On 06/23/2016 05:50 PM, Michal Židek wrote:
> Lukas,
>
> did you have some local patches related to
> this patch, that you did not send here?
>
> Because I can not apply the patch on current
> master and the changes in the context of
> your patch seem like you did something with
> default config file path?
>
> Slightly modified version that applies on
> current master is attached (the changes
> are the same, but the context differs).
>
> Michal
>
I added the missing access check for
snippets. If the snippets does not
pass the access check it is skipped
and a loud debug message is logged.
I attach it as separate patch for
easier review, but it should be squashed
before pushing. I also attach the first
patch for convenience.
Michal
From 6299c0c9e2d07f0764be80e73334e3cdc2ba2b12 Mon Sep 17 00:00:00
2001
From: =?UTF-8?q?Michal=20=C5=BDidek?= <mzidek(a)redhat.com>
Date: Tue, 22 Mar 2016 14:09:34 +0100
Subject: [PATCH] confdb: Make it possible to use config snippets
Resolves:
https://fedorahosted.org/sssd/ticket/2247
Signed-off-by: Lukas Slebodnik <lslebodn(a)redhat.com>
---
Makefile.am | 4 ++-
src/confdb/confdb.h | 1 +
src/confdb/confdb_setup.c | 41 ++++--------------------
src/confdb/confdb_setup.h | 3 +-
src/external/libini_config.m4 | 12 +++++++
src/monitor/monitor.c | 6 ++--
src/util/sss_ini.c | 73 ++++++++++++++++++++++++++++++++++++++-----
src/util/sss_ini.h | 3 +-
8 files changed, 96 insertions(+), 47 deletions(-)
diff --git a/Makefile.am b/Makefile.am
index 7161bef..67fa639 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -3566,6 +3566,7 @@ SSSD_USER_DIRS = \
$(DESTDIR)$(pubconfpath) \
$(DESTDIR)$(pubconfpath)/krb5.include.d \
$(DESTDIR)$(gpocachepath) \
+ $(DESTDIR)$(sssdconfdir)/conf.d \
$(DESTDIR)$(sssdconfdir) \
$(DESTDIR)$(logpath) \
$(NULL)
@@ -3600,7 +3601,8 @@ endif
$(INSTALL) -d -m 0755 $(DESTDIR)$(mcpath) $(DESTDIR)$(pipepath) \
$(DESTDIR)$(pubconfpath) \
$(DESTDIR)$(pubconfpath)/krb5.include.d $(DESTDIR)$(gpocachepath)
- $(INSTALL) -d -m 0711 $(DESTDIR)$(sssdconfdir)
+ $(INSTALL) -d -m 0711 $(DESTDIR)$(sssdconfdir) \
+ $(DESTDIR)$(sssdconfdir)/conf.d
if HAVE_DOXYGEN
docs:
diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index c478ef0..9d9a887 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -41,6 +41,7 @@
#define CONFDB_DEFAULT_CFG_FILE_VER 2
#define CONFDB_FILE "config.ldb"
#define CONFDB_DEFAULT_CONFIG_FILE SSSD_CONF_DIR"/sssd.conf"
+#define CONFDB_DEFAULT_CONFIG_DIR SSSD_CONF_DIR"/conf.d"
#define SSSD_MIN_ID 1
#define SSSD_LOCAL_MINID 1000
#define CONFDB_DEFAULT_SHELL_FALLBACK "/bin/sh"
diff --git a/src/confdb/confdb_setup.c b/src/confdb/confdb_setup.c
index 694a7f0..3cfc8b0 100644
--- a/src/confdb/confdb_setup.c
+++ b/src/confdb/confdb_setup.c
@@ -125,14 +125,14 @@ int confdb_create_base(struct confdb_ctx *cdb)
return EOK;
}
-int confdb_init_db(const char *config_file, struct confdb_ctx *cdb)
+int confdb_init_db(const char *config_file, const char *config_dir,
+ struct confdb_ctx *cdb)
{
TALLOC_CTX *tmp_ctx;
int ret;
int sret = EOK;
int version;
char timestr[21];
- char *lasttimestr;
bool in_transaction = false;
const char *config_ldif;
const char *vals[2] = { timestr, NULL };
@@ -174,41 +174,12 @@ int confdb_init_db(const char *config_file, struct confdb_ctx *cdb)
goto done;
}
- /* Determine if the conf file has changed since we last updated
- * the confdb
+ /* FIXME: Determine if the conf file or any snippet has changed
+ * since we last updated the confdb or if some snippet was
+ * added or removed.
*/
- ret = sss_ini_get_stat(init_data);
- if (ret != EOK) {
- DEBUG(SSSDBG_FATAL_FAILURE,
- "Status check on config file failed.\n");
- ret = errno;
- goto done;
- }
-
- errno = 0;
-
- ret = sss_ini_get_mtime(init_data, sizeof(timestr), timestr);
- if (ret <= 0 || ret >= sizeof(timestr)) {
- DEBUG(SSSDBG_FATAL_FAILURE,
- "Failed to convert time_t to string ??\n");
- ret = errno ? errno : EFAULT;
- }
- ret = confdb_get_string(cdb, tmp_ctx, "config", "lastUpdate",
- NULL, &lasttimestr);
- if (ret == EOK) {
-
- /* check if we lastUpdate and last file modification change differ*/
- if ((lasttimestr != NULL) && (strcmp(lasttimestr, timestr) == 0)) {
- /* not changed, get out, nothing more to do */
- ret = EOK;
- goto done;
- }
- } else {
- DEBUG(SSSDBG_FATAL_FAILURE, "Failed to get lastUpdate attribute.\n");
- goto done;
- }
- ret = sss_ini_get_config(init_data, config_file);
+ ret = sss_ini_get_config(init_data, config_file, config_dir);
if (ret != EOK) {
DEBUG(SSSDBG_FATAL_FAILURE, "Failed to load configuration\n");
goto done;
diff --git a/src/confdb/confdb_setup.h b/src/confdb/confdb_setup.h
index 2b8802f..f4f03b4 100644
--- a/src/confdb/confdb_setup.h
+++ b/src/confdb/confdb_setup.h
@@ -47,6 +47,7 @@
int confdb_create_base(struct confdb_ctx *cdb);
int confdb_test(struct confdb_ctx *cdb);
-int confdb_init_db(const char *config_file, struct confdb_ctx *cdb);
+int confdb_init_db(const char *config_file, const char *config_dir,
+ struct confdb_ctx *cdb);
#endif /* CONFDB_SETUP_H_ */
diff --git a/src/external/libini_config.m4 b/src/external/libini_config.m4
index 9e5c69f..a2bba42 100644
--- a/src/external/libini_config.m4
+++ b/src/external/libini_config.m4
@@ -19,6 +19,18 @@ PKG_CHECK_MODULES(INI_CONFIG_V0, [
INI_CONFIG_LIBS="$INI_CONFIG_V1_1_LIBS"
HAVE_LIBINI_CONFIG_V1_1=1
AC_DEFINE_UNQUOTED(HAVE_LIBINI_CONFIG_V1_1, 1, [libini_config
version 1.1.0 or greater])
+ PKG_CHECK_MODULES(INI_CONFIG_V1_3, [
+ ini_config >= 1.3.0], [
+
+ INI_CONFIG_CFLAGS="$INI_CONFIG_V1_3_CFLAGS"
+ INI_CONFIG_LIBS="$INI_CONFIG_V1_3_LIBS"
+ HAVE_LIBINI_CONFIG_V1_3=1
+ AC_DEFINE_UNQUOTED(HAVE_LIBINI_CONFIG_V1_3, 1,
+ [libini_config version 1.3.0 or
greater])
+ ], [
+ AC_MSG_WARN([libini_config-devel >= 1.3.0 not
available, using older version])
+ ]
+ )
], [
AC_MSG_WARN([libini_config-devel >= 1.1.0 not available, using
older version])
]
diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
index ac3af28..e6bb624 100644
--- a/src/monitor/monitor.c
+++ b/src/monitor/monitor.c
@@ -1872,6 +1872,7 @@ static int monitor_ctx_destructor(void *mem)
*/
errno_t load_configuration(TALLOC_CTX *mem_ctx,
const char *config_file,
+ const char *config_dir,
struct mt_ctx **monitor)
{
errno_t ret;
@@ -1934,7 +1935,7 @@ errno_t load_configuration(TALLOC_CTX *mem_ctx,
goto done;
}
- ret = confdb_init_db(config_file, ctx->cdb);
+ ret = confdb_init_db(config_file, config_dir, ctx->cdb);
if (ret != EOK) {
DEBUG(SSSDBG_FATAL_FAILURE, "ConfDB initialization has failed [%s]\n",
sss_strerror(ret));
@@ -3189,7 +3190,8 @@ int main(int argc, const char *argv[])
}
/* Parse config file, fail if cannot be done */
- ret = load_configuration(tmp_ctx, config_file, &monitor);
+ ret = load_configuration(tmp_ctx, config_file, CONFDB_DEFAULT_CONFIG_DIR,
+ &monitor);
if (ret != EOK) {
switch (ret) {
case ERR_MISSING_CONF:
diff --git a/src/util/sss_ini.c b/src/util/sss_ini.c
index 766a75e..3dad18b 100644
--- a/src/util/sss_ini.c
+++ b/src/util/sss_ini.c
@@ -46,7 +46,10 @@
struct sss_ini_initdata {
char **error_list;
+ struct ref_array *ra_success_list;
+ struct ref_array *ra_error_list;
struct ini_cfgobj *sssd_config;
+ struct ini_cfgobj *orig_sssd_config;
struct value_obj *obj;
const struct stat *cstat;
struct ini_cfgfile *file;
@@ -205,13 +208,23 @@ void sss_ini_config_print_errors(char **error_list)
/* Load configuration */
int sss_ini_get_config(struct sss_ini_initdata *init_data,
- const char *config_file)
+ const char *config_file,
+ const char *config_dir)
{
int ret;
#ifdef HAVE_LIBINI_CONFIG_V1
+ const char *patterns[] = { "^[^\\.].*\\.conf", NULL };
+ const char *sections[] = { ".*", NULL };
+#ifdef HAVE_LIBINI_CONFIG_V1_3
+ uint32_t i = 0;
+ char *msg = NULL;
+#endif /* HAVE_LIBINI_CONFIG_V1_3 */
+
+ init_data->sssd_config = NULL;
+ init_data->ra_success_list = NULL;
/* Create config object */
- ret = ini_config_create(&(init_data->sssd_config));
+ ret = ini_config_create(&(init_data->orig_sssd_config));
if (ret != EOK) {
DEBUG(SSSDBG_FATAL_FAILURE,
"Failed to create config object. Error %d.\n", ret);
@@ -223,27 +236,73 @@ int sss_ini_get_config(struct sss_ini_initdata *init_data,
INI_STOP_ON_ANY,
INI_MV1S_OVERWRITE,
INI_PARSE_NOWRAP,
- init_data->sssd_config);
+ init_data->orig_sssd_config);
if (ret != EOK) {
DEBUG(SSSDBG_FATAL_FAILURE,
"Failed to parse configuration. Error %d.\n", ret);
- if (ini_config_error_count(init_data->sssd_config)) {
+ if (ini_config_error_count(init_data->orig_sssd_config)) {
DEBUG(SSSDBG_FATAL_FAILURE,
"Errors detected while parsing: %s\n",
ini_config_get_filename(init_data->file));
- ini_config_get_errors(init_data->sssd_config,
+ ini_config_get_errors(init_data->orig_sssd_config,
&init_data->error_list);
sss_ini_config_print_errors(init_data->error_list);
ini_config_free_errors(init_data->error_list);
}
- ini_config_destroy(init_data->sssd_config);
- init_data->sssd_config = NULL;
+ ini_config_destroy(init_data->orig_sssd_config);
+ init_data->orig_sssd_config = NULL;
+ return ret;
+ }
+
+ /* Create config object */
+ ret = ini_config_create(&(init_data->sssd_config));
+ if (ret != EOK) {
+ DEBUG(SSSDBG_FATAL_FAILURE,
+ "Failed to create config object. Error %d.\n", ret);
return ret;
}
+#ifdef HAVE_LIBINI_CONFIG_V1_3
+ ret = ini_config_augment(init_data->orig_sssd_config,
+ config_dir,
+ patterns,
+ sections,
+ NULL,
+ INI_STOP_ON_ANY,
+ INI_MV1S_OVERWRITE,
+ INI_PARSE_NOWRAP,
+ INI_MV2S_OVERWRITE,
+ &init_data->sssd_config,
+ &init_data->ra_error_list,
+ &init_data->ra_success_list);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "Failed to augment configuration [%d]: %s",
+ ret, sss_strerror(ret));
+ }
+
+ while (ref_array_get(init_data->ra_error_list, i, &msg) != NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "Config merge error: %s\n", msg);
+ i++;
+ }
+
+ i = 0;
+ while (ref_array_get(init_data->ra_success_list, i, &msg) != NULL) {
+ DEBUG(SSSDBG_TRACE_FUNC,
+ "Config merge success: %s\n", msg);
+ i++;
+ }
+#endif
+
+ if (init_data->sssd_config == NULL) {
+ /* Fall back to original configuration */
+ init_data->sssd_config = init_data->orig_sssd_config;
+ }
+
return ret;
#else
diff --git a/src/util/sss_ini.h b/src/util/sss_ini.h
index 3beaca1..f5b36de 100644
--- a/src/util/sss_ini.h
+++ b/src/util/sss_ini.h
@@ -58,7 +58,8 @@ int sss_ini_get_mtime(struct sss_ini_initdata *init_data,
/* Load configuration */
int sss_ini_get_config(struct sss_ini_initdata *init_data,
- const char *config_file);
+ const char *config_file,
+ const char *config_dir);
/* Get configuration object */
int sss_ini_get_cfgobj(struct sss_ini_initdata *init_data,
const char *section, const char *name);
--
2.5.0
From 97b8542bd8ad0603d97cf0b2201807d5a3073e51 Mon Sep 17 00:00:00
2001
From: =?UTF-8?q?Michal=20=C5=BDidek?= <mzidek(a)redhat.com>
Date: Thu, 23 Jun 2016 18:13:50 +0200
Subject: [PATCH] Squash me before pushing
Just add missing access check
for snippets.
---
src/util/sss_ini.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/src/util/sss_ini.c b/src/util/sss_ini.c
index 3dad18b..3c014b3 100644
--- a/src/util/sss_ini.c
+++ b/src/util/sss_ini.c
@@ -218,6 +218,14 @@ int sss_ini_get_config(struct sss_ini_initdata *init_data,
#ifdef HAVE_LIBINI_CONFIG_V1_3
uint32_t i = 0;
char *msg = NULL;
+ struct access_check snip_check;
+
+ snip_check.flags = INI_ACCESS_CHECK_MODE | INI_ACCESS_CHECK_UID
+ | INI_ACCESS_CHECK_GID;
+ snip_check.uid = 0; /* owned by root */
+ snip_check.gid = 0; /* owned by root */
+ snip_check.mode = S_IRUSR; /* r**------ */
+ snip_check.mask = ALLPERMS & ~(S_IWUSR|S_IXUSR);
#endif /* HAVE_LIBINI_CONFIG_V1_3 */
init_data->sssd_config = NULL;
@@ -270,7 +278,7 @@ int sss_ini_get_config(struct sss_ini_initdata *init_data,
config_dir,
patterns,
sections,
- NULL,
+ &snip_check,