389-devel November 2009

389-devel@lists.fedoraproject.org

9 participants
22 discussions

Start a nNew thread

Please review: Add Named Pipe Log Script
by Rich Megginson 25 Nov '09

25 Nov '09

http://directory.fedoraproject.org/wiki/Named_Pipe_Log_Script

2 2

commit: changed selinux policy to support fifos (named pipes)
by Rich Megginson 24 Nov '09

24 Nov '09

To ssh://git.fedorahosted.org/git/389/ds.git c177c34..b2e2a3f master -> master commit b2e2a3f5294707e1ccf2b25fd281ce3653dac819 Author: Nathan Kinder <nkinder(a)redhat.com> Date: Mon Nov 23 09:48:50 2009 -0800 Allow dirsrv_t to log to a fifo in SELinux policy. This patch changes the SELinux dirsrv policy to allow ns-slapd to log to a fifo file. Author: nkinder (Thanks!) Tested on RHEL5 i386 diff --git a/selinux/dirsrv.if b/selinux/dirsrv.if index 80b478f..b8e1a7f 100644 --- a/selinux/dirsrv.if +++ b/selinux/dirsrv.if @@ -77,6 +77,7 @@ interface(`dirsrv_manage_log',` allow $1 dirsrv_var_log_t:dir manage_dir_perms; allow $1 dirsrv_var_log_t:file manage_file_perms; + allow $1 dirsrv_var_log_t:fifo_file: manage_fifo_file_perms; ') ####################################### diff --git a/selinux/dirsrv.te b/selinux/dirsrv.te index 60901f2..ef09fb2 100644 --- a/selinux/dirsrv.te +++ b/selinux/dirsrv.te @@ -105,6 +105,7 @@ files_var_lib_filetrans(dirsrv_t,dirsrv_var_lib_t, { file dir sock_file }) # log files manage_files_pattern(dirsrv_t, dirsrv_var_log_t, dirsrv_var_log_t) +manage_fifo_files_pattern(dirsrv_t, dirsrv_var_log_t, dirsrv_var_log_t) allow dirsrv_t dirsrv_var_log_t:dir { setattr }; logging_log_filetrans(dirsrv_t,dirsrv_var_log_t,{ sock_file file dir })

1 0

Pushed - Add bounds checking to DN unescape function
by Nathan Kinder 19 Nov '09

19 Nov '09

I've pushed this patch under the one-line commit rule. It's also an issue Noriko and I discussed in private, so she's familiar with the fix (it's actually a slight variation on a fix she wrote).

1 1

Please Review: Avoid freeing NULL trimmed passwords list
by Nathan Kinder 17 Nov '09

17 Nov '09

3 3

Please Review: (515329) Correct attribute value inconsistency on replica
by Nathan Kinder 16 Nov '09

16 Nov '09

3 3

Please review: port windows console to 64-bit, 2008, VC9, etc.
by Rich Megginson 16 Nov '09

16 Nov '09

1) upgrade doesn't work - so the package will manually remove the old package and any shortcuts left behind 2) includes the VC runtime merge modules - the old trick of including the vc runtime .dll doesn't work any more 3) removed all of the brand/vendor/version/etc. specific stuff from the .wxs file - these are now all supplied and passed in to the build process 4) the package file name is now <brand>-Console-<version>-<platform>.msi to make it easier to identify, and is more consistent with package naming on other platforms

2 2

Please review: Implement support for versioning and release engineering procedures - version 1.2.5.a1
by Rich Megginson 16 Nov '09

16 Nov '09

2 2

passsync
by John Dennis 16 Nov '09

16 Nov '09

I looked, albeit it quickly, on the 389 web site for details on how passsync works, but I didn't find any details only a how-to, so if the answers to these questions are documented you could just point me to the doc. The question arose in the context of one of our field people who wants to use FreeRADIUS backed against a 389 LDAP server which is pulling passwords from AD using passsync. FreeRADIUS needs ntlm hashes, but it can compute the ntlm hash from a cleartext password if one is available (but it's better if the ntlm hash is available in an attribute). My understanding is that passsync will update 389 with a cleartext password only. Is that correct? Is it possible to have passsync also update the ntlm hash by either pulling from AD or by computing it from the cleartext at the moment it's writing the cleartext into the 389 attributes? The next relevant issue is how password prefix's are handled. I don't know if this is a standard or just a convention, but passwords can be prefixed with their format enclosed in braces, e.g. {clear}, {crypt}, {md5}, etc. It turns out that FreeRADIUS when it queries a password will only recognize a clear text password vs. hash if it's prefixed with {clear} or {cleartext}. Is passsync capable of prepending the password type when it updates the password attribute? -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

3 2

389-ds-base 64bit-portability-issue ldap/servers/plugins/acl/acl_ext.c:698
by Peter Nixon 13 Nov '09

13 Nov '09

As requested, I have opened a bug for this issue at: https://bugzilla.redhat.com/show_bug.cgi?id=537357 Regards -- Peter Nixon http://peternixon.net/

2 1

Problem building 389-ds-base on openSUSE
by Peter Nixon 12 Nov '09

12 Nov '09

Hi Guys I have been attempting to build 389-ds-base 1.2.4 on openSUSE and have found the configure script makes some assumptions about Berkley DB that are not valid on SUSE. The configure script fails with the following error: configure: checking for db... checking for --with-db... no checking for db.h... using /usr/include/db.h checking for db_create in -ldb-.... no configure: error: /usr/include/db.h is version . but libdb-. not found error: Bad exit status from /var/tmp/rpm-tmp.83160 (%build) On openSUSE the db packages are the following: # rpm -ql libdb-4_5 /usr/lib/libdb-4.5.so # rpm -ql libdb-4_5-devel /usr/include/db.h /usr/include/db4 /usr/include/db4/db.h /usr/include/db4/db_185.h /usr/include/db_185.h /usr/lib/libdb-4.5.a /usr/lib/libdb-4.so /usr/lib/libdb.a /usr/lib/libdb.so # cat /usr/include/db.h #include <db4/db.h> # cat /etc/SuSE-release openSUSE 11.2 (i586) VERSION = 11.2 The attached patch solves this problem for me, but is almost certain to break things on Fedora. Hopefully someone with better m4 foo than I can fix it up... Regards -- Peter Nixon http://peternixon.net/

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-devel November 2009