The attached patch adds exporting of the original (non-overridden) user shell
to tlog-rec, during the PAM session opening. The shell is exported via adding
variable "TLOG_REC_SHELL" to the user's environment.
This is supposed to be used within the preliminary session recording solution,
which employs tlog . The administrators are supposed to setup session
recording with SSSD by adding local overrides of the user shell to
"/usr/bin/tlog-rec". When tlog-rec is spawned in the role of the shell, it
sets up terminal I/O recording and then spawns the shell specified in
This can be tested by logging as any user and checking if TLOG_REC_SHELL
variable is set to the original (non-overridden) shell.
This is a draft patch and code and design change suggestions are welcome.
On 11/23/2015 04:32 PM, Petr Spacek wrote:
> On 23.11.2015 13:53, Pavel Reichl wrote:
>> On 11/20/2015 05:35 PM, Jakub Hrozek wrote:
>>> On Fri, Nov 20, 2015 at 03:57:04PM +0100, Pavel Reichl wrote:
>>>> please see attached patch.
>>> Could you ask Petr Spacek to do a conceptual review? Somebody else (me
>>> of noone else is interested) can then do the code-review but I don't
>>> think our team has as good experience in handling nsupdate details..
>> Hello Petr, could you do the conceptual review as Jakub wishes?
>> I hope it should not be too hard as what we change in the patches is
>> generation of a textual message for nsupdate and it's tested I dare to say
> Sure, just send me a link :-) I do not see it the message above.
Sure, hope the link will work for you:
these three patches add infrastructure for this libini feature
I did not add the patch for ini_allowed_sections validator. Will
add that validator when these patches are in master.
I also did not bump the version number for now. Will do this
Any comments are welcome.
I'm working on pam_sss.so tests and I ran into a problem that I don't
know how to solve best.
tl;dr, I would like to set different environment variables for different
tests in order to set up cwrap libraries differently per-test.
I can't use setenv() in the test itself, because that's too late, I need
the variables to be set when __attribute__(constructor) is run, so normally
at program startup, when the libraries are loaded.
With cmake it's easy, use set(TEST_ENVIRONMENT). But with autotools, I
only found two ways:
- TESTS_ENVIRONMENT - this is fine, but it's per Makefile.am. So I
would have to split the tests more, into pam_wrapper tests that also
require uid_wrapper, tests that only require pam_wrapper, ...
- LOG_COMPILER - this allows to run a wrapper script before a test
that receives the test name as argv. So this is pretty much what I
want except this is a feature new to automake 1.12, which would
rule out both RHEL-6 and Ubuntu Trusty (which is used by Travis)
So I'm really leaning towards creating a src/tests/cwrap/pwrap/Makefile.am
and src/tests/cwrap/pwrap_root/Makefile.am. The downside of multiple
Makefile.am files is that there is some code duplication and the build
takes longer. But I still think there is enough interest (from us and from
our users) to support git master on old platforms. I can file a ticket to
remove this and use LOG_COMPILER when we drop support for RHEL-6 and old
If you disagree, please reply, otherwise I'm going to send a patch with
42% code coverage, up from 0% last week. Woo!
please see attached patch set which contains some refactoring which is
in my opinion quite safe. It doesn't touch the recursive call of
pam_reply() as I think that changing that would be more risky change.
I saw some integration tests failures recently,
and I think there is a race condition between the
enumeration refresh timeout and the sleeps
after some operations that wait for this timeout.
SSSD fails to populate changes from LDAP in time
and some asserts can fail because of this.
So far I saw 4 tests to fail like this, which
is already quite a lot.
The attached patch modifies the timeout values
and hopefully removes the issue.
this patch-set should solve https://fedorahosted.org/sssd/ticket/2158 by
moving the main processing of the PAC data to the backends. The PAC
responder now only has to send one request to the backend to look up the
user based on its SID if the user's SID was not found in the cache. I
used the new cache_req here so the patches depend on Pavel's latest
cache_req patches which are currently under review.
Since new IPA server can provided group-membership data to IPA clients
via the extdom plugin the most important test-cases are currently
against older IPA servers e.g. version 3.3.3 provided by RHEL/CentOS 7.0
(7.1 already has a newer version with enhanced extdom plugin).
attached two patches resolve . This ticket has design page .
In my opinion it could be fine to have tests on sysdb_sudo. I have
started write some, but there were troubles with memory leak. Maybe I
haven't understood necessary logic properly.
However I could continue with tests or create new ticket for it.
And little question. Is the name of sudo rule case sensitive? If yes, I
have to do one little change.