sssd-devel June 2016

sssd-devel@lists.fedorahosted.org

11 participants
64 discussions

[PATCH] libwbclient: wbcSidsToUnixIds() don't fail on errors
by Sumit Bose 07 Jun '16

07 Jun '16

Hi, this patch fixes an issue in SSSD's implementation of libwbclient. wbcSidsToUnixIds() translates a list of SID to POSIX IDs and it is expected that if one SID cannot be mapped the related output entry should just get type WBC_ID_TYPE_NOT_SPECIFIED. Currently the request fail completely if one SID cannot be mapped. To test, use 'wbinfo --sids-to-unix-ids' with an invalid SID. Without fix: $ wbinfo --sids-to-unix-ids=S-1-5-21-3692237560-1981608775-3610128199-1104,S-1-5-21-3692237560-1981608775-3610128199-5 wbcSidsToUnixIds failed: WBC_ERR_UNKNOWN_FAILURE wbinfo_sids_to_unix_ids failed With fix: $ wbinfo --sids-to-unix-ids=S-1-5-21-3692237560-1981608775-3610128199-1104,S-1-5-21-3692237560-1981608775-3610128199-5 S-1-5-21-3692237560-1981608775-3610128199-1104 -> uid 700201104 S-1-5-21-3692237560-1981608775-3610128199-5 -> unmapped Even with completely random SIDs you should see a proper output: $ wbinfo --sids-to-unix-ids=S-2-3-4,S-5-6-7 S-2-3-4 -> unmapped S-5-6-7 -> unmapped bye, Sumit

3 4

[PATCHES] Support starting SSSD from a default configuration
by Stephen Gallagher 03 Jun '16

03 Jun '16

These patches provide support for shipping a default configuration file that the monitor will automatically copy to /etc/sssd/sssd.conf if none already exists. The idea is for distributions to be able to provide a default (and resettable) configuration for out-of-the-box behavior. I considered writing the patch to check /etc/sssd and then check /usr/lib*/sssd in turn, but I realized that this would be too complicated with the infopipe interactions (which would need to be updated to do a copy-on-write the first time they changed something). It was simpler to just always create the /etc version and use that. Patch 0001: Create a secure copy function that can be used to duplicate the default configuration Patch 0002: Cosmetic patch; changes the name of an internal macro variable to make it clear that it's the active configuration file, not the default one. Patch 0003: Add the logic to confdb_setup.c to copy over the default configuration if and only if our attempt to load the configuration came up with ERR_MISSING_CONF. It will then try to load it again and proceed or fail from there. The default configuration provided here is to load the SSSD with a single proxy provider that reads from nss_files (and supports authentication through pam_unix). This does not have to be shipped with any downstream package; the idea is that downstreams would be expected to modify this configuration to their own needs. This would need to be called out in the release announcement for whatever version of SSSD incorporates this change. These patches will require a change to the SELinux policy, since the monitor needs to be able to write to the /etc/sssd directory. type=AVC msg=audit(1461088081.353:550): avc: denied { write } for pid=3721 comm="sssd" name="sssd" dev="dm-0" ino=4600013 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:sssd_conf_t:s0 tclass=dir permissive=0 Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access.

3 9

[PATCH] GPO: Add "polkit-1" to ad_gpo_map_allow
by Stephen Gallagher 03 Jun '16

03 Jun '16

Polkit is an authorization mechanism of its own (similar to sudo). SSSD doesn't need to apply additional authorization decisions atop it, so we'll just accept it as "allow". Resolves: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1578415

3 3

[PATCH] LDAP: Try also the AD access control for IPA users
by Jakub Hrozek 03 Jun '16

03 Jun '16

Hi, the attached patch implements Sumit's idea to solve https://fedorahosted.org/sssd/ticket/2927 The user who reported the bug confirmed that the patch works. As an additional improvement, they requested that these results should not be considered when the cache expires, but immediatelly. But honestly I don't know if and how this could be solved (we would need to fetch this attribute always on initgroups on both client and server..) so I would prefer additional ticket and merge this patch first.

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel June 2016