sssd-devel September 2012

sssd-devel@lists.fedorahosted.org

16 participants
77 discussions

[PATCH] Out-of-bounds read fix in hmac-sha-1
by Ondrej Kos 07 Sep '12

07 Sep '12

fixes https://fedorahosted.org/sssd/ticket/1331 Although the given memset wasn't doing anything when *key_len == HMAC_SHA1_BLOCKSIZE* (length of bytes to set was 0), the first argument to memset was an address starting right after the key itself - out-of-bounds. O. -- Ondrej Kos Associate Software Engineer Identity Management Red Hat Czech cell: +420-736-417-909 phone: +420-532-294-558 ext.: 82-62558 irc: okos @ #brno

4 5

[PATCH] Release mutex if a thread gets cancelled
by Jakub Hrozek 07 Sep '12

07 Sep '12

https://fedorahosted.org/sssd/ticket/1460 Please see the commit. I'm wondering if there is still a (small) race condition between the call to pthread_cleanup_pop() and unlocking the mutex. Would it be better to i.e. always call the cleanup handler with pthread_cleanup_pop(1) and disconnect from the fd based on some other condition?

2 11

[PATCH] Fixed wrong number in shadowLastChange
by Jan Zelený 07 Sep '12

07 Sep '12

The attribute is supposed to contain number of days since the epoch, not the number of seconds. Thanks Jan

4 3

[PATCH] KRB5: Only return PAM error for unreachable kpasswd when performing chpass
by Jakub Hrozek 07 Sep '12

07 Sep '12

I know this ticket is scheduled for RC2 but I suspect it is the root cause of problems we were seeing in production and I wanted to provide a scratch buil. https://fedorahosted.org/sssd/ticket/1452 We always try to resolve the kpasswd server even when we're just authenticating the user so that tools such as kpasswd work. However, we should treat errors from this step as fatal only when actually changing passwords.

2 3

[PATCH] Move SELinux processing from session to account PAM stack
by Timo Aaltonen 07 Sep '12

07 Sep '12

Selective backport of 7016947229edcaa268a82bf69fde37e521b13233 for sssd-1-8 branch. -- t

2 2

[PATCH] libsss_sudo should have a versioned dependency on SSSD
by Jakub Hrozek 07 Sep '12

07 Sep '12

Technically a one-liner, but I still prefer packaging changes to be reviewed and tested. https://fedorahosted.org/sssd/ticket/1509

2 2

Announcing SSSD 1.9.0 beta 7
by Jakub Hrozek 05 Sep '12

05 Sep '12

The SSSD team is proud to announce the seventh beta release of version 1.9 of the System Security Services Daemon. This is a bugfix release only, no new features were added in this version. This release was originally planned to be a Release Candidate, however we are still actively working on fixing several crasher bugs. A proper Release Candidate will be released once we fix the known crashes. We will be focusing on more stabilizing after that point until the final 1.9.0 release which is tentatively scheduled for September 13, although that release date will probably slip a couple of days. As always, you can download the latest sources at https://fedorahosted.org/sssd/ == Highlights == * Fixed security bug CVE-2012-3462 - HBAC rules were ignored when the SELinux login context support was enabled * Mutexes in the nss_sss module are now released correctly if one thread in a multithreaded application is cancelled while the mutex is locked * The fail over code works correctly when the IPA provider is not able to establish a GSSAPI-encrypted connection to an IPA server * The SSSD correctly accepts -1 as a valid value of the shadow attributes * When the SSSD is unable to resolve a host name, it tries the next configured server now instead of going offline * The default SELinux login context for IPA users was changed to unconfined_t when there are no rules on the server * A file descriptor leak in cases the SSSD was unable to establish SSL connection to an LDAP server was fixed == Packaging Changes == * A new Python wrapper around the murmur hash library has been introduced. It is only useful to the FreeIPA server at the moment. == Tickets Fixed == https://fedorahosted.org/sssd/ticket/734 on reconnect we need to detect that a ipa/ds server has been reinitialized https://fedorahosted.org/sssd/ticket/1156 Do not use "goto" to jump backwards in the proxy code https://fedorahosted.org/sssd/ticket/1194 when nesting limit is reached, the LDAP provider tries to establish link to members outside the nesting limit https://fedorahosted.org/sssd/ticket/1345 sssd does not warn into sssd.log for broken configurations https://fedorahosted.org/sssd/ticket/1365 ipv6 address with square brackets doesn't work for krb5_server https://fedorahosted.org/sssd/ticket/1388 domain.remove_provider() does not work https://fedorahosted.org/sssd/ticket/1390 Add support for nested automount maps https://fedorahosted.org/sssd/ticket/1393 shadow attributes should accept -1 https://fedorahosted.org/sssd/ticket/1396 Kerberos validation algorithm is insufficient for cross-realm trusts https://fedorahosted.org/sssd/ticket/1415 Group lookups no longer work when fastcache cannot be initialized https://fedorahosted.org/sssd/ticket/1416 sssd_be crashes on using inappropriate keytab file https://fedorahosted.org/sssd/ticket/1430 Password change prompt doesn't appear when "User must change password on next logon" is set for a AD user. https://fedorahosted.org/sssd/ticket/1436 LOCAL domain lookups don't work https://fedorahosted.org/sssd/ticket/1446 sssd does not try another server when unable to resolve hostname https://fedorahosted.org/sssd/ticket/1447 Fail over does not work correctly when IPA server is establishing a GSSAPI-encrypted LDAP connection https://fedorahosted.org/sssd/ticket/1453 proxy provider: value stored to status is never read in get_pw_name https://fedorahosted.org/sssd/ticket/1455 SELinux code must fall back to default only if there are no rules on the server https://fedorahosted.org/sssd/ticket/1456 Attempt to close the same file stream twice https://fedorahosted.org/sssd/ticket/1457 Insecure temporary file in IPA subdomain provider https://fedorahosted.org/sssd/ticket/1459 SRV servers are always marked as back up https://fedorahosted.org/sssd/ticket/1460 SSSD thread issue can cause the application to not get any identity information https://fedorahosted.org/sssd/ticket/1470 FreeIPA HBAC rules ignored when FreeIPA and SSSD are configured to set SELinux user context https://fedorahosted.org/sssd/ticket/1472 Duplicate detection in fail over does not work https://fedorahosted.org/sssd/ticket/1478 ldap_autofs_* options missing from /usr/share/sssd/sssd.api.d/sssd-ldap.conf https://fedorahosted.org/sssd/ticket/1480 1.9.0b6 does not build with SELinux disabled https://fedorahosted.org/sssd/ticket/1488 Segfault in IPA subdomain provider https://fedorahosted.org/sssd/ticket/1490 SSSD does not close TCP connections when SSL fails https://fedorahosted.org/sssd/ticket/1491 Consolidate functions that make a realm upper-case https://fedorahosted.org/sssd/ticket/1492 There is no /etc/selinux/targeted/logins on RHEL5 https://fedorahosted.org/sssd/ticket/1500 SSSD's default ccache location needs to be updated (again), and the man pages should reflect it == Detailed Changelog == Ariel Barria (1): * SIGUSR2 should force SSSD to reread resolv.conf as well Jakub Hrozek (32): * Bumping version for the 1.9.0 release * Don't call fo_set_{server,port}_status for SRV servers * Fix the version number * SYSDB: Check the return value * SYSDB: Use ldb_msg_add_string for simple string additions * Failover: Return last tried server if it's still being tried * Subdomains: Send the DP reply in the correct format * Always mark SRV servers as primary * Allocate on top of a talloc context, not NULL * Abort PAM access phase if HBAC does not return PAM_SUCCESS * Change default for ldap_idmap_range_min to 200000 * Don't use server after SRV data collapsed * Document entry_cache_autofs_timeout * Add autofs-related options to configAPI * sss_client: Group lookups should work even when fastcache cannot be initialized * FO: Don't retry the same server if it's not working * FO: Return EAGAIN if there are more servers to try * KRB5: Only return PAM error for unreachable kpasswd when performing chpass * Build SELinux code in responder conditionally * Do not try to remove the temp login file if already renamed * Only create the SELinux login file if there are mappings on the server * Fix compilation error in Python murmurhash bindings * Process all groups from a single nesting level * Use PTHREAD_MUTEX_ROBUST to avoid deadlock in the client * RPM: Switch the default ccache location * RPM: Always include the patch file * Check if the SELinux login directory exists * SYSDB: Commit transaction in sysdb_store_user * SYSDB: Abort unit test if sysdb_getpwnam fails * Retry the next server if bind during LDAP auth times out * Don't terminate the same connection twice * Update translations for 1.9.0 beta 7 release Jan Cholasta (3): * SSH: Return error code in SSH utility functions * SSH: Simplify public key formatting function * SSH: Add support for OpenSSH-style public keys Michal Zidek (10): * Return value of fread in src/tools/sss_debuglevel.c no longer ignored. * Change default value of ldap_sasl_string to host/hostname@REALM in man page. * SRV resolution for backup servers should not be permitted. * When ldap_group_nesting_level was reached, the LDAP provider tried to link group members with groups outside nesting limit. * Duplicate detection in fail over did not work. * Typo in debug message (SSSd -> SSSD). * Unify usage of sysdb transactions * Fix: IPv6 address with square brackets doesn't work. * Adding -std=gnu99 flag. * Unify usage of sysdb transactions (part 2). Nick Guay (1): * remove duplicate sss_obfuscate reference in seealso manpage section Ondrej Kos (5): * Removed unused variable assignment * Replaced "id_max" & "id_min" * Backward GOTOs rewritten into do-while loops. * AD context was set to null due to type mismatch * Consolidation of functions that make realm upper-case Pavel Březina (12): * tests: build sysdb ssh tests conditionally * shadow attributes can contain -1 * Add end of line to debug message * monitor: set debug level when unable to load configuration * Remove redefinition of some SYSDB_* macros * Rename SYSDB_SUDO_CACHE_AT_OC to SYSDB_SUDO_CACHE_OC * Remove SYSDB_SUDO_CACHE_OC from attribute lists * Fix LOCAL domain lookups * Close LDAP connection when unable to install TLS * Unbreak build on RHEL5: replace ldap_destroy() with ldap_unbind_ext() * Remove compilation warning: ret may be uninitialized * Clean up cache on server reinitialization Stephen Gallagher (6): * SSSDConfig: Fix nonfunctional SSSDDomain.remove_provider() * IPA: Do not attempt to close the same file twice * IPA: Securely set umask for mkstemp in subdomain provider * MAN: Fix minor typo in ldap_search_base section * MAN: Improve description of ldap_*_search_base options * SYSDB: Make sysdb_attrs_get_el_int() public Sumit Bose (5): * Add python bindings for murmurhash3 * accept_fd_handler: add missing return * Fix fallback in validate_tgt() * Use new debug levels in validate_tgt() * Check flat names when searching for sub-domains as well Yuri Chornoivan (1): * Fix various typos in documentation.

1 0

[PATCH] - SIGUSR2 should force SSSD to reread resolv.conf as well
by Ariel Barria 05 Sep '12

05 Sep '12

https://fedorahosted.org/sssd/ticket/1045

5 7

[PATCH] Don't terminate the same connection twice
by Jakub Hrozek 05 Sep '12

05 Sep '12

The sdap_id_release_conn_data function is already called inside sdap_id_op_hook_conn_data() so the net result is a double free. I can't think of a reason when you'd want to call release_conn_data but not op_hook_conn_data.. This hunk was changed during the work on the primary servers. I verified that primary/backup server reconnection logic still works and the connection to the backup server is properly closed. Jan, what was the reason behind the hunk?

3 4

[PATCH] Retry the next server if bind during LDAP auth times out
by Jakub Hrozek 05 Sep '12

05 Sep '12

In the very rare case, where the initial connection to the LDAP server would succeed during authentication, but the bind would time out, then the SSSD wouldn't retry the next server.

2 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2012