sssd-devel January 2011

sssd-devel@lists.fedorahosted.org

14 participants
57 discussions

[PATCHES] Better default logging of access denials
by Sumit Bose 06 Jan '11

06 Jan '11

Hi, in trac ticket #751 it was requested to add syslog messages telling the admin why access was denied for a specific user with LDAP access provider. The following two patches add this for the check based on the shadow expire attribute and the authorized service check. bye, Sumit

2 2

[PATCH] Do not call nspr_nss_cleanup() in sss_password_decrypt()
by Sumit Bose 06 Jan '11

06 Jan '11

Hi, Shanks found an issue with obfuscated password which led to https://fedorahosted.org/sssd/ticket/762 This patch fixes the issue but might introduce some memory leaks. It does not remove nspr_nss_cleanup() at any other places, because for me the usage looks safe there. But we really should push https://fedorahosted.org/sssd/ticket/752 to get a code audit for our NSS usage. bye, Sumit

2 4

[PATCHES] Enumeration fixes
by Sumit Bose 06 Jan '11

06 Jan '11

Hi, based on an issue found by Shanks (#757) I had a closer look at some parts of the enumeration code in the nss responder and found a different issue (#758) and some non functional code. 0001: should fix #758. 0002: should fix #757. If only the local provider was configured the code did not return to the main loop during execution and the callback of the corresponding tevent request was never called.I think this is a regression from the introduction of the synchronous sysdb interface. To fix it I added a timer event which just calls *_step() again to make sure we always return to the main loop at least once. Of someone knows of a more elegant solution I'm all ears. Btw. the code cries for refactoring. 0003: the code arround last_user_enum and last_group_enum was not functional anymore and the enumeration timeout is handled by *_result_timeout().

2 4

[PATCH] Use the right status when resetting service discovery
by Sumit Bose 05 Jan '11

05 Jan '11

Hi, while resetting the failover status the service discovery components are set to a wrong value. These patches should fix this and should help tp avoid problems in the future. Shoud fix trac ticket #756. bye, Sumit

2 2

[PATCH] Fix boolean comparison against string
by Stephen Gallagher 05 Jan '11

05 Jan '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 These two macros are only ever used as the default value for a call to confdb_get_bool(), which is expecting a boolean value here. By coincidence, this resulted in the same behavior as expected (because the memory location of the string != 0), but it is still incorrect. Coverity 10082 and 100083 - -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAk0iEQ8ACgkQeiVVYja6o6NHhwCfXUeIr//jaWzvw2+xnUCQTalZ 418AoI4IwukB726gJJQoeFvx99rNIpje =iJMC -----END PGP SIGNATURE-----

2 2

[PATCHES] Patches for Coverity issues in ding-libs INI
by Dmitri Pal 03 Jan '11

03 Jan '11

Hello, 10034 Patch attached 10041 No patch. It is currently fixed on master and on 0.1.x the code is not used. This issue should be dismissed. 10042 No patch. It is currently fixed on master and on 0.1.x the code is not used. This issue should be dismissed. 10044 Patch attached 10048 Patch attached. Patch was developed on master but since this code has not changed for a long time the patch should also apply to the 0.1.x branch. The patch name is "COLLECTION-Initializing-variables-in-test". 10071 Patch attached. 10072 Patch attached. 10073 Patch attached. 10076 Patch attached. 10077 Patch attached. Also there is an attempt to sort out issues 10078 - 10079. See patch comments. The only remaining Coverity issue is: 10075 I want to redo the way we deal with paths to config files across the whole test. Stay tuned for the patch. -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/ -- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 9

SSSD.CONF: Disable caching of Authorization data
by JR Aquino 03 Jan '11

03 Jan '11

Might someone be able to tell me how I can completely disable caching in sssd.conf? I've tweaked the entry cache vars but I don't seem to be getting immediate db searches. I'm trying to account for: User exists in hbac posix group. User is removed from hbac posix group Should deny ssh login, but instead its permitted. If I rudely delete all the caches from /var/lib/sss/db/* It will properly deny me access. Disabling caching or at least disabling the caching of hbac level data would be what I am after. Thanks!!! -JR

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel January 2011