ":" "503"); __talloc_steal_ret; });
^~~~~~~~~~~~~~~~~~
1 warning generated.
I am opened to better solution of this warning.
LS
9 years, 2 months
[PATCH] responder: new interface for cache request
by Pavel Březina
Hi,
this patch set is based on Jakub's original code. The goal was to reduce
code duplication among responders - the part that iterates over domains
and performs a cache lookup and data provider communication if object is
staled.
The first three patches are preparation for unit tests to allow testing
with multi domain environment. The forth patch is the new interface. The
fifth patch enables views with this interface - I made it a separate
commit so the changes can be more easily spotted.
And finally the last patch make IFP to use this new interface. Only IFP
uses it at the moment so we can find potential bugs without hitting NSS
and other responders.
9 years, 2 months
Master branch is now tracking development of SSSD 1.13
by Jakub Hrozek
Hi,
I branched off sssd-1-12, which means that a) we can finally push some
patches that were delayed because we wanted to avoid breaking 1.12 and
b) all patches that should be fixed in 1.12.x need to be pushed to both
sssd-1-12 and master.
Happy coding!
9 years, 2 months
Announcing SSSD 1.12.3
by Jakub Hrozek
=== SSSD 1.12.3 ===
The SSSD team is proud to announce the release of version 1.12.3 of
the System Security Services Daemon.
As always, the source is available from https://fedorahosted.org/sssd
RPM packages will be made available for Fedora 21 and rawhide shortly.
== Feedback ==
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
== Highlights ==
* This is mostly a bug fixing release with only minor enhancements visible
to the end user
* Contains many fixes and enhancements related to the ID views functionality of
FreeIPA servers
* SSSD now allows the IPA client to move from one ID view to another
after SSSD restart
* It is possible to apply ID views to IPA domains as well. Previous SSSD
versions only allowed views to be applied to AD trusted domains
* Overriding SSH public keys is supported in this release
* This release contains several fixes and enhancements related to users
and groups from trusted AD domains
* When a trusted AD domain is disabled on the server side, access is
denied for users logging in from these domains
* External group memberships (i.e. memberships in IPA groups) are now
resolved correctly for trusted AD users
* The localauth plugin configuration is written into the pubconf directory
which should be included from krb5.conf on IPA clients. As a result,
the localauth plugin should be configured automatically on IPA clients.
* Password change when One-Time-Passwords are used was fixed
* The tokenGroups support was disabled by default in the LDAP provider. The
tokenGroups support is still enabled by default in the AD provider
* Simple access provider skips user or group names that can't be resolved
if only allow rules are configured
== Packaging Changes ==
* Support for running SSSD as a non-privileged user was added. SSSD's
directories must be owned by this user, hence SSSD needs to be
configured properly at build time, using the new configure option
--with-sssd-user. Additionally, the non-privileged user must also be
selected in sssd.conf using the "user" configuration option.
== Documentation Changes ==
* A new configuration option "krb5_confd_path" was added. This option
specifies the directory where SSSD places Kerberos configuration snippets.
* The default value of "ldap_user_uuid" was changed to be "objectSID"
for the AD back end and unset for all other back ends.
* The option "ldap_use_tokengroups" changed its default value to True
for AD and IPA providers only.
* The "allowed_shells" option newly accepts the wildcard ("*") value, allowing any shell
== Tickets Fixed ==
https://fedorahosted.org/sssd/ticket/1195
4 functions with reference leaks within sssd (src/python/pyhbac.c)
https://fedorahosted.org/sssd/ticket/1939
Create unit test for be_ptask
https://fedorahosted.org/sssd/ticket/2102
disable midpoint refresh for netgroups if ptask refresh is enabled
https://fedorahosted.org/sssd/ticket/2219
Shell fallback mechanism in SSSD
https://fedorahosted.org/sssd/ticket/2370
sssd should run under unprivileged user
https://fedorahosted.org/sssd/ticket/2372
SELinux: Audit changes to the SELinux label files
https://fedorahosted.org/sssd/ticket/2404
Remove password from the PAM stack if OTP is used
https://fedorahosted.org/sssd/ticket/2430
sssd segfaults repeatedly with error 4 in memberof.so
https://fedorahosted.org/sssd/ticket/2439
Return a different errno from client when sssd is not running.
https://fedorahosted.org/sssd/ticket/2445
Race condition while invalidating memory cache in client code
https://fedorahosted.org/sssd/ticket/2451
sssd-ldap man page changes, add 'access_provider = ldap' as a requirement 'ldap_access_order = for lockout'
https://fedorahosted.org/sssd/ticket/2454
[RFE] Views: apply user SSH public key override
https://fedorahosted.org/sssd/ticket/2456
Error message not helpful if extdom lookup fails
https://fedorahosted.org/sssd/ticket/2460
service lookups returned in lowercase with case_sensitive=preserving
https://fedorahosted.org/sssd/ticket/2461
Proxy Provider: Fails to lookup case sensitive users and groups with case_sensitive=preserving
https://fedorahosted.org/sssd/ticket/2462
Manpage description of case_sensitive=preserving is incomplete
https://fedorahosted.org/sssd/ticket/2464
Use ldap_extra_attrs when requesting attributes from extdom plugin
https://fedorahosted.org/sssd/ticket/2467
Set the right permissions in Makefile.am when installing from source
https://fedorahosted.org/sssd/ticket/2468
Don't set the umask in the utility function that creates sockets
https://fedorahosted.org/sssd/ticket/2470
refactor create_pipe_fd()
https://fedorahosted.org/sssd/ticket/2473
RFE: Add a configuration option to specify where a snippet with sssd_krb5_localauth_plugin.so is generated
https://fedorahosted.org/sssd/ticket/2475
Wrong results returned with enumeration
https://fedorahosted.org/sssd/ticket/2477
SSSD doesn't tell that it can't start because of no longer existent ID range
https://fedorahosted.org/sssd/ticket/2481
ID Views implementation does not support IPA user&group overrides
https://fedorahosted.org/sssd/ticket/2484
Password change over ssh doesn't work with OTP and FreeIPA
https://fedorahosted.org/sssd/ticket/2487
sssd does not work with custom value of option re_expression
https://fedorahosted.org/sssd/ticket/2490
dereferencing failure against openldap server
https://fedorahosted.org/sssd/ticket/2492
Group membership gets lost in IPA server mode
https://fedorahosted.org/sssd/ticket/2498
"debug_timestamps = false" and "debug_microseconds = true" do not work after enabling journald with sssd.
https://fedorahosted.org/sssd/ticket/2501
pam_sss domains option: Untrusted users from the same domain are allowed to auth.
https://fedorahosted.org/sssd/ticket/2503
Use the MEMORY ccache to pass around keytab contents
https://fedorahosted.org/sssd/ticket/2506
Check unlink return values to silence Coverity warnings
https://fedorahosted.org/sssd/ticket/2510
The Kerberos provider is not properly views-aware
https://fedorahosted.org/sssd/ticket/2512
selinuxusermap rule does not apply to trusted AD users
https://fedorahosted.org/sssd/ticket/2514
gid is overridden by uid in default trust view
https://fedorahosted.org/sssd/ticket/2516
pam_sss domains option: User auth should fail when domains=<emtpy value>
https://fedorahosted.org/sssd/ticket/2518
SSSD master doesn't build on RHEL-6
https://fedorahosted.org/sssd/ticket/2519
SSSD should not fail authentication when only allow rules are used
https://fedorahosted.org/sssd/ticket/2520
Crash in function get_object_from_cache
https://fedorahosted.org/sssd/ticket/2521
be_ptask unit test fails sometimes
https://fedorahosted.org/sssd/ticket/2524
getent fails for posix group with AD users after login
https://fedorahosted.org/sssd/ticket/2526
User is unable to authenticate if the option krb5_fast_principal is NULL
https://fedorahosted.org/sssd/ticket/2529
IPA: incomplete group memberships for AD users on IPA clients
https://fedorahosted.org/sssd/ticket/2530
MAN: Document that only usernames are checked for pam_trusted_uids
https://fedorahosted.org/sssd/ticket/2535
Access is not rejected for disabled domain
https://fedorahosted.org/sssd/ticket/2537
sssd-libwbclient conflicts with Samba's and causes crash in wbinfo
== Detailed Changelog ==
Carlos A. Munoz (1):
* Add zanata.xml file for integration with Zanata command line client
Dan Lavu (3):
* MAN PAGE: modified sssd-ldap.5.xml for sssd ticket #2451
* MAN: page edit for ldap_use_tokengroups
* MAN: Clarify ad_gpo_map* options
Denis Kutin (1):
* NSS: Possibility to use any shells in 'allowed_shells'
Jakub Hrozek (68):
* Updating the version for the 1.12.3 development
* SSSD: Add the options to specify a UID and GID to run as
* SSSD: Chown the log files
* UTIL: Use a custom PID_PATH and DB_PATH when unit testing server.c
* TESTS: Unit tests can use confdb without using sysdb
* TESTS: Unit tests for server_setup
* RPM: Package the libsss_semanage.so library
* IPA: Handle NULL members in process_members()
* UTIL: Add a function to convert id_t from a number or a name
* BUILD: Add a config option for sssd user, own private directories as the user
* RPM: Change file ownership to sssd.sssd
* SSSD: Load a user to run a service as from configuration
* SBUS: Chown the sbus socket if needed
* SBUS: Allow connections from other UIDs
* BE: Own the sbus socket as the SSSD user
* NSS: Run as a user specified by monitor
* TEST: Unit test for create_pipe_fd
* AUTOFS: Run the autofs responder as the SSSD user
* PAC: Run the pac responder as the SSSD user
* SUDO: Run the sudo responder as the SSSD user
* SSH: Run the ssh responder as the SSSD user
* GPO: Terminate request on error
* TESTS: Add tests for the views-related option maps
* IPA: Don't fail the request when BE doesn't find the object
* IPA: Rename user_dom into obj_dom
* BUILD: Install ldap_child and as setuid if running under non-privileged user
* LDAP: Move sss_krb5_verify_keytab_ex to ldap_child
* LDAP: read the correct data type from ldap_child's input buffer
* LDAP: Drop privileges after kinit in ldap_child
* UTIL: Remove code duplication of struct io
* UTIL: Remove more code duplication setting up child processes
* IPA: Move setting the SELinux context to a child process
* BE: Make struct bet_queue_item private to sssd_be
* BUILD: Install krb5_child as suid if running under non-privileged user
* KRB5: Drop privileges in the child, not the back end
* KRB5: Move ccache-related functions to krb5_ccache.c
* KRB5: Move checking for illegal RE to krb5_utils.c
* KRB5: Move all ccache operations to krb5_child.c
* KRB5: Do not switch_creds() if already the specified user
* BUILD: Use separate chown to make changing ownership to the sssd user non-fatal
* BUILD: Make chown of files to sssd user non-fatal
* BUILD: Touch files in DESTDIR
* BE: Become a regular user after initialization
* BE: Fix a debug message
* IPA: Handle IPA groups returned from extop plugin
* Hint about removing sysdb if initializing ID map fails
* PAM: Make pam_forwarder_parse_data static
* SBUS: Initialize DBusError before using it
* PAM: Check for trusted domain before sending the request to BE
* PAM: Move is_uid_trusted from pam_ctx to preq
* TESTS: Basic child tests
* Add extra_args to exec_child()
* KRB5: Create the fast ccache in a child process
* LDAP: Remove useless include
* sss_atomic_write_s() return value is signed
* KRB5: Relax DEBUG message
* TESTS: Build test_child even without cmocka
* Rename test-child to dummy-child
* CI: Suppress memory errors from poptGetNextOpt
* tests: Free popt_context
* IFP: Return group names with the right case
* KRB5: Check FAST kinit errors using get_tgt_times()
* Skip CHAUTHTOK_PRELIM when using OTPs
* PAM: Domain names are case-insensitive
* PAM: Missing argument to domains= should fail auth
* MAN: Misspelled username in pam_trusted_users is not fatal
* RESPONDER: Log failures to resolve user names in csv_string_to_uid_array
* Updating translations for the 1.12.3 release
Lukas Slebodnik (28):
* BUILD: Fix automake warning
* test_server: Fix waiting for background process
* SPEC: Print testsuite log for failed test
* SBUS: Fix error handling after closing container
* BUILD: Fix linking cwrap tests with -Wl,--as-needed
* test_sysdb_views: Use unique directory for cache
* IPA: Store right username to selinux child context
* PAM: Remove authtok from PAM stack with OTP
* NSS: Fix warning enumerated type mixed with another type
* Revert "LDAP: Change defaults for ldap_user/group_objectsid"
* AD: Change level of debug message
* CI: Build sssd on debian with samba support
* LDAP: Disable token groups by default
* sss_client: Extract destroying of mmap cache to function
* sss_client: Fix race condition in memory cache
* krb5: Check return value of krb5_principal_get_realm
* krb5: Check return value of sss_krb5_princ_realm
* AD: Set dp_error if gc was not used
* TOOLS: sss_debuglevel should worh with ifp responder
* CI: Update valgrind suppresion database for libselinux
* IPA: Do not append domain name to fq name
* sss_client: Work around glibc bug
* MAKE: Fix linking of test_child_common
* UTIL: Fix dependencies of internal sss libraries
* BUILD: Install libsss_crypt after its dependencies
* MONITOR: Disable inlining of function load_configuration
* krb5_child: Initialize REALM earlier
* IPA: properly handle groups from different domains
Michal Zidek (21):
* util: Move semanage related functions to src/util
* sss_semanage: Add mlsrange parameter to set_seuser
* IPA: Use set_seuser instead of writing selinux login file
* MONITOR: Allow confdb to be accessed by nonroot user
* SYSDB: Allow calling chown on the sysdb file from monitor
* responder_common: Create fd for pipe in helper
* responders: Do not initialize pipe fd if already present
* PAM: Create pipe file descriptors before privileges are dropped
* PAM: Run pam responder as nonroot
* nss: preserve service name in getsrv call
* MONITOR: Fix warning may be used uninitialized
* selinux_child: Do not ignore return values.
* proxy: Do not try to store same alias twice
* PROXY: Preserve service name in proxy provider
* MAN: Update case_sensitive=Preserving in man pages.
* Man: debug_timestamps and debug_microseconds
* test: Wrong parameter type in sss_parse_name_check
* util: Special-case PCRE_ERROR_NOMATCH in sss_parse_name
* util: sss_get_domain_name regex mismatch not fatal
* confdb: Make confdb_set_string accept const char pointer
* AD: Never store case_sensitive as "true" to confdb
Nikolai Kondrashov (1):
* CI: Remove Clang analyzer
Pavel Březina (8):
* IPA: use ipaUserGroup object class for groups
* be_ptask: create a private header file
* be_ptask: handle OFFLINE_DISABLE mode before task execution
* be_ptask: add next_execution time to struct be_ptask
* be_ptask: do not store sync ctx to _task
* tests: be_ptask
* be_ptask: let backoff affect only period
* be_ptask: use gettimeofday() instead of time()
Pavel Reichl (20):
* TESTS: Add -std=gnu99 to cwrap tests CFLAGS
* Fix debug messages - trailing '.'
* pyhbac,pysss: fix reference leaks
* RESPONDERS: refactor create_pipe_fd()
* RESPONDERS: Don't hard-code umask value in utility function
* RESPONDERS: Set default value for umask
* CONFDB: Detect&fix misconf opt refresh_expired_interval
* NSS: disable midpoint refresh for netgroups
* SYSDB: sysdb_idmap_get_mappings returns ENOENT
* Fix: always check return value of unlink()
* BUILD: restrict perms. when installing from source
* SYSDB: sysdb_get_bool() return ENOENT & unit tests
* simple access provider: non-existing object
* simple-access-provider: break matching allowed users
* LDAP: retain external members
* TESTS: sysdb_delete_by_sid() test return value
* NSS: nss_cmd_getbysid_search return ENOENT
* SYSDB: sysdb_search_object_by_sid returns ENOENT
* CONFDB: Typo in debug message
* TESTS: typo in 'assert message'
Stephen Gallagher (1):
* monitor: Service restart fixes
Sumit Bose (48):
* ipa: fix issues with older servers not supporting views
* ipa: improve error reporting for extdom LDAP exop
* ipa_subdomains_handler_master_done: initialize reply_count
* nss: group enumeration fix
* sdap_print_server: use getpeername() to get server address
* IFP: Fix typo in debug message
* memberof: check for empty arrays to avoid segfaults
* Add add_strings_lists() utility function
* IPA: inherit ldap_user_extra_attrs to AD subdomains
* Add parse_attr_list_ex() helper function
* nss: parse user_attributes option
* nss: return user_attributes in origbyname request
* sysdb_get_user_attr_with_views: add mandatory override attributes
* sysdb_add_overrides_to_object: add new parameter and multi-value support
* Views: apply user SSH public key override
* Add test for sysdb_add_overrides_to_object()
* Add ssh pubkey to origbyname request
* Revert "LDAP: Remove unused option ldap_user_uuid"
* Revert "LDAP: Remove unused option ldap_group_uuid"
* Fix uuid defaults
* sysdb: add sysdb_search_object_by_uuid()
* ipa: add split_ipa_anchor()
* LDAP: add support for lookups by UUID
* LDAP: always store UUID if available
* ipa: add get_be_acct_req_for_uuid()
* IPA: make get_object_from_cache() public
* IPA: check overrrides for IPA users as well
* Enable views for all domains
* Fix KRB5_CONF_PATH
* AD/IPA: add krb5_confd_path configuration option
* sysdb: add sysdb_delete_view_tree()
* sysdb: add sysdb_invalidate_overrides()
* views: allow view name change at startup
* krb5: make krb5 provider view aware
* IPA: only update view data if it really changed
* krb5: do not fail if checking the old ccache failed
* test: avoid leaks in leak tests
* krb5: add copy_ccache_into_memory()
* krb5: add copy_keytab_into_memory()
* ldap_child: copy keytab into memory to drop privileges earlier
* krb5_child: become user earlier
* krb5: add wrapper for krb5_kt_have_content()
* krb5: handle KRB5KRB_ERR_GENERIC as unspecific error
* IPA: verify group memberships of trusted domain users
* IPA: do not try to add override gid twice
* IPA: handle GID overrides for MPG domains on clients
* libwbclient: initialize some return values
* Add test for sysdb_store_override
9 years, 2 months