sssd-devel July 2012

sssd-devel@lists.fedorahosted.org

19 participants
76 discussions

Start a nNew thread

[PATCH] sdap_sudo.c: add missing end of line in few debug messages
by Pavel Březina 23 Jul '12

23 Jul '12

SSIA

3 2

[PATCH] SYSDB: Add log message for unexpected LDB errors
by Stephen Gallagher 20 Jul '12

20 Jul '12

I added this as a CRIT_FAILURE because we should consider it a bug if we aren't handling an LDB error that occurs regularly. At minimum, we need to know what it is.

2 1

[PATCH] Fix sysdb_search_selinux_usermap_by_username return value
by Jakub Hrozek 20 Jul '12

20 Jul '12

There was a logic bug in sysdb_search_selinux_usermap_by_username that resulted in returning the value the variable "ret" had after the last call to sysdb_attrs_get_uint32_t, which in cases the last rule processed did not have the requested attributes led to using the default user context. I think this would fix the strange bug Rob was seeing yesterday, but I still need to verify that.

2 4

[PATCH] NSS: Add override_shell option
by Stephen Gallagher 20 Jul '12

20 Jul '12

If override_shell is specified in the [nss] section, all users managed by SSSD will have their shell set to this value. If it is specified in the [domain/DOMAINNAME] section, it will apply to only that domain (and override the [nss] value, if any). Fixes https://fedorahosted.org/sssd/ticket/1087

2 2

[PATCHES] Manpage improvements
by Stephen Gallagher 20 Jul '12

20 Jul '12

Patch 0001: List all available backends for provider options Fixes https://fedorahosted.org/sssd/ticket/1432 Patch 0002: Improvements to the AD provider manpage Add information about ID mapping (including how to disable it) as well as information on how to handle homedir and shell. Fixes https://fedorahosted.org/sssd/ticket/1433

2 5

[PATCHES] Add support for multiple servers in the Kerberos locator plugin
by Stephen Gallagher 18 Jul '12

18 Jul '12

This is the first half of the work necessary to resolve https://fedorahosted.org/sssd/ticket/941 This patch largely rewrites the Kerberos locator plugin so that it can parse kdcinfo files containing multiple servers (one per line, with optional port). These patches are testable by manually editing /var/lib/sss/pubconf/kdcinfo.REALM (or /var/lib/sss/pubconf/kpasswdinfo.REALM, as appropriate). They are also fully backwards-compatible. I will be working on and sending the KRB5 provider side of things after this, but since these are ready, manually testable and backwards-compatible, it seemed prudent to send them for review in parallel. Patch 0001: Convert memory allocation functions to use talloc. There's no reason to avoid this dependency, and it will make subsequent patches much simpler. Patch 0002: Create a structure for holding address and port information (with linked-list semantics) Patch 0003: Rewrite the kdcinfo parser so that it supports multiple entries, one per line. It ignores blank lines. Patch 0004: Modify the sssd_krb5_locator_lookup() function to send repeated calls to the cbfunc() callback, providing all of the kdcinfo-specified servers as values. Clients using libkrb5 will transparently try all of the provided servers until finding one that works.

2 4

Announcing SSSD 1.9.0 beta 5
by Jakub Hrozek 18 Jul '12

18 Jul '12

The SSSD team is proud to announce the fifth of six preview releases of version 1.9 of the System Security Services Daemon. Beta 6 will be released on July 31st and will contain a new tool for "seeding" accounts with a temporary password for sending machines to remotees as well as introducing a concept of primary vs. secondary servers. After Beta 6, no new features will be added to SSSD 1.9.0 and we will focus on stability and our backlog of bugfixes until the final release around September 1st. We will most likely issue a series of release candidate builds prior to that, but these have not yet been scheduled. As always, you can download the latest sources at https://fedorahosted.org/sssd/ == Highlights == * Many fixes for the support for setting default SELinux user context from FreeIPA, most notably fixed the specificity evaluation * Fixed an incorrect default in the krb5_canonicalize option of the AD provider which was preventing password change operation * The shadowLastChange attribute value is now correctly updated with the number of days since the Epoch, not seconds == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1360 format of file for pam_selinux is incorrect https://fedorahosted.org/sssd/ticket/1379 Possible use of uninitialized values https://fedorahosted.org/sssd/ticket/1395 SELinux rule matching ignores specificity requirement https://fedorahosted.org/sssd/ticket/1417 Several unowned directories https://fedorahosted.org/sssd/ticket/1419 sssd incorrectly sets shadowLastChange in seconds not days https://fedorahosted.org/sssd/ticket/1421 selinux rules are never deleted from sysdb https://fedorahosted.org/sssd/ticket/1422 When ldap_sasl_minssf is assigned large values, appropriate error message should be logged sssd_DOMAIN log == Detailed Changelog == Jakub Hrozek (9): * Bumping version to 1.9.0 beta 5 * Add newline to DEBUG messages * RPM: Own several directories * Add missing "%" to specfile * IPA: Download defaults even if there are no SELinux mappings * SYSDB: Delete SELinux mappings * IPA: Return and save all SELinux rules in the provider * PAM: Fix off-by-one-error in the SELinux session code * Update translations for 1.9.0 beta 5 release Jan Vcelak (1): * LDAP: Properly cast type for MINSSF value Jan Zeleny (3): * Fixed wrong number in shadowLastChange * Add function sysdb_attrs_copy_values() * Modify priority evaluation in SELinux user maps Michal Zidek (2): * Fixed: Unchecked return value from dp_opt_set_int. * Fixed: Uninitialized value in krb5_child-test if ccname was specified. Nick Guay (1): * Fix uninitialized values Pavel Březina (2): * resolv_gethostbyname_send: strdup hostname to work properly when hostname is allocated on stack * sudo test client: avoid SIGSEGV when run without arguments Stephen Gallagher (2): * AD: Add missing DP option terminator * AD: Fix defaults for krb5_canonicalize Yuri Chornoivan (1): * Fix typo: exhasution->exhaustion.

1 0

[PATCH] PAM: Fix off-by-one-error in the SELinux session code
by Jakub Hrozek 18 Jul '12

18 Jul '12

This was causing unpredictable behaviour when writing the SELinux user -- because the string wasn't NULL-terminated, the PAM module sometimes wrote junk into the logins file.

2 2

[PATCH] AD: Fix defaults for krb5_canonicalize
by Stephen Gallagher 18 Jul '12

18 Jul '12

The AD provider cannot function with canonicalization because of a bug in Active Directory rendering it unable to complete a password-change while canonicalization is enabled. I had set the default properly in the LDAP options, but forgot to set it the same in the Kerberos options, resulting in unpredictable (and bad) behavior. This changes both versions to specify BOOL_FALSE for the default. The last option on the dp_options structure is ignored for booleans, but I changed it to BOOL_FALSE as well, just for consistency.

2 2

[PATCH]Fix uninitialized values
by Nick Guay 18 Jul '12

18 Jul '12

Patch for uninitialized values when building with -Wmaybe-uninitialized.

3 6

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel July 2012