sssd-devel March 2012

sssd-devel@lists.fedorahosted.org

21 participants
80 discussions

[PATCH] PROXY: Create fake user entries for group lookups
by Stephen Gallagher 09 Mar '12

09 Mar '12

Fixes https://fedorahosted.org/sssd/ticket/1241 Now we will check that each member referenced by the group exists in the cache, and we will create a fake user if it is not. I did not do any special handling for aliases because there's no way to identify them in the proxy provider.

2 2

[PATCH] Potential NULL-dereference in sudosrv_cmd_get_sudorules
by Pavel Březina 09 Mar '12

09 Mar '12

https://fedorahosted.org/sssd/ticket/1236

3 4

[PATCHES] Fixes for issues in SSH-related code found by coverity
by Jan Zelený 09 Mar '12

09 Mar '12

Please check the umask mode, that's the only thing I'm not sure about. Thanks Jan

3 7

Use of unininitialized value in sss_sudo_parse_response
by Pavel Březina 09 Mar '12

09 Mar '12

https://fedorahosted.org/sssd/ticket/1231

2 2

Use of unininitialized value in sudosrv_cache_set_entry
by Pavel Březina 09 Mar '12

09 Mar '12

https://fedorahosted.org/sssd/ticket/1232

2 3

Missing debug message if sdap_sudo_refresh_set_timer fails
by Pavel Březina 09 Mar '12

09 Mar '12

https://fedorahosted.org/sssd/ticket/1238

2 2

[PATCH] Two memory leaks in sss_sudo_get_values
by Pavel Březina 09 Mar '12

09 Mar '12

https://fedorahosted.org/sssd/ticket/1235

3 2

[PATCHES] Check nsAccountLock during IPA pam_acct_mgmt
by Stephen Gallagher 09 Mar '12

09 Mar '12

Patch 0001: Make sdap_access_send() public so the IPA provider can consume it. Patch 0002: Check that the user is not disabled before performing the HBAC check. I chose to do the nsAccountLock check first because it's a very fast operation against the cache, so if it returns PAM_PERM_DENIED we will skip the slower HBAC checks and jump straight to denial.

2 2

[PATCH] Fix two netgroup issues
by Jakub Hrozek 08 Mar '12

08 Mar '12

Hi, Amith reported these two issues. [PATCH 1/2] Save original name into the in-memory cache We were saving the original name into the netgroup hash when the object was first constructed but when no domain matched, we would save the cased name. The first request that was constructed with the original name was never marked as "ready", so another request with the same name was stuck waiting. [PATCH 2/2] setnetgrent return codes are handled in the _done callback, some of them gracefully, such as ENOENT that sends an empty reply. This patch uses tevent_req_post() to always call the callback and handle error conditions there. In particular, Amith was able to trigger this error by requesting a netgroup by raw name when all domains were marked as FQDN only

2 3

[PATCH] Fix nested groups processing
by Jakub Hrozek 08 Mar '12

08 Mar '12

The attached patch fixes the crash described in https://bugzilla.redhat.com/show_bug.cgi?id=743133#c28 The cause is actually embarassingly simple, the bug just did occur only with specific configurations our tests didn't exercise and moreover the default debugging didn't include enough information to triage the issue just from the debug logs. The root cause was that we would process all nested groups in a nesting level in a single tevent request and we kept the number of parent groups stored in the "state" structure. However, when moving to next group in the nesting leve, we didn't reset the number of parents.. Instead of keeping the number of parent groups in "state" and having to reset the count when moving to another group on the same level, the patch keeps track of the all groups on a particular level along with their parents and parent count in a more structured manner. This makes the code less fragile. The patch also adds more debugging.

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel March 2012