[SSSD] [PATCH] UTIL: Add a function to convert id_t from a number or a name

Jakub Hrozek jhrozek at redhat.com
Fri Oct 17 16:32:45 UTC 2014


On Fri, Oct 17, 2014 at 02:17:21PM +0200, Jakub Hrozek wrote:
> On Thu, Oct 16, 2014 at 04:37:25PM +0200, Pavel Reichl wrote:
> > 
> > On 10/15/2014 09:35 PM, Jakub Hrozek wrote:
> > >0001-UTIL-Add-a-function-to-convert-id_t-from-a-number-or.patch
> > >
> > >
> > > From 9ef055cef1d109e0e932ddb0c43e6a59b9b29e0f Mon Sep 17 00:00:00 2001
> > >From: Jakub Hrozek<jhrozek at redhat.com>
> > >Date: Tue, 23 Sep 2014 16:27:23 +0200
> > >Subject: [PATCH] UTIL: Add a function to convert id_t from a number or a name
> > >
> > >We need a custom function that would convert a numeric or string input
> > >into uid_t. The function will be used to drop privileges in servers and
> > >also in the PAC and IFP responders.
> > >
> > >Includes a unit test to test all code that changed as well as a fix for
> > >a misnamed attribute in the csv_to_uid_list function synopsis.
> > >---
> > >  src/responder/common/responder.h        |   2 +-
> > >  src/responder/common/responder_common.c |  13 +--
> > >  src/tests/cwrap/Makefile.am             |  53 ++++++++++++
> > >  src/tests/cwrap/passwd                  |   1 +
> > >  src/tests/cwrap/test_responder_common.c | 143 ++++++++++++++++++++++++++++++++
> > >  src/tests/cwrap/test_usertools.c        | 108 ++++++++++++++++++++++++
> > >  src/util/usertools.c                    |  64 ++++++++++++++
> > >  src/util/util.c                         |   1 +
> > >  src/util/util.h                         |   3 +
> > >  9 files changed, 378 insertions(+), 10 deletions(-)
> > >  create mode 100644 src/tests/cwrap/test_responder_common.c
> > >  create mode 100644 src/tests/cwrap/test_usertools.c
> > >
> > >diff --git a/src/responder/common/responder.h b/src/responder/common/responder.h
> > >index 3674d13f2303d0ce248f765a638aaa83d0c16cf3..97552ec472c5baa285b41cc48b51149f3ef6adb5 100644
> > >--- a/src/responder/common/responder.h
> > >+++ b/src/responder/common/responder.h
> > >@@ -308,7 +308,7 @@ errno_t schedule_get_domains_task(TALLOC_CTX *mem_ctx,
> > >                                    struct tevent_context *ev,
> > >                                    struct resp_ctx *rctx);
> > >-errno_t csv_string_to_uid_array(TALLOC_CTX *mem_ctx, const char *cvs_string,
> > >+errno_t csv_string_to_uid_array(TALLOC_CTX *mem_ctx, const char *csv_string,
> > >                                  bool allow_sss_loop,
> > >                                  size_t *_uid_count, uid_t **_uids);
> > >diff --git a/src/responder/common/responder_common.c b/src/responder/common/responder_common.c
> > >index b7331ac8ab1de51839937d117968e92062af76d7..8c185dce00c28d99d4f10252cd7b9748663fb08a 100644
> > >--- a/src/responder/common/responder_common.c
> > >+++ b/src/responder/common/responder_common.c
> > >@@ -159,7 +159,7 @@ errno_t check_allowed_uids(uid_t uid, size_t allowed_uids_count,
> > >      return EACCES;
> > >  }
> > >-errno_t csv_string_to_uid_array(TALLOC_CTX *mem_ctx, const char *cvs_string,
> > >+errno_t csv_string_to_uid_array(TALLOC_CTX *mem_ctx, const char *csv_string,
> > >                                  bool allow_sss_loop,
> > >                                  size_t *_uid_count, uid_t **_uids)
> > >  {
> > >@@ -169,9 +169,8 @@ errno_t csv_string_to_uid_array(TALLOC_CTX *mem_ctx, const char *cvs_string,
> > >      int list_size;
> > >      uid_t *uids = NULL;
> > >      char *endptr;
> > >-    struct passwd *pwd;
> > >-    ret = split_on_separator(mem_ctx, cvs_string, ',', true, false,
> > >+    ret = split_on_separator(mem_ctx, csv_string, ',', true, false,
> > >                               &list, &list_size);
> > >      if (ret != EOK) {
> > >          DEBUG(SSSDBG_OP_FAILURE, "split_on_separator failed [%d][%s].\n",
> > >@@ -211,17 +210,13 @@ errno_t csv_string_to_uid_array(TALLOC_CTX *mem_ctx, const char *cvs_string,
> > >                  goto done;
> > >              }
> > >-            errno = 0;
> > >-            pwd = getpwnam(list[c]);
> > >-            if (pwd == NULL) {
> > >+            ret = sss_user_from_string(list[c], &uids[c]);
> > >+            if (ret != EOK) {
> > >                  DEBUG(SSSDBG_OP_FAILURE, "List item [%s] is neither a valid "
> > >                                            "UID nor a user name which cloud be "
> > s/cloud/could
> 
> [...]
> 
> I fixed this error and the others you pointed out, but after discussion
> with Simo in the following patchset, I removed the functions to retrieve
> groups completely -- as sssd.conf would only allow specifiying the user
> to run as, not groups.
> 
> A new patch is attached.
> 
> As Sumit and Pavel are doing great progress with the views feature, I
> hope we can start pushing the already acked patches and avoid several
> dispersed threads..

It makes more sense to review the patches together with the ones that
depend on the packaging. This thread is retired in favor of "Monitor and
sbus changes for running SSSD as a non-privileged user"

Sorry for the noise.



More information about the sssd-devel mailing list