[sssd PR#586][opened] SSH: Do not exit abruptly if SSHD closes its end of the pipe before reading all the SSH keys
by jhrozek
URL: https://github.com/SSSD/sssd/pull/586
Author: jhrozek
Title: #586: SSH: Do not exit abruptly if SSHD closes its end of the pipe before reading all the SSH keys
Action: opened
PR body:
"""
Resolves: https://pagure.io/SSSD/sssd/issue/3747
Before writing the keys to sshd, ignore SIGPIPE so that if the pipe towards
the authorizedkeys helper is closed, the sss_ssh_authorizedkeys helper is
not terminated with SIGPIPE, but instead proceeds and then the write(2)
calls would non-terminally fail with EPIPE.
The other patch in this PR is not meant to be pushed. It is an easy way to
reproduce the bug. I would also like to write an integration test, but
I'm not sure if I can do that very soon and given that we try to release
in about a week I prefer to send the fix first.
In order to reproduce, load many SSH keys to a user object. I found it was
easiest to cheat during reproducing and do this:
- first, set a long cache expire so that the cache doesn't expire
and overwrite your local changes
- ldbedit the cache
- copy the ssh public key attribute and each time, change one character
in the attribute (ldb would otherwise detect the duplicates)
- save the ldbedit window
- run the program from the second patch. With the sss_ssh_authorizedkeys
patch in, the sss_ssh_authorizedkeys binary should finish gracefully,
without the patch, it would fail with SIGPIPE.
In my testing, I needed about 30 ssh keys to reproduce the bug.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/586/head:pr586
git checkout pr586
5 years, 10 months
all tests fail in intgcheck
by Chris Kowalczyk
Hello All,
I have been trying to run sssd intgcheck for some time. Thanks to your
help, there is some progress but I am not 'there' yet..
So, I managed to build the tests by using the following command:
> make intgcheck INTGCHECK_CONFIGURE_FLAGS="
--build=$SSS_ARCH-unknown-linux-gnu \
--host=$SSS_ARCH-unknown-linux-gnu \
--program-prefix= \
--prefix=/usr \
--exec-prefix=/usr \
--bindir=/usr/bin \
--sbindir=/usr/sbin \
--sysconfdir=/etc \
--datadir=/usr/share \
--includedir=/usr/include \
--libdir=$SSS_LIBDIR \
--libexecdir=/usr/libexec \
--localstatedir=/var \
--sharedstatedir=/var/lib \
--mandir=/usr/share/man \
--infodir=/usr/share/info \
--enable-nsslibdir=/$SSS_LIB \
--enable-pammoddir=/$SSS_LIB/security \
--with-krb5-rcache-dir=/var/cache/krb5rcache \
--with-initscript=systemd \
--with-syslog=journald \
--enable-all-experimental-features \
--cache-file=/tmp/sssd/fileconfig.cache \
--with-test-dir=/tmp/sssd/tests "
> echo $SSS_LIBDIR
/usr/lib64
> echo $SSS_LIB
lib64
This command is based on:
https://github.com/SSSD/sssd/blob/master/contrib/fedora/bashrc_sssd
The tests run but they (almost) all fail. What I discovered is that the
created test folder is rather empty:
/tmp/sssd-intg.33or699m
$ tree
.
├── etc
│ └── ldap
└── var
├── lib
└── run
5 directories, 0 files
( BTW, shouldn't the test folder be /tmp/sssd/tests, as I specified in
the make command? )
I was trying to modify various things but to no success - the test
folders were always empty. As a result, I get many errors from the
testcases like: "/tmp/sssd-intg.33or699m/etc/sssd/sssd.conf" or
"/tmp/sssd-intg.33or699m/lib64/getsockopt_wrapper.so".
Would you have any idea how to 'properly' point everything to be put
into those test folders?
Kind regards,
Chris
5 years, 10 months
Announcing SSSD 1.16.2
by Jakub Hrozek
SSSD 1.16.2
===========
The SSSD team is proud to announce the release of version 1.16.2 of the
System Security Services Daemon.
The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/
RPM packages will be made available for Fedora shortly.
Feedback
--------
Please provide comments, bugs and other feedback via the sssd-devel or
sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Highlights
----------
New Features
^^^^^^^^^^^^
* The smart card authentication, or in more general certificate authentication
code now supports OpenSSL in addition to previously supported NSS (#3489).
In addition, the SSH responder can now return public SSH keys derived from
the public keys stored in a X.509 certificate. Please refer to the
``ssh_use_certificate_keys`` option in the man pages.
* The files provider now supports mirroring multiple passwd or group
files. This enhancement can be used to use the SSSD files provider instead
of the nss_altfiles module
Notable bug fixes
^^^^^^^^^^^^^^^^^
* A memory handling issue in the ``nss_ex`` interface was fixed. This bug
would manifest in IPA environments with a trusted AD domain as a crash of
the ns-slapd process, because a ``ns-slapd`` plugin loads the ``nss_ex``
interface (#3715)
* Several fixes for the KCM deamon were merged (see #3687, #3671, #3633)
* The ``ad_site`` override is now honored in GPO code as well (#3646)
* Several potential crashes in the NSS responder's netgroup code were fixed
(#3679, #3731)
* A potential crash in the autofs responder's code was fixed (#3752)
* The LDAP provider now supports group renaming (#2653)
* The GPO access control code no longer returns an error if one of the
relevant GPO rules contained no SIDs at all (#3680)
* A memory leak in the IPA provider related to resolving external AD
groups was fixed (#3719)
* Setups that used multiple domains where one of the domains had its ID
space limited using the ``min_id/max_id`` options did not resolve requests
by ID properly (#3728)
* Overriding IDs or names did not work correctly when the domain resolution
order was set as well (#3595)
* A version mismatch between certain newer Samba versions (e.g. those shipped
in RHEL-7.5) and the Winbind interface provided by SSSD was fixed. To further
prevent issues like this in the future, the correct interface is now detected
at build time (#3741)
* The files provider no longer returns a qualified name in case domain
resolution order is used (#3743)
* A race condition between evaluating IPA group memberships and AD group
memberships in setups with IPA-AD trusts that would have manifested as
randomly losing IPA group memberships assigned to an AD user was fixed
(#3744)
* Setting an SELinux login label was broken in setups where the domain
resolution order was used (#3740)
* SSSD start up issue on systems that use the libldb library with version
1.4.0 or newer was fixed.
Packaging Changes
-----------------
* Several new build requirements were added in order to support the OpenSSL
certificate authentication
Documentation Changes
---------------------
* The files provider gained two new configuration options ``passwd_files``
and ``group_files.`` These can be used to specify the additional files
to mirror.
* A new ``ssh_use_certificate_keys`` option toggles whether the SSH responder
would return public SSH keys derived from X.509 certificates.
* The ``local_negative_timeout`` option is now enabled by default. This
means that if SSSD fails to find a user in the configured domains,
but is then able to find the user with an NSS call such as getpwnam,
it would negatively cache the request for the duration of the
local_negative_timeout option.
Tickets Fixed
-------------
* `3752 <https://pagure.io/SSSD/sssd/issue/3752>`_ - /usr/libexec/sssd/sssd_autofs SIGABRT crash daily due to a double free
* `3749 <https://pagure.io/SSSD/sssd/issue/3749>`_ - [RFE] sssd.conf should mention the FILES provider as valid config value for the 'id_provider'
* `3748 <https://pagure.io/SSSD/sssd/issue/3748>`_ - home dir disappear in sssd cache on the IPA master for AD users
* `3744 <https://pagure.io/SSSD/sssd/issue/3744>`_ - Race condition between concurrent initgroups requests can cause one of them to return incomplete information
* `3743 <https://pagure.io/SSSD/sssd/issue/3743>`_ - Weirdness when using files provider and domain resolution order
* `3742 <https://pagure.io/SSSD/sssd/issue/3742>`_ - Change of: User may not run sudo --> a password is required
* `3741 <https://pagure.io/SSSD/sssd/issue/3741>`_ - Samba can not register sss idmap module because it's using an outdated SMB_IDMAP_INTERFACE_VERSION
* `3740 <https://pagure.io/SSSD/sssd/issue/3740>`_ - Utilizing domain_resolution_order in sssd.conf breaks SELinux user map
* `3733 <https://pagure.io/SSSD/sssd/issue/3733>`_ - sssd fails to download known_hosts from freeipa
* `3728 <https://pagure.io/SSSD/sssd/issue/3728>`_ - Request by ID outside the min_id/max_id limit of a first domain does not reach the second domain
* `3726 <https://pagure.io/SSSD/sssd/issue/3726>`_ - SSSD with ID provider 'ad' should give a warning in case the ldap schema is manually changed to something different than 'ad'.
* `3725 <https://pagure.io/SSSD/sssd/issue/3725>`_ - sssd not honoring dyndns_server if the DNS update process is terminated with a signal
* `3719 <https://pagure.io/SSSD/sssd/issue/3719>`_ - The SSSD IPA provider allocates information about external groups on a long lived memory context, causing memory growth of the sssd_be process
* `3715 <https://pagure.io/SSSD/sssd/issue/3715>`_ - ipa 389-ds-base crash in krb5-libs - k5_copy_etypes list out of bound?
* `3706 <https://pagure.io/SSSD/sssd/issue/3706>`_ - Hide debug message domain not found for well known sid
* `3694 <https://pagure.io/SSSD/sssd/issue/3694>`_ - externalUser sudo attribute must be fully-qualified
* `3684 <https://pagure.io/SSSD/sssd/issue/3684>`_ - A group is not updated if its member is removed with the cleanup task, but the group does not change
* `3680 <https://pagure.io/SSSD/sssd/issue/3680>`_ - GPO: SSSD fails to process GPOs If a rule is defined, but contains no SIDs
* `3679 <https://pagure.io/SSSD/sssd/issue/3679>`_ - Make nss netgroup requests more robust
* `3674 <https://pagure.io/SSSD/sssd/issue/3674>`_ - The tcurl module logs the payload
* `3671 <https://pagure.io/SSSD/sssd/issue/3671>`_ - KCM: Payload buffer is too small
* `3666 <https://pagure.io/SSSD/sssd/issue/3666>`_ - Fix usage of str.decode() in our tests
* `3664 <https://pagure.io/SSSD/sssd/issue/3664>`_ - LOGS: Improve debugging in case the PAM service is not mapped to any GPO rule
* `3660 <https://pagure.io/SSSD/sssd/issue/3660>`_ - confdb_expand_app_domains() always fails
* `3658 <https://pagure.io/SSSD/sssd/issue/3658>`_ - Application domain is not interpreted correctly
* `3656 <https://pagure.io/SSSD/sssd/issue/3656>`_ - PyErr_NewExceptionWithDoc configure check should not use cached results for different python versions
* `3646 <https://pagure.io/SSSD/sssd/issue/3646>`_ - SSSD's GPO code ignores ad_site option
* `3644 <https://pagure.io/SSSD/sssd/issue/3644>`_ - sss_groupshow no longer labels MPG groups
* `3634 <https://pagure.io/SSSD/sssd/issue/3634>`_ - sssctl COMMAND --help fails if sssd is not configured
* `3633 <https://pagure.io/SSSD/sssd/issue/3633>`_ - Reset the last_request_time when any activity happens on Secrets and KCM responders
* `3629 <https://pagure.io/SSSD/sssd/issue/3629>`_ - Implement sss_nss_getsidbyuid and sss_nss_etsidbygid for situations where customers define UID == GID
* `3619 <https://pagure.io/SSSD/sssd/issue/3619>`_ - Enable local_negative_timeout by default
* `3605 <https://pagure.io/SSSD/sssd/issue/3605>`_ - Fix pep8 issues on our python files.
* `3595 <https://pagure.io/SSSD/sssd/issue/3595>`_ - ID override GID from Default Trust View is not properly resolved in case domain resolution order is set
* `3558 <https://pagure.io/SSSD/sssd/issue/3558>`_ - sudo: report error when two rules share cn
* `3550 <https://pagure.io/SSSD/sssd/issue/3550>`_ - refresh_expired_interval does not work with netgrous in 1.15
* `3520 <https://pagure.io/SSSD/sssd/issue/3520>`_ - Files provider supports only BE_FILTER_ENUM
* `3469 <https://pagure.io/SSSD/sssd/issue/3469>`_ - extend sss-certmap man page regarding priority processing
* `3436 <https://pagure.io/SSSD/sssd/issue/3436>`_ - Certificates used in unit tests have limited lifetime
* `3402 <https://pagure.io/SSSD/sssd/issue/3402>`_ - Support alternative sources for the files provider
* `3335 <https://pagure.io/SSSD/sssd/issue/3335>`_ - GPO retrieval doesn't work if SMB1 is disabled
* `2653 <https://pagure.io/SSSD/sssd/issue/2653>`_ - Group renaming issue when "id_provider = ldap" is set.
Detailed Changelog
------------------
* Fabiano Fidêncio (77):
* TESTS: Fix E501 pep8 issues on test_ldap.py
* TESTS: Fix E20[12] pep8 issues on python-test.py
* TESTS: Fix E501 pep8 issues on python-test.py
* TESTS: Fix E251 pep8 issues on python-test.py
* TESTS: Fix E231 pep8 issues on python-test.py
* TESTS: Fix E265 pep8 issues on python-test.py
* TESTS: Fix E128 pep8 issues on python-test.py
* TESTS: Fix E302 pep8 issues on python-test.py
* TESTS: Fix W391 pep8 issues on python-test.py
* TESTS: Fix E228 pep8 issues on python-test.py
* TESTS: Fix E261 pep8 issues on python-test.py
* TESTS: Fix E701 pep8 issues on python-test.py
* TESTS: Fix E305 pep8 issues on python-test.py
* TESTS: Fix E20[12] pep8 issues on pysss_murmur-test.py
* TESTS: Fix E211 pep8 issues on pysss_murmur-test.py
* TESTS: Fix E20[12] pep8 issues on pyhbac-test.py
* TESTS: Fix E261 pep8 issues on pyhbac-test.py
* TESTS: Fix W391 pep8 issues on pyhbac-test.py
* TESTS: Fix E501 pep8 issues on pyhbac-test.py
* TESTS: Fix E302 pep8 issues on pyhbac-test.py
* TESTS: Fix E305 pep8 issues on pyhbac-test.py
* TESTS: Fix E711 pep8 issues on sssd_group.py
* TESTS: Fix E305 pep8 issues on sssd_netgroup.py
* TESTS: Fix E501 pep8 issues on utils.py
* TESTS: Fix E305 pep8 issues on conf.py
* CONTRIB: Fix E501 pep8 issues on sssd_gdb_plugin.py
* CONTRIB: Fix E305 pep8 issues on sssd_gdb_plugin.py
* TESTS: Fix E302 pep8 issues on test_enumeration.py
* TESTS: FIX E501 pep8 issues on pysss_murmur-test.py
* CI: Enable pep8 check
* CI: Ignore E722 pep8 issues on debian machines
* TESTS: Fix E501 pep8 issues on test_netgroup.py
* NSS: Remove dead code
* CONFDB: Start a ldb transaction from sss_ldb_modify_permissive()
* TOOLS: Take into consideration app domains
* TESTS: Move get_call_output() to util.py
* TESTS: Make get_call_output() more flexible about the stderr log
* TESTS: Add a basic test of `sssctl domain-list`
* KCM: Use json_loadb() when dealing with sss_iobuf data
* KCM: Remove mem_ctx from kcm_new_req()
* KCM: Introduce kcm_input_get_payload_len()
* KCM: Do not use 2048 as fixed size for the payload
* KCM: Adjust REPLY_MAX to the one used in krb5
* KCM: Fix typo in ccdb_sec_delete_list_done()
* KCM: Only print the number of found items after we have it
* SERVER: Tone down shutdown messages for socket-activated responders
* MAN: Improve docs about GC detection
* NSS: Add InvalidateGroupById handler
* DP: Add dp_sbus_invalidate_group_memcache()
* ERRORS: Add ERR_GID_DUPLICATED
* SDAP: Add sdap_handle_id_collision_for_incomplete_groups()
* SDAP: Properly handle group id-collision when renaming incomplete groups
* SYSDB_OPS: Error out on id-collision when adding an incomplete group
* SECRETS: reset last_request_time on any activity
* KCM: reset last_request_time on any activity
* RESPONDER: Add sss_client_fd_handler()
* RESPONDER: Make use of sss_client_fd_handler()
* SECRETS: Make use of sss_client_fd_handler()
* KCM: Make use of sss_client_fd_handler()
* TESTS: Rename test_idle_timeout()
* TESTS: Add test for responder_idle_timeout
* TESTS: Fix typo in test_sysdb_domain_resolution_order_ops()
* SYSDB: Properly handle name/gid override when using domain resolution order
* TESTS: Increase test_resp_idle_timeout* timeout
* COVERITY: Add coverity support
* MAKE_SRPM: Add --output parameter
* Add .copr/Makefile
* CACHE_REQ: Don't force a fqname for files provider' output
* cache_req: Don't force a fqname for files provider output
* tests: Add a test for files provider + domain resolution order
* man: Users managed by the files provider don't have their output fully-qualified
* Revert "CACHE_REQ: Don't force a fqname for files provider' output"
* selinux_child: workaround fqnames when using DRO
* sudo_ldap: fix sudoHost=defaults -> cn=defaults in the filter
* Revert "sysdb custom: completely replace old object instead of merging it"
* sysdb_sudo: completely replace old object instead of merging it
* tlog: only log in tcurl_write_data when SSS_KCM_LOG_PRIVATE_DATA is set to YES
* Jakub Hrozek (33):
* Bumping the version to track 1.16.2 development
* IPA: Handle empty nisDomainName
* TESTS: Fix E266 pep8 issues on test_ldap.py
* TESTS: Fix E231 pep8 issues on test_session_recording.py
* TESTS: Fix E501 pep8 issues on test_session_recording.py
* TESTS: Fix E303 pep8 issues on test_ldap.py
* SYSDB: When marking an entry as expired, also set the originalModifyTimestamp to 1
* IPA: Qualify the externalUser sudo attribute
* NSS: Adjust netgroup setnetgrent cache lifetime if midpoint refresh is used
* TESTS: Add a test for the multiple files feature
* SDAP: Improve a DEBUG message about GC detection
* LDAP: Augment the sdap_opts structure with a data provider pointer
* TESTS: Add an integration test for renaming incomplete groups during initgroups
* SYSDB: sysdb_add_incomplete_group now returns EEXIST with a duplicate GID
* MAN: Document which principal does the AD provider use
* FILES: Do not overwrite and actually remove files_ctx.{pwd,grp}_watch
* FILES: Reduce code duplication
* FILES: Reset the domain status back even on errors
* FILES: Skip files that are not created yet
* FILES: Only send the request for update if the files domain is inconsistent
* DYNDNS: Move the retry logic into a separate function
* DYNDNS: Retry also on timeouts
* AD: Warn if the LDAP schema is overriden with the AD provider
* SYSDB: Only check non-POSIX groups for GID conflicts
* Do not keep allocating external groups on a long-lived context
* CACHE_REQ: Do not fail the domain locator plugin if ID outside the domain range is looked up
* MAN: Fix the title of the session recording man page
* DP/LDAP: Only increase the initgrTimestamp when the full initgroups DP request finishes
* LDAP: Do not use signal-unsafe calls in ldap_child SIGTERM handler
* AUTOFS: remove timed event if related object is removed
* RESPONDERS: Enable the local negative timeout by default
* LDAP: Suppress a loud debug message in case a built-in SID can't be resolved
* Updating the translations for the 1.16.2 release
* Justin Stephenson (3):
* DEBUG: Print simple allow and deny lists
* CONFDB: Add passwd_files and group_files options
* FILES: Handle files provider sources
* Lukas Slebodnik (21):
* CI: Add dbus into debian dependencies
* intg: convert results returned as bytes to strings
* SYSDB: Remove unused parameter from sysdb_cache_connect_helper
* SPEC: Add gcc to build dependencies
* UTIL: Use alternative way for detecting PyErr_NewExceptionWithDoc
* CONFIGURE: drop unused check
* SYSDB: Return ENOENT for mpg with local provider
* sysdb-tests: sysdb_search_group_by_name with local provider
* selinux_child: Allow to query sssd
* selinux_child: Fix crash with initialized key
* BUILD: Remove unnecessary flags from test_ipa_dn
* BUILD: Remove ldap libraries from SSSD_LIBS
* BUILD: Remove ldap libraries from TOOL_LIBS
* BUILD: Remove pcre libs from common _LIBS
* BUILD: Remove pcre from krb5_child
* BUILD: Remove libcollection form common libs
* BUILD: Reduce dependencies of sss_signal
* BUILD: Remove cares from sssd_secrets
* BUILD: Remove libini_config from common libs
* MONITOR: Do not use two configuration databases
* CI: Prepare for python3 -> python
* Michal Židek (6):
* AD: Missing header in ad_access.h
* GPO: Add ad_options to ad_gpo_process_som_state
* GPO: Use AD site override if set
* GPO: Fix bug with empty GPO rules
* GPO: DEBUG msg when GP to PAM mappings overlap
* GPO: Debugging default PAM service mapping
* Pavel Březina (3):
* sudo ldap: do not store rules without sudoHost attribute
* sysdb custom: completely replace old object instead of merging it
* sssctl: move check for version error to correct place
* Richard Sharpe (1):
* nss-imap: add sss_nss_getsidbyuid() and sss_nss_getsidbygid()
* Sumit Bose (38):
* intg: enhance netgroups test
* TESTS: simple CA to generate certificates for test
* TESTS: replace hardcoded certificates
* TESTS: remove NSS test databases
* test_ca: add empty index.txt.attr file
* nss: initialize nss_enum_index in nss_setnetgrent()
* nss: add a netgroup counter to struct nss_enum_index
* nss-idmap: do not set a limit
* nss-idmap: use right group list pointer after sss_get_ex()
* NSS: nss_clear_netgroup_hash_table() do not free data
* winbind idmap plugin: support inferface version 6
* winbind idmap plugin: fix detection
* p11_child: move verification into separate functions
* p11_child: add verification option
* utils: add get_ssh_key_from_cert()
* utils: move p11 child paths to util.h
* utils: add cert_to_ssh_key request
* tests: add test for cert_to_ssh_key request
* ssh: use cert_to_ssh_key request to verify certifcate and get keys
* ssh: add option ssh_use_certificate_keys and enhance man page
* utils: remove unused code from cert utils
* tests: add SSH responder tests
* p11_child: split common and NSS code into separate files
* p11_child: add OpenSSL support
* TESTS: make some cert auth checks order independent
* p11_child: allow tests to use OpenSSL version of p11_child
* certmap: fix issue found by Coverity in OpenSSL version
* SPEC/CI: enable openssl build for Debian and upcoming versions
* certmap: allow missing empty EKU in OpenSSL version
* KCM: be aware that size_t might have different size than other integers
* sysdb: add sysdb_getgrgid_attrs()
* ipa: use mpg aware group lookup in get_object_from_cache()
* ipa: allow mpg group objects in apply_subdomain_homedir()
* AD/LDAP: do not fall back to mpg user lookup on GC connection
* cifs idmap plugin: use new sss_nss_idmap calls
* winbind idmap plugin: use new sss_nss_idmap calls
* libwbclient-sssd: use new sss_nss_idmap calls
* pysss_nss_idmap: add python bindings for new sss_nss_idmap calls
* Thorsten Scherf (1):
* man: Add FILES as a valid config option for 'id_provider'
* Yuri Chornoivan (1):
* MAN: Fix minor typos
* amitkuma (1):
* sssctl: Showing help even when sssd not configured
* amitkumar50 (2):
* MAN: Add sss-certmap man page regarding priority processing
* MAN: Clarify how comments work in sssd.conf
5 years, 10 months