October 2013 - sssd-devel - Fedora mailing-lists

[PATCH] krb5: Check return value of sss_krb5_princ_realm
by Lukas Slebodnik 28 Nov '14

28 Nov '14

ehlo, yet another warning from clang static analyser. sss_krb5_princ_realm set output parameter realm to NULL and len to 0 in case of failure. Clang static analysers repoted warning "Null pointer passed as an argument to a 'nonnull' parameter" in function match_principal. It was possible, that realm_name with value NULL could be used in strncmp. Function sss_krb5_princ_realm is used on other places for printing(formatting) realm_name and NULL can be safely used as a argument for printf-like functions. Patch is attached. LS

5 13

[PATCH] LDAP: Try all attributes when saving an entry
by Jakub Hrozek 08 Jul '14

08 Jul '14

Hi, this bug was reported on #sssd by a user. He was running some flavor of IBM Tivoli where the entries only had an "ID", not separate "UID" and "GID". But due to a bug in sssd he couldn't use the same value for both, this configuration: ldap_user_uid_number = idAttribute ldap_user_gid_number = idAttribute only saved the ID into UID and left GID empty. It appears we have a long standing bug in sdap_parse where we only consider first match. If this patch is accepted, I would also like to refactor sdap_parse in master because currently it is a 250-lines long function with multiple branches..

2 6

Build Fixes
by Benjamin Franzke 17 May '14

17 May '14

Hi, These two patches add missing CFLAGS/LIBS to Makefile.am: [PATCH 1/2] BUILD: Link libsss_ad.so to sasl libs [PATCH 2/2] BUILD: Use OPENLDAP_CFLAGS instead of LDAP_CFLAGS This underlinking was noticed in make check (dlopen-test). Note: It failed for me since my openldap build had no sasl support, which would otherwise have pulled in libsasl2.so. Of course, that support should be in place, but the linking should still be fixed. BTW: It would propably be nice to have a configure check whether openldap has sasl support, but it seems that would need a check if ldap_sasl_interactive_bind returns LDAP_NOT_SUPPORTED. Regards, Ben

6 13

[PATCH] BUILD: Link libsss_krb5_common.so to libkeyutils.so
by Benjamin Franzke 28 Apr '14

28 Apr '14

Hi List, The symbol add_key is used by src/providers/krb5/krb5_delayed_online_authentication.c which is part of libsss_krb5_common.so Fixes following error: [sssd[be[default]]] [load_backend_module] (0x0010): Unable to load ad module with path (/usr/lib64/sssd/libsss_ad.so), error: /usr/lib64/sssd/libsss_krb5_common.so: undefined symbol: add_key -lkeyutils was passed to the libraries libsss_{krb5,ipa,ad}.so, but when compiling with -Wl,--as-needed this flag will be ignored, since it is not used directly. So it was unavailable to libsss_krb5_common.so which actually needs it. This patch removes $(KEYUTILS_LIBS) from those libraries and adds it to libsss_krb5_common.so Maybe libsss_krb5_common.so should be added to dlopen-tests? But then other libraries and functions are needed as well, which it currently inherits from libsss_{krb5,ipa,ad}.so. BTW: are these common libraries (i mean ldap too) convenience build libraries, or to save disk space? If they're just for convencience maybe they should not be installed? Regards, Ben

4 16

[PATCH] nested groups unit test
by Pavel Březina 18 Feb '14

18 Feb '14

Hi, this is the first unit test for nested groups. It covers only the most basic situation when we are trying to resolve one group with no members. Even though it is only one test, the patch set is quite big. This is because it creates the possibility to mock providers related modules. Most of the patches are just a preparation for unit testing providers. Patches 1-5 Moves the code around to reduce number of dependencies. (E.g. you do not want to load fail over when you are testing nested groups.) Patch 6 Mocks basic SDAP interface. Patch 7 Mocks sysdb objects - currently user and rfc2307bis group. You can decide what set of attributes the object should posses. For example, creating a user requires only basedn and name parameter, to construct originalDN and name attributes. The rest is provided by (attrname, value) pairs via variadic function. E.g.: mock_sysdb_user(mem_ctx, basedn, name, SYSDB_UIDNUM, uid, ...) get_attr_type() translates the sysdb attribute name to proper data type. This should be extended as needed. Patch 8 Adds provider tests related common object files and cflags in makefile Patch 9 New macro sss_will_return_always(fn, value). This can be used to mock function data in such way that any call of mock() will return the value. It was just pushed also to cmocka upstream as will_return_always(). Patch 10-11 Unit test. Patch 12 Removes a noisy debug message. I would like to get this reviewed before I continue with more test cases, so the framework is tuned enough. Off topic: I also created new macro called fail_msg, which will make the test fail printing a message. I didn't use this macro in the end, but it made its way to cmocka upstream.

3 10

[INI][PATCHES] All of them (C-Style Comments, Unicode conversion, Space processing, UNIT tests)
by Dmitri Pal 10 Jan '14

10 Jan '14

Hello, This mail contains all the patches that I have so far in my git. -------------------------- The following set of patches is related to comments and unchanged from the previous submission. I replied to the comments about them in another mail. I do not think there is anything to address. If there is please let me know. 0001-INI-Do-not-check-validity-of-comments.patch 0002-INI-Extend-error-set-and-add-parsing-error.patch 0003-INI-Process-c-style-comments.patch 0004-INI-Test-files-for-unit-test.patch 0005-INI-Unit-test-for-c-style-comments.patch -------------------------- The following set of patches addresses comments and fixes bugs in Unicode/UTF8 conversion 0006-INI-Expose-buffer-context-as-void.patch 0007-INI-Extend-internal-file-handle.patch 0008-INI-Convert-files-to-UTF.patch 0009-INI-Updated-unit-test-for-UTF8-conversion.patch Thanks for review Lukas. I reworked the code significantly. I think I addressed everything except the initialization comment. I agree with you that it would have been better to initialize things outside the loop but I need to read the first buffer to be able to determine the encoding. This is what causes this logic. I do not see a way to avoid it so left that part as is. ---------------------------- The following one liner fixes a trace text 0010-INI-Fix-typo-in-comment.patch ---------------------------- The following patches are related to the problem I noticed earlier and recorded in the ticket https://fedorahosted.org/sssd/ticket/2119 But in reality the cause was bug in the Unicode conversion and a bug with space processing. 0011-INI-Fix-processing-of-the-white-space-at-the-end-of-.patch 0012-INI-Unit-test-for-space-trimming-in-multiline-values.patch ---------------------------- The following patch adds more unit test for both Unicode conversion and folding by combining the tests together. The unit tests written for each of them individually are not sufficient to catch corner cases. This test does. And I played with different constants before checking in to make sure that all sorts of combinations are caught. I decided to settle on these numbers because they provide sufficient amount of testing but do not extend the time too much. Right now all make check tests take about 7-8 seconds on my laptop. 0013-INI-Adding-more-unit-tests.patch -- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

3 9

[PATCHES] Heimdal Support
by Benjamin Franzke 23 Dec '13

23 Dec '13

Hi list, I've tried to use sssd with heimdal, there were some fixes to be done. Are you intrested in reviewing and integrating them? They are available at: https://git.bnfr.net/sssd/log/?h=heimdal-1 Note: They are on top of other build fixes i've send to the list (but thats visible in the log). This compiles without warnings and passes all make tests. Actually i've added alternatives for deprecated (in terms of heimdal) kerberos functions to avoid warnings there. I've tested this in a samba 4 environment (with the sssd-ad module). Regards, Ben

5 8

DEBUG macro refactoring
by Nikolai Kondrashov 18 Dec '13

18 Dec '13

Hi everyone, I've been looking at the sssd sources for some test failure investigation and noticed that the DEBUG macro expands to quite a lot of code. I decided to see if it can be reduced and what the impact will be. The result is the patches that follow. I've noticed that the total size of installed binaries produced by the standard Fedora build with "reconfig && chmake" drops by 20% after applying these patches. A build on Debian, configured similarly to the one used in the Debian package dropped by 44%. I've verified that all the patches build and pass the tests run by "chmake", but otherwise haven't tested them. Sincerely, Nick

7 37

[PATCH] AUTOMAKE: Don't build libsss_test_common every time
by Lukas Slebodnik 29 Nov '13

29 Nov '13

ehlo, Although static library libsss_test_common was used only in tests, It was also built with command "make all". Simple patch is attached. LS

2 9

[PATCH] Look up originalDN if not available during LDAP auth
by Jakub Hrozek 20 Nov '13

20 Nov '13

Hi, the attached two patches fix #2077. I wrote the patches even though there are unresolved 1.11 issues because there was a customer looking for a test package.

2 6

[PATCH] PROXY: Handle empty GECOS
by Jakub Hrozek 20 Nov '13

20 Nov '13

I found this bug while triaging a customer case with Chris Hudson who ran into the same issue Simo fixed recently in the proxy provider.

2 3

Fix proxy backend initgroups_dyn code
by Simo Sorce 20 Nov '13

20 Nov '13

Tested fix for #2051 and seem to work. However it just occurred to me we may always want to check if pwd.pw_gid is listed in the gids returned and add it if not ? Simo. -- Simo Sorce * Red Hat, Inc * New York

3 5

[PATCHES] Alignment issues reported by Clang
by Michal Židek 15 Nov '13

15 Nov '13

Patches 1-4 and 9: These patches use the SAFEALIGN macros where it is appropriate. I split them into several patches for easier review, so that client code changes are not mixed with the rest of the code and changes that are a little different than the rest have their own patch. Patches 5-6: Here I think it is not needed to use uint8_t* or char*. We cast the pointer anyway and there are no real alignment issues (the memory is aligned properly). I was thinking about suppressing the warnings with #pragma here, but in this particular situation it is IMO better to have just void*. Patches 7-8: These were all false positive warnings. It is possible to suppress them with additional casting but I found it less readable so I used #pragma. Patch 10: We had improperly aligned part of a buffer used in client code. Also some code blocks here must rely on fact that the buffer they get is aligned properly (they can do nothing about it if it isn't). In these cases it is better to silence the warnings, so that it does not make permanent noise during compilation. Thanks Michal

5 13

[PATCH] Inherit ID limits of parent domains if set
by Jakub Hrozek 14 Nov '13

14 Nov '13

Hi, the attached patch was tested by a customer running RHEL6. I'm not sure if we should do any more checking when running on a modern system where ranges can be better defined on the IPA side for example?

2 3

[PATCH] Add ldap_autofs_map_master_name option
by C. S. 12 Nov '13

12 Nov '13

Add ldap_autofs_map_master_name option so that the auto master map name change be changed from the default auto.master.

3 17

[PATCH] UTIL: Free log message when using journald
by Jakub Hrozek 07 Nov '13

07 Nov '13

I was exercising sssd with valgrind when looking for #1020945 and found this leak.

3 6

[PATCH] confdb: Make offline timeout configurable
by Michal Židek 07 Nov '13

07 Nov '13

I decided not to only document the behaviour, but also add option to configure it (so I could remove one FIXME from the code). https://fedorahosted.org/sssd/ticket/1718 Michal

5 11

[PATCH] responder: Access packet header using SAFEALIGN macros
by Michal Židek 07 Nov '13

07 Nov '13

Hello, the attached patch should uses the SAFEALIGN macros to access data in the packet header (in sss_packet structure) so that it does not depend on proper memory alignment (currently the alignment is OK, but if we add something to the packet header later, it is probably safer not to depend on proper alignment). It also silences a lot of alignment warnings. Thanks Michal

4 10

[PATCH] Include external headers with #include <foo.h>
by Jakub Hrozek 04 Nov '13

04 Nov '13

Attached is a style patch. Feel free to ack or nack, it's just a readability improvement.

5 16

[PATCH] NSS: Check allocation result
by Jakub Hrozek 01 Nov '13

01 Nov '13

Another small bug I found when looking for #1020945

5 9

Announcing SSSD 1.11.2
by Jakub Hrozek 31 Oct '13

31 Oct '13

=== SSSD 1.11.2 === The SSSD team is proud to announce the release of version 1.11.2 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora 19, 20 and rawhide shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * A new option ad_access_filter was added. This option allows the administrator to easily configure LDAP search filter that the users logging in must match in order to be granted access * Group resolution now supports resolving group members from different trusted AD domains in a single forest * A bug that prevented a configuration file with trailing spaces to be loaded was fixed * SSSD no longer crashes if the LDAP connection is terminated while LDAP requests are still in progress * Several important bugs related to the Global Catalog support were fixed: * SSSD now correctly falls back to LDAP lookups in case Global Catalog is not reachable * If the AD servers were specified using the ad_server option and not autodiscovered, server fail over did not work correctly with 1.11.1 == Feature removal == * The Kerberos provider is no longer able to create public directories when evaluating the krb5_ccachedir option. This is a backwards-incompatible change. Creating public directories is something the system administrator should perform in order for the directories to have the correct permissions and allow the authentication daemon to create user directories as private only. == Documentation Changes == * The decimal debug levels are now recommended instead of the advanced hexadecimal levels which are more suitable for developers == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1968 Memory grows if subdomain goes away in the AD provider https://fedorahosted.org/sssd/ticket/2030 getent response requires sssd restart after trust add https://fedorahosted.org/sssd/ticket/2064 ad: unable to resolve membership when user is from different domain than group https://fedorahosted.org/sssd/ticket/2071 Ccache directory creation leads to unexpected results https://fedorahosted.org/sssd/ticket/2082 [RFE] Add a new option ad_access_filter https://fedorahosted.org/sssd/ticket/2092 Group lookup is not returned immediately after service startup https://fedorahosted.org/sssd/ticket/2100 sudo responder does not support specifying just one of sudoNotBefore/sudoNotAfter https://fedorahosted.org/sssd/ticket/2101 Use idrange of forest root if there is none for a member domain and type is ipa-ad-trust-posix https://fedorahosted.org/sssd/ticket/2104 AD provider should fall back the LDAP if Global Catalog is not reachable https://fedorahosted.org/sssd/ticket/2105 Do not show 'Could not add new domain' error messages if ldap_id_mapping=false https://fedorahosted.org/sssd/ticket/2112 Coverity reported potential NULL dereference https://fedorahosted.org/sssd/ticket/2116 SID looksups are not handled if noexist_delete flag is set https://fedorahosted.org/sssd/ticket/2121 ipa ad trusted user lookups failed with sssd_be crash https://fedorahosted.org/sssd/ticket/2123 Creating system accounts on a IdM client takes up to 10 minutes when AD trust is configured in the IdM. https://fedorahosted.org/sssd/ticket/2124 sssd_nss exited abnormally and generated core files. https://fedorahosted.org/sssd/ticket/2126 sssd_be segfault when authenticating against active directory https://fedorahosted.org/sssd/ticket/2131 NSS responder doesn't qualify memberuid and ghost users of groups that contain members from different domains == Detailed Changelog == Jakub Hrozek (23): * Updating the version for the 1.11.2 release * krb5: Fix unit tests * INI: Disable line-wrapping functionality * KRB5: Return PAM_ACCT_EXPIRED when logging in as expired AD user * PROXY: Fix memory hierarchy when enumerating services * Inherit ID limits of parent domains if set * SYSDB: Add sysdb_delete_by_sid * LDAP: Delete entry by SID if not found * LDAP: Amend sdap_access_check to allow any connection * LDAP: Parse FQDN into name/domain for subdomain users * AD: Add a new option ad_access_filter * AD: Use the ad_access_filter if it's set * AD: Search GC by default during access control, fall back to LDAP * AD: Add extended access filter * TEST: Test getgrnam with emphasis on members * NSS: Print FQDN for groups with mixed domain membership * KRB5: Handle ERR_CHPASS_FAILED * NSS: Fix service enumeration * MAN: Document that krb5 directories can only be created as private * LDAP: Check all search bases during nested group processing * NSS: Fix parenthesis * AD: Fix ad_access_filter parsing with empty filter * Updating translation for the 1.11.2 release Lukas Slebodnik (9): * LDAP: Set default value for dyndns update to false * krb5: Remove warning dereference of a null pointer * krb5: Use right function to free data. * AD: Prefer GC port from SRV record * AD: fall back to LDAP if GC is not available. * tests: Use right format string for type size_t * Makefile: Add missing libraries * Makefile: Remove unused variable TEST_MOCK_OBJ * LDAP: Return correct error code Pavel Březina (23): * sudo: allow specifying only one time restriction * sudo: improve time restrictions debug messages * nss: wait for initial subdomains request to finish * subdomains: first destroy ptask then remove sdom * dp: make subdomains refresh interval configurable * dp: store list of ongoing requests * utils: add ERR_DOMAIN_NOT_FOUND error code * dp: set request domain * dp: add function to terminate request of specific domain * dp: free sdap domain if subdomain is removed * be_ptask: add be_ptask_create_sync() * dp: convert cleanup task to be_ptask * ipa: destroy cleanup task when subdomain is removed * ad: destroy ptasks when subdomain is removed * sdap_save_user: try to determine domain by SID * sdap_save_group: try to determine domain by SID * free sid obtained from sss_idmap_unix_to_sid() * ad: shortcut if possible during get object by ID or SID * sdap: store base dn in sdap_domain * sdap: add sdap_domain_get_by_dn() * ghosts: pick correct domain for every member * sdap_fill_memberships: pick correct domain for every member * nested groups: pick correct domain for cache lookups Simo Sorce (1): * krb5: Remove ability to create public directories Stephen Gallagher (4): * SYSDB: Fix incorrect DEBUG message * MAN: Clarify debug level documentation * MAN: Reflow debug_levels.xml * BUILD: Update bashrc macros Sumit Bose (17): * AD: properly intitialize GC from ad_server option * LDAP: handle SID requests if noexist_delete is set * IPA server mode: properly initialize ext_groups * idmap: add internal function to free a domain struct * idmap: fix a memory leak if a collision is detected * idmap: allow ranges with external mapping to overlap * sdap_idmap: add sdap_idmap_get_configured_external_range() * sdap_idmap: properly handle ranges for external mappings * Add unconditional online callbacks * IPA: add callback to reset subdomain timeouts * sdap_get_generic_ext_send: check if we a re still connected * find_subdomain_by_sid: skip domains with missing domain_id * idmap: add sss_idmap_domain_by_name_has_algorithmic_mapping() * sdap_idmap_domain_has_algorithmic_mapping: add domain name argument * IPA: add trusted domains with missing idrange * ad_subdom_store: check ID mapping of the domain not of the parent * be_spy_create: free be_req and not the long living data

2 1

[PATCH] ad: support cross domain membership
by Pavel Březina 30 Oct '13

30 Oct '13

https://fedorahosted.org/sssd/ticket/2064 These patch set depends on: [PATCH] ad: store group in correct tree on initgroups via tokenGroups You can also pull it with all dependencies from my repository: fedorapeople.org:public_git/sssd.git #ad-groups The fundamental changes in this patch set are: - lookup groups in global catalog - pick up member domain from its originalDN

3 24

[PATCH] AD: Fix ad_access_filter parsing with empty filter
by Jakub Hrozek 30 Oct '13

30 Oct '13

I'm sorry about the breakage, but if the ad_access_filter was unset yet access_provider was set to AD, access was denied. Even though the access order was set correctly to "expire, filter", the filter being NULL caused problems. A patch including unit test is attached.

2 2

[PATCH] be_spy_create: free be_req and not the long living data
by Sumit Bose 30 Oct '13

30 Oct '13

Hi, Steeve found some unusual behaviour during his test which led to the shutdown of the whole SSSD. The attached patch should fix it. bye, Sumit

2 3

[PATCH] free sid obtained from sss_idmap_unix_to_sid()
by Pavel Březina 30 Oct '13

30 Oct '13

4 5

[PATCH] LDAP: Return correct error code
by Lukas Slebodnik 30 Oct '13

30 Oct '13

ehlo, I found one warning, while I was testing some patches. This warning was unrelated to patches, therefore I am sending separate email. simple patch is attached. LS

3 3

[PATCH] Makefile: Add missing libraries
by Lukas Slebodnik 30 Oct '13

30 Oct '13

ehlo, I tried to build latest sssd master on ubuntu and some tests could not be linked. It is caused by disabled link_all_deplibs. LS

2 2

[PATCH] BUILD: Update bashrc macros
by Stephen Gallagher 30 Oct '13

30 Oct '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 * Stop using --target (unneeded) * Drop explicit use of --with-default-ccache* since we now pick it up from libkrb5 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlJv9S0ACgkQeiVVYja6o6MVZACfSwORHp6bDJdlifs5FcgmWrP6 XNkAmgOnIxDNP+yIvdYUFkvXNYM3dsUa =ub5l -----END PGP SIGNATURE-----

3 4

[PATCH] MAN: Document that krb5 directories can only be created as private
by Jakub Hrozek 29 Oct '13

29 Oct '13

When I started writing 1.11.2 release notes, I realized that we did not amend documentation when we removed the ability to create public krb5 directories.

3 5

[PATCH] NSS: Fix service enumeration
by Jakub Hrozek 29 Oct '13

29 Oct '13

The code wrote into the middle of the packet to a space that was already reserved and allocated but then still advanced the pointer to the buffer. https://fedorahosted.org/sssd/ticket/2124

2 4

[PATCH] ad_subdom_store: check ID mapping of the domain not of the
by Sumit Bose 29 Oct '13

29 Oct '13

Hi, Pavel found an issue while using getpwuid() or getgrgid() with algorithmic mapping for sub-domain users and an empty cache. This patch should fix the issue. bye, Sumit

3 2

[PATCH] KRB5: Handle ERR_CHPASS_FAILED
by Jakub Hrozek 29 Oct '13

29 Oct '13

The Kerberos provider didn't handle ERR_CHPASS_FAILED at all, which resulted in the default return code (System Error) to be returned if password change failed for pretty much any reason, including password too recent etc.

2 4

[PATCH] NSS: Print FQDN for groups with mixed domain membership
by Jakub Hrozek 29 Oct '13

29 Oct '13

Hi, The first patch adds a unit test for getgrnam. I wanted to make sure we don't break anything this close to the 1.11.2 release. The second patch is a workaround until https://fedorahosted.org/sssd/ticket/2129 is fixed properly. Consider a group entry such as: cn: subgroup@subdom ghost: someuser ghost: anotheruser@subdom Currently in order to print all group members as FQDN (which is the default for AD provider), the code needs to iterate over the ghost attributes and parse them into (name,domain) and optionally re-add the domain. The proper fix would be to store always just the FQDN in the hardcoded form of user@domain

2 10

[PATCHES] save users and groups: try to determine domain by SID
by Pavel Březina 29 Oct '13

29 Oct '13

2 2

[PATCHES] dp: free sdap domain if subdomain is removed
by Pavel Březina 25 Oct '13

25 Oct '13

https://fedorahosted.org/sssd/ticket/1968

3 6

[PATCH] Add a new option ad_access_filter
by Jakub Hrozek 25 Oct '13

25 Oct '13

Hi, the attached patches implement the new option ad_access_control as designed in https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryAccessControl The only part not implemented exactly as per the design page is changing the default. I will write an e-mail about the issue into the thread with the design decision so that also people who filter out patches can participate.

2 5

[PATCH] LDAP: Delete entry by SID if not found
by Jakub Hrozek 25 Oct '13

25 Oct '13

Hi, if an entry is removed from LDAP and searched by SID, the SID lookup code doesn't handle ENOENT and doesn't remove the stray entry from cache. The attached patch fixes that.

5 9

[PATCH] tests: Use right format string for type size_t
by Lukas Slebodnik 25 Oct '13

25 Oct '13

ehlo, I found few warnings in current master. (I compile with Werror) src/tests/cmocka/test_utils.c:54:56: warning: format specifies type 'unsigned int' but the argument has type 'size_t' (aka 'unsigned long') [-Wformat] dom->name = talloc_asprintf(dom, DOMNAME_TMPL, c); ^ src/tests/cmocka/test_utils.c:57:62: warning: format specifies type 'unsigned int' but the argument has type 'size_t' (aka 'unsigned long') [-Wformat] dom->flat_name = talloc_asprintf(dom, FLATNAME_TMPL, c); ^ src/tests/cmocka/test_utils.c:60:57: warning: format specifies type 'unsigned int' but the argument has type 'size_t' (aka 'unsigned long') [-Wformat] dom->domain_id = talloc_asprintf(dom, SID_TMPL, c); ^ src/tests/cmocka/test_utils.c:111:69: warning: format specifies type 'unsigned int' but the argument has type 'size_t' (aka 'unsigned long') [-Wformat] name = talloc_asprintf(global_talloc_context, DOMNAME_TMPL, c); ^ src/tests/cmocka/test_utils.c:114:75: warning: format specifies type 'unsigned int' but the argument has type 'size_t' (aka 'unsigned long') [-Wformat] flat_name = talloc_asprintf(global_talloc_context, FLATNAME_TMPL, c); ^ src/tests/cmocka/test_utils.c:117:64: warning: format specifies type 'unsigned int' but the argument has type 'size_t' (aka 'unsigned long') [-Wformat] sid = talloc_asprintf(global_talloc_context, SID_TMPL, c); ^ src/tests/cmocka/test_utils.c:155:69: warning: format specifies type 'unsigned int' but the argument has type 'size_t' (aka 'unsigned long') [-Wformat] name = talloc_asprintf(global_talloc_context, DOMNAME_TMPL, c); ^ src/tests/cmocka/test_utils.c:158:75: warning: format specifies type 'unsigned int' but the argument has type 'size_t' (aka 'unsigned long') [-Wformat] flat_name = talloc_asprintf(global_talloc_context, FLATNAME_TMPL, c); ^ src/tests/cmocka/test_utils.c:161:64: warning: format specifies type 'unsigned int' but the argument has type 'size_t' (aka 'unsigned long') [-Wformat] sid = talloc_asprintf(global_talloc_context, SID_TMPL, c); Simple patch is attached. LS

3 2

[PATCH] mmap_cache: prevent potential dereference of NULL
by Lukas Slebodnik 25 Oct '13

25 Oct '13

ehlo, attached patch fix warnings reported by clang static analyser. LS

2 1

[PATCH] AD: fall back to LDAP if GC is not available.
by Lukas Slebodnik 25 Oct '13

25 Oct '13

ehlo, Global catalog port was ignored from SRV record, hard coded value was used every time. 1st patch should fix it. 2nd patch add fall back to LDAP if GC is not available. with this patch SSSD will not go offline if GC is not available, but it may happen that SSSD will try to connect to GC often. I am not sure, but we can add new option do disable GC lookup completely. LS

3 4

[PATCHES] IPA: add trusted domains with missing idrange
by Sumit Bose 25 Oct '13

25 Oct '13

Hi, this patch set tries to fix https://fedorahosted.org/sssd/ticket/2101 . Currently we rely on the fact that the external mapping is the default in the case of an error. But this leads to a loot of useless CPU cycles and maybe irritating error messages. With this patch set each trusted AD member domain gets a proper range assigned if the forest root is configured to manage the POSIX attributes. bye, Sumit

2 5

[PATCH] subdomains: first destroy ptask than remove sdom
by Pavel Březina 24 Oct '13

24 Oct '13

2 6

[PATCH] sdap_get_generic_ext_send: check if we a re still connected
by Sumit Bose 22 Oct '13

22 Oct '13

Hi, this patch tries to fix https://fedorahosted.org/sssd/ticket/2126 . Se commit message for details. bye, Sumit

2 3

[PATCH] IPA: add callback to reset subdomain timeouts
by Sumit Bose 22 Oct '13

22 Oct '13

Hi, these two patches are the SSSD part to fix https://fedorahosted.org/sssd/ticket/2030 . To reset the timeouts I introduced a new callback type which is always executed if SIGUSR2 (go online immediately) is received in contrast to the default online callback which are only executed if the backend was offline before. If the patch are accepted I will send corresponding ones to FreeIPA to send the signal if 'ipa trust-add' is run as root. bye, Sumit

2 5

[PATCH] Remove duplicate declaration
by Jakub Hrozek 22 Oct '13

22 Oct '13

sss_parse_name() was declared twice for no apparent reason. This patch removes the duplicate declaration.

2 4

[PATCH] IPA: Do not enable IPA sites in server mode
by Jakub Hrozek 22 Oct '13

22 Oct '13

I realized this might be a nice chance when I was working on #2079. In the server mode, the IPA sites should be ignored, I think. But I don't think this patch is too important as IPA sites are still only experimental patches.

2 5

[PATCH] nss: wait for initial subdomains request to finish
by Pavel Březina 22 Oct '13

22 Oct '13

https://fedorahosted.org/sssd/ticket/2092

3 6

[INI] [PATCH] Fix warning format string is not a string literal.
by Lukas Slebodnik 22 Oct '13

22 Oct '13

ehlo, I found a warning in ding-libs (ini), while I was testing patches on the list. Simple patch is attached. LS

2 2

[PATCH] Remove unused constants
by Jakub Hrozek 22 Oct '13

22 Oct '13

I found some unused code when working on the dbus responder.

2 2

[PATCH] IPA: Remove unused memory context
by Lukas Slebodnik 22 Oct '13

22 Oct '13

ehlo, While I was working on another isuue I found unused paraeter. Simple patch is attached LS

2 2

[PATCH] PROXY: Fix memory hierarchy when enumerating services
by Jakub Hrozek 22 Oct '13

22 Oct '13

Enumerating services with the proxy backend didn't work, a local variable was used as a talloc context..

2 2

[PATCH] krb5: Use right function to free data
by Lukas Slebodnik 22 Oct '13

22 Oct '13

ehlo, This patch fixes warning reported by clang static analyzer. Simple patch is attached. LS

3 4

[INI][PATCHES] Allow c-style comments in config files
by Dmitri Pal 21 Oct '13

21 Oct '13

Hello The following patch set addresses ticket https://fedorahosted.org/sssd/ticket/2108 Please see commit messages for more details about what each patch does. Please follow the order of the patches in the set. -- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 4

SSSD Internals Document published
by Yassir Elley 21 Oct '13

21 Oct '13

The SSSD team has published an SSSD Internals Document, which can be found at https://fedorahosted.org/sssd/wiki/InternalsDocs. If there are any mistakes in the document, feel free to modify the document. >From the Introduction to the document: " The purpose of this document is to give a basic description of the internals of the SSSD implementation. The material in this document is accurate as of SSSD 1.10. It is assumed that the reader is already familiar with the external usage of SSSD. The intended audience of this document are new contributors to the SSSD project. This document is not intended to be comprehensive. For additional details on specific features, please refer to the various Design Documents. This document does not discuss the details of building, installing, and debugging SSSD. More information on these topics can be found in the Developer Pages, and the Documentation. To be most useful, this document should be updated as appropriate, and reviewed at regular intervals. In order to better understand the material and make things more concrete, this document starts by describing a specific use case (and configuration) that will be discussed throughout the document. The document starts with a high level end-to-end overview, and then deep-dives into detailed descriptions. The document is organized into the following sections: Active Directory Use Case: specifies use case used throughout the document System Overview: end-to-end SSSD overview, including short descriptions of components Advanced Topics: offline operation, multiple domains, trust relationships SSSD Wrappers: SBus, SDAP Common Data Structures: data structures used by each SSSD process Component Details: gory details of each component Appendix: tevent, function descriptions, filesystem locations, helpful links " Regards, Yassir.

3 3

Design Discussion: Improving AD provider access control
by Jakub Hrozek 20 Oct '13

20 Oct '13

Hi, I created a design page that describes a proposed way of improving the current AD provider access control. The main ticket that tracks the work is https://fedorahosted.org/sssd/ticket/2082 and the full design page can be found here: https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryAccessControl Comments and review are mostly welcome. For your convenience, the text of the design page is also copied below, in wiki syntax: == Active Directory client access control == Related ticket(s): * [https://fedorahosted.org/sssd/ticket/2082 RFE:Add a new option ad_access_filter] * [https://fedorahosted.org/sssd/ticket/1975 RFE:Change the default of ldap_access_order] * [https://fedorahosted.org/sssd/ticket/1977 issues when combining the AD provider and ldap_access_filter] Somewhat related: * [https://fedorahosted.org/sssd/ticket/2083 Document the best practices for AD access control] === Problem Statement === The recommended way of connecting a Linux client to an Active Directory domain is using the [http://jhrozek.fedorapeople.org/sssd/1.11.0/man/sssd-ad.5.html AD provider]. However, in the default configuration of the Active Directory provider, only account expiration is checked. Very often, the administrator needs to restrict the access to the client machine further, limiting the access to a certain user, group of users, or using some other custom filtering mechanism. In order to do so, the administrator is required to use an alternative access control provider. However, none of the alternatives provide the full required functionality for all users resolvable by the AD provider, moreover they are hard to configure. This design page proposes extension of the AD access provider to address these concerns. === Current access control options === With the existing SSSD, the administrator has two basic means to restrict access control to the Linux client - using the [http://jhrozek.fedorapeople.org/sssd/1.11.0/man/sssd-simple.5.html simple access control provider] or configuring the LDAP access control provider. Each approach has its pros and cons. ==== Using the simple access provider ==== The simple access provider grants or denies access based on the contents of allow and deny lists. There are separate lists for user and group names as well as allowed and denied objects. The following example shows configuration that grants access to user named `tux` and group called `linuxadmins`. {{{ access_provider = simple simple_allow_users = tux simple_allow_groups = linuxadmins }}} * Pros: * Easy to configure * Realmd provides an interface to configure the simple access provider using its CLI * Cons: * Account expiration is not checked * Limited expresiveness. No way to combine several clauses * Does not align with the LDAP structure the Active Directory uses ==== Using the LDAP access provider ==== The LDAP access provider offers a way to configure the access control decision based on whether the user matches a preconfigured filter. Moreover, the LDAP access provider also offers chaining other LDAP based checks. For the vanilla AD environment, only account expiration check applies. The following example illustrates configuration that allows access to those users, who are members of group named `linuxadmins` AND have a valid home directory set using the `ldap_access_filter` directive. The users who match the configured filter are also checked whether they are expired (`ldap_access_order` contains `expire`). {{{ access_provider = ldap ldap_access_order = filter, expire ldap_account_expire_policy = ad ldap_access_filter = (&(memberOf=cn=admins,ou=groups,dc=example,dc=com)(unixHomeDirectory=*)) ldap_sasl_mech = GSSAPI ldap_sasl_authid = CLIENT_SHORTNAME$(a)EXAMPLE.COM ldap_schema = ad }}} * Pros: * Allows the administrator to base access control on a custom LDAP filter, making it possible to combine several conditions * Conditions are not limited to user names or group membership * Cons: * Nontrivial and clumsy configuration that must include several low level LDAP settings, otherwise set automatically by the AD provider. Defeats the whole purpose of the AD provider * The admin needs to combine AD and LDAP providers. Judging by experience from triaging support cases with Red Hat support, this is a problem for many admins. * Account expiration check must be configured separately, which is not obvious * No support for users from trusted AD domains * No realmd integration === Proposed solution === The proposal is to add a new access filter configuration option to the existing AD access provider. Adding the option to the AD provider would greatly simplify the configuration when compared to the LDAP access control, while maintaining the full expresiveness of `ldap_access_filter`. The new option would be called `ad_access_filter`. If the new option was set, then the AD access provider would first match the entry against the filter in that option. If the entry matched, then the account would be checked for expiration. The following exapmple illustrates an example similar to the one above, using the proposed AD options: {{{ access_provider = ad ad_access_filter = (&(memberOf=cn=admins,ou=groups,dc=example,dc=com)(unixHomeDirectory=*)) }}} The main advantage is simplified configuration. The admin doesn't have to know or understand what "SASL ID" is. In comparison with the two legacy solutions explained above: * Pros * Easy and intuitive configuration. Only one provider type is configured * Sane defaults - always checks for expiration, also checks access filter if configured that way * Would support users and groups from trusted domains by leveraging the existing AD provider infrastructure * Cons * No realmd integration === Realmd integration === After a short discussion with the realmd upstream maintainer, it was decided that these options do not fit the realmd use-cases well. If the user needs to use such advanced techniques as LDAP filters, chances are that he doesn't need a tool like realmd to set them up in the config file. === Implementation details === 1. The default value of what AD access_provider is set to should be changed * Currently, if `access_provider` is not set explicitly, the default is `permit`, thus allowing even expired accounts * The new default would be `ad`, checking account expiration even with a minimal configuration 1. A new option would be added. The new option would be called `ad_access_filter` 1. The LDAP access provider must be extended to allow connecting to a GC and support subdomains in general * Pass in `struct sdap_domain` and `id_conn` instead of using the connection from `sdap_id_ctx` directly * The code must not read the `sss_domain_info` from `be_ctx` but only from `sdap_domain` in order to support subdomain users 1. The AD access provider must call the improved LDAP access provider internally with the right connection * The default should be GC * If POSIX attributes are in use and GC lookup wouldn't match, optionally fall back to LDAP. This fallback could be tried just once to speed up subsequent access control 1. The default chain of LDAP access filter the AD provider sets internally must be changed. * Currently AD provider sets `ldap_access_order=expire`. If (and only if) `ad_access_filter` was set, the LDAP chain would become `ldap_access_order=filter,expire` ==== Parsing the `ad_access_filter` option ==== 1. The `ad_access_filter` option is a comma-separated list of filters that apply globally, per-domain or per-forest. The most specific match is used 1. If the `ad_access_filter` value starts with an opening bracket `(`, it is used as a filter for all entries from all domains and forests * example: `(&(memberOf=cn=admins,ou=groups,dc=example,dc=com)(unixHomeDirectory=*))` 1. More advanced format can be used to restrict the filter to a specific domain or a specific forest. This format is `KEYWORD:NAME:FILTER` * KEYWORD can be one of `DOM` or `FOREST` * KEYWORD can be missing * NAME is a label. * if KEYWORD equals `DOM` or missing completely, the filter is applied for users from domain named NAME only * if KEYWORD equals `FOREST`, the filter is applied on users from forest named NAME only * examples of valid filters are: * apply filter on domain called dom1 only: * `dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)` * apply filter on domain called dom2 only: * `DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)` * apply filter on forest called EXAMPLE.COM only: * `FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)` 1. If no filter matches the user's domain, access is denied * example `ad_access_filter = dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com), dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)`, user logs in from dom3 === Contingency plan === None needed. The existing options would still exist and function as they do now. === How to test === 1. Check that `access_provider=ad` without any other options allows non-expired users 1. Check that `access_provider=ad` without any other options denies expired users 1. Test that setting `ad_access_filter` restricts access to users who match the filter * test that an expired user, even though he matches the filter, is denied access * this test must include users from the primary domain as well as a sub domain * Different filters should be tested to make sure the most speficic filter applies * example: add a restrictive filter for dom1 and permissive filter without specifying the domain. A user from dom1 must be denied access, while a user from other domain must be allowed access 1. When access is denied, the SSSD PAM responder must return a reasonable return code (6) === Future and optional enhancements === In the future, we should extend the `access_provider` option itself and allow chaining access providers. This enhancement would allow even more flexibility and would allow the administrator to combine different access providers, but is outside the scope of the change described by this design page. === Author(s) === * Jakub Hrozek <jhrozek(a)redhat.com> * Sumit Bose <sbose(a)redhat.com>

4 7

[INI] [PATCHES] Add UTF 8/16/32 conversion
by Dmitri Pal 19 Oct '13

19 Oct '13

Hello, The attached patches address ticket https://fedorahosted.org/sssd/ticket/2106 The patches do not define new flags as suggested in the ticket. As we discussed with Nalin we try to detect the encoding based on the BOM and do the right thing without flags. If we see that this is not enough we will add flags but that would add a new function so such change would be destined for a bigger release. For now I think the use case is addressed. If we see the need to other use cases we will open other tickets. The patch depends on the previous set of patches that deal with C-Style comments. I also found some other unrelated issue that I logged as a separate ticket. https://fedorahosted.org/sssd/ticket/2119 -- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 3

automatic renewal of TGT for IPA users
by Qing Chang 18 Oct '13

18 Oct '13

In sssd InternalsDocs, there is a statement: "SSSD can automatically renew the TGT at a configurable interval". Can someone give me a pointer as how I can configure sssd to do it? I am using krenew for the same effect, thought a native way would be much better... Many thanks, Qing

2 1

[PATCHES] struct sockaddr casting
by Michal Židek 17 Oct '13

17 Oct '13

Hello, these are the patches, that solve the casting of sockaddr structure. Patch 0001 - Adds function to filter out special ip addresses (loopback, multicast, linklocal, broadcast) and also a unit test for it. Used in later patches. Patch 0002 and 0003 - Use the function from patch 0001 and properly copy the sockaddr_in structure to avoid alignment warnings. Patch 0004 - Avoid casting of sockaddr to sockaddr_in in tests. Also here is the discussion from diffrent thread, related to sockaddr casting: // PASTE BEGIN >>>>> I tested some compilers and patches work fine with clang and gcc. >>>>> But there are also another compilers in the world >>>>> ant they needn't understand "pragma GCC". This pragma is not standardized. >>>>> >>>>> >>>>> src/providers/dp_dyndns.c(145): warning #161: unrecognized #pragma >>>>> #pragma GCC diagnostic push >>>>> ^ >>>>> >>>>> src/providers/dp_dyndns.c(146): warning #161: unrecognized #pragma >>>>> #pragma GCC diagnostic ignored "-Wcast-align" >>>>> ^ >>>>> >>>>> src/providers/dp_dyndns.c(206): warning #161: unrecognized #pragma >>>>> #pragma GCC diagnostic pop >>>>> ^ >>>>> >>>>> If you are 100% sure about alignment, you can define own macro. >>>>> >>>>> Something like this: >>>>> #define ignore_align(var, dest_type) \ >>>>> (dest_type *)((void*)(var)) >>>>> >>>>> And usage: >>>>> wrapper->refcount = ignore_align(wrapper->ptr + refcount_offset, int); >>>>> >>>>> >>>>> Does anybody have any better ideas? >>>> Compiler specific #pragma should not be used. And I think in general >>>> #pragma should be used with great care. Currently there is only one use >>>> case in sssd in the memcache code to align some structs which make >>>> sense. >>> Indeed, agree 100% >>> >>>> Especially I think ingnoring a warning is not a good idea. If currently >>>> no one has a good idea how to handle the sockaddr and in_addr structs in >>>> a way which does not produce a warning I would prefer to keep the >>>> warning around until someone has a good idea. Imo a comment in the code >>>> that the warning can be ignored would be sufficient for the time being. >>> casting sockaddr is a bug, unless you know for sure it was created as >>> sockaddr_un and then simply casted to sockaddr, but in that case I would >>> consider the casting to pass it around just a different bug. >>> >>> Please use sockaddr_un anywhere you need to perform casts. Pass around >>> sockaddr_un and cast it only at the time of use when needed. >> It is not possible to use sockaddr_un(or sockaddr_storage). >> >> We use function getifaddrs to retrieve addresses of network interfaces. >> >> Manual page says (man 3 getifaddrs) >> -------------------------------------------------------------------------- >> int getifaddrs(struct ifaddrs **ifap); >> >> The getifaddrs() function creates a linked list of structures >> describing the network interfaces of the local system, and stores >> the address of the first item of the list in *ifap. >> The list consists of ifaddrs structures, defined as follows: >> >> struct ifaddrs { >> struct ifaddrs *ifa_next; /* Next item in list */ >> char *ifa_name; /* Name of interface */ >> unsigned int ifa_flags; /* Flags from SIOCGIFFLAGS */ >> struct sockaddr *ifa_addr; /* Address of interface */ >> ^^^^^^^^^^^^^^^ >> We cannot change this type >> struct sockaddr *ifa_netmask; /* Netmask of interface */ >> union { >> struct sockaddr *ifu_broadaddr; >> /* Broadcast address of interface */ >> struct sockaddr *ifu_dstaddr; >> /* Point-to-point destination address */ >> } ifa_ifu; >> #define ifa_broadaddr ifa_ifu.ifu_broadaddr >> #define ifa_dstaddr ifa_ifu.ifu_dstaddr >> void *ifa_data; /* Address-specific data */ >> }; >> >> -------------------------------------------------------------------------- > In this case you should copy the contents of sockaddr to a new variable > of the right type, and not cast. > > Simo. > Yes, this is the only way you can deal with these issues. I remembered this from my experiments with ELAPI 3 years ago. I ran into similar problems with this function and had to copy data. -- Thank you, Dmitri Pal // PASTE END Thank you, Michal

3 10

[PATCH] krb5: Remove warning dereference of a null pointer
by Lukas Slebodnik 17 Oct '13

17 Oct '13

ehlo, coverity and clang report warning "dereference of a null pointer". I think it was false possitive, because we cannot get to the sithuation where "kr->creds == NULL" Patch is attached. Gzipped clang report is attached. (report-pv9WXu.html#Path19) LS

3 2

[PATCH] sdap_idmap: properly handle ranges for external mappings
by Sumit Bose 17 Oct '13

17 Oct '13

Hi, this patch set aims to fix https://fedorahosted.org/sssd/ticket/2105 . But since I had to touch the libsss_idmap code for this I found an issue here as well, which is fixed by the first two patches. bye, Sumit

2 2

[PATCH] KRB5: Return PAM_ACCT_EXPIRED when logging in as expired AD user
by Jakub Hrozek 17 Oct '13

17 Oct '13

Hi, When testing the AD access control patches, I found out that logging in as expired AD user triggered a System Error. The attached patch fixes that.

2 2

[PATCH] dlopen-tests: Check the result of asprintf
by Benjamin Franzke 17 Oct '13

17 Oct '13

According to asprintf(3) the content off errmsg is undefined on error, lets set it to NULL.

3 2

ssh does not remove credential cache at logout
by Qing Chang 16 Oct '13

16 Oct '13

IPA clients (RHEL, CentOS and Unbuntu 12.04) does not clear credential cache files when a user logout from a ssh session. pam_sss man page does not have much information on how it manage to clean out a session when the session is ended. This is my sshd and session_common file: ===== sshd ===== @include common-auth account required pam_nologin.so @include common-account @include common-session session optional pam_motd.so # [1] session optional pam_mail.so standard noenv # [1] session required pam_limits.so session required pam_env.so # [1] session required pam_env.so user_readenv=1 envfile=/etc/default/locale @include common-password ===== ===== common-session ===== auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] pam_sss.so use_first_pass auth requisite pam_deny.so auth required pam_permit.so auth optional pam_cap.so ===== Is this a pam configuration issue or a pam_sss issue? Thanks, Qing -- ------------------ Qing Chang Senior Systems Administrator M6-624 Research Computing Sunnybrook Health Sciences Centre 2075 Bayview Ave. Toronto, Ontario, M4N 3M5 (416) 480-6100 x3263 qchang(a)sri.utoronto.ca ------------------

2 2

[PATCH] IPA server mode: properly initialize ext_groups
by Sumit Bose 16 Oct '13

16 Oct '13

Hi, when writing the code to read IPA memberships for trusted AD users I didn't carefully check how struct ipa_server_mode_ctx is initialized. Hence the new member I have added was not properly initialized. This patch should fix it. bye, Sumit

3 4

[PATCH v2] Debug macro refactoring
by Nikolai Kondrashov 16 Oct '13

16 Oct '13

Hi everyone, Please find attached my updated patches refactoring the DEBUG macro (mostly). I've moved the level limiting condition to the macro as requested by Simo. I've separated the macro definition update from the invocation update. I've tried using coccinelle ("spatch") to do the invocation update, but unfortunately, it either puts all DEBUG macro arguments on a single line with a simple semantic patch (debug.spatch), or puts parts of the concatenated string literals on a single line with an unrolled version (debug_unrolled.spatch). I haven't managed to find another way. So, for this simple case, Perl seems to be better (if not so reliable). I've used the following command to update the invocations: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv $f{,.orig} perl -e 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*$[^(]+)\((.*?)$\s*\)\s*;#$1$2);#gs; print $text; ' < $f.orig > $f done And then manually fixed two or three cases where it got confused and has broken the compilation. After that, coccinelle couldn't find any more places to update. You can either use the included patch, try applying one of the semantic patches, or not convert the macro to variadic and not update the invocations at all. You can still get the size reduction benefit and fix the flushing. I will leave this up to you. If you decide to try the semantic patches, they can be applied as such: spatch --sp-file debug_unrolled.spatch -dir . | git apply You will need the "coccinelle" package to get the "spatch" tool. Sincerely, Nick

1 0

[PATCH v2] Debug macro refactoring
by Nikolai Kondrashov 16 Oct '13

16 Oct '13

Hi everyone, Please find attached my updated patches refactoring the DEBUG macro (mostly). I've moved the level limiting condition to the macro as requested by Simo. I've separated the macro definition update from the invocation update. I've tried using coccinelle ("spatch") to do the invocation update, but unfortunately, it either puts all DEBUG macro arguments on a single line with a simple semantic patch (debug.spatch), or puts parts of the concatenated string literals on a single line with an unrolled version (debug_unrolled.spatch). I haven't managed to find another way. So, for this simple case, Perl seems to be better (if not so reliable). I've used the following command to update the invocations: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv $f{,.orig} perl -e 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*$[^(]+)\((.*?)$\s*\)\s*;#$1$2);#gs; print $text; ' < $f.orig > $f done And then manually fixed two or three cases where it got confused and has broken the compilation. After that, coccinelle couldn't find any more places to update. You can either use the included patch, try applying one of the semantic patches, or not convert the macro to variadic and not update the invocations at all. You can still get the size reduction benefit and fix the flushing. I will leave this up to you. If you decide to try the semantic patches, they can be applied as such: spatch --sp-file debug_unrolled.spatch -dir . | git apply You will need the "coccinelle" package to get the "spatch" tool. Sincerely, Nick

1 0

[PATCH] LDAP: Set default value for dyndns update to false
by Lukas Slebodnik 15 Oct '13

15 Oct '13

ehlo, In some cases, local boolean variable "do_update" could be used without proper initialisation. Clang static analyser warning: "Assigned value is garbage or undefined" It was not a big problem, because non-zero value for boolean variable mean true. Simple patch is attached. LS

3 3

Fwd: [sudo-users] objectClass=sudoRule vs objectClass=sudoRole in AD
by JR Aquino 15 Oct '13

15 Oct '13

This was asked in the SUDO-users mailing list today. It seemed like something important to cover in here as well. From: <Curtis.CTR.Roze(a)faa.gov<mailto:Curtis.CTR.Roze@faa.gov>> Subject: [sudo-users] objectClass=sudoRule vs objectClass=sudoRole in AD Date: October 11, 2013 5:53:44 AM PDT To: <sudo-users(a)sudo.ws<mailto:sudo-users@sudo.ws>> How does the query for sudo rules in AD even work when the debug shows a query such as: (&(objectClass=sudoRule)(|(sudoUser=ALL)(sudoUser=test.user)(sudoUser=#1215014110)(sudoUser=%test_rmm_linux_users)(sudoUser=%Domain Users)(sudoUser=%Domain Users)(sudoUser=+*))) If I execute this on the command line using ldapsearch I get no results. If I change objectClass to objectClass=sudoRole in the same seach, ldapsearch works perfectly. I created the sudoers ou and objects using the guidance in the sudoers documentation on sudo.ws. Thanks for the insight. Curtis Roze ____________________________________________________________ sudo-users mailing list <sudo-users(a)sudo.ws<mailto:sudo-users@sudo.ws>> For list information, options, or to unsubscribe, visit: http://www.sudo.ws/mailman/listinfo/sudo-users

4 5

[PATCH] Spec file changes for cifs-utils plugin
by Sumit Bose 15 Oct '13

15 Oct '13

Hi, as promised I created the spec file changes to include the cifs-utils plugin into the sssd-client package on Fedora and RHEL platforms where recent cifs-utils are available. bye, Sumit

3 9

Re: [SSSD] [PATCH] CIFS idmap Plugin using SSSD
by Benjamin Franzke 15 Oct '13

15 Oct '13

Hi Sumit, Sorry for the delay, got sidetracked by trying to find an appropriate way to handle the well known sids etc.. But thanks to your reminder I got over to do the integration into sssd's autoconf/make now :) So here is the patch as an attachment. (as recommended by the contrib page - but if you like it better for review l'll git send-email it as well..) This patch does not include an update for the rpm specs. Could you do that integration? For me as a gentoo user that is currently an unknown-area :) Regards, Ben 2013/10/9 Sumit Bose <sbose(a)redhat.com> > On Mon, Oct 07, 2013 at 12:22:13PM +0200, Benjamin Franzke wrote: > > 2013/10/7 Sumit Bose <sbose(a)redhat.com> > > > > > On Thu, Oct 03, 2013 at 11:57:07PM +0200, Benjamin Franzke wrote: > > > > > > > > > > Hi Ben, > > > > > > > > > > this is really great, thank you very much for the contribution! As > a > > > > > matter of fact, we've been planning on delivering the CIFS plugin > as > > > > > part of the next release: > > > > > https://fedorahosted.org/sssd/ticket/1534 > > > > > > > > > > Have you found the design page we created? > > > > > > > > > https://fedorahosted.org/sssd/wiki/DesignDocs/IntegrateSSSDWithCIFSClient > > > > > > > > > > > > Yeah, I've read those pages before writing the plugin.. > > > > > > > > > > > > > > > > > > Mostly the work on our side was done by Sumit Bose (I've CC-ed > him). I > > > > > would propose to get in touch with him to avoid duplicating some > > > effort. > > > > > > > > > Unfortunately Sumit is in Germany and there is a holiday so he won't > be > > > > > available until Monday. > > > > > > > > > > > > > > In general, I would suggest to merge this code into the SSSD tree > if > > > you > > > > > wouldn't mind. I think it would makes sense to have the code in the > > > same > > > > > repo as the ID mapping library. > > > > > > > > > > > > > I'd really appreciate having it integrated in sssd tree, > > > > to have centralized maintainance and adoption by distributions.. > > > > > > Thanks a lot for the patch. I would suggest to put your code into > > > src/lib/cifs_idmap_sss/ and modify SSSD's Makefile.am to build the > > > plugin. Would you like to do the integration and send the result for > > > review to this list again? > > > > > > > I'd like to do that integration, will send a patch.. > > I'd like to add the plugin to the next Fedora release which > unfortunately has its deadline next week. I don't want to rush you, but > do you have a chance to send the patch today or tomorrow? Otherwise > would you mind if I prepare the patch to integrate your code into the > SSSD tree? > > Thanks for your help. > > bye, > Sumit > > > > > > > About the well-know SIDs. They should not be handled inside the plugin > > > but by SSSD itself. If you are interested in adding them I'd be happy > to > > > help you how to start (if my help is needed at all :-). > > > > > > > Yup, sounds better to handle the SIDs by SSSD core. I'd like to try.. > > I'll see whether time permits me to do that soon.. (doing this as a part > of > > my thesis) > > > > > > > > > > > > bye, > > > Sumit > > > > > > > > > > > > > > > > Thanks again for the contribution, much appreciated! > > > > > _______________________________________________ > > > > > sssd-devel mailing list > > > > > sssd-devel(a)lists.fedorahosted.org > > > > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel > > > > > > > > > > > > _______________________________________________ > > > > sssd-devel mailing list > > > > sssd-devel(a)lists.fedorahosted.org > > > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel > > > > > > _______________________________________________ > > > sssd-devel mailing list > > > sssd-devel(a)lists.fedorahosted.org > > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel > > > > > > _______________________________________________ > > sssd-devel mailing list > > sssd-devel(a)lists.fedorahosted.org > > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel > >

4 16

[PATCH] INI: Disable line-wrapping functionality
by Jakub Hrozek 11 Oct '13

11 Oct '13

As Dmitri noted in a thread on sssd-users, we did an incompatible change in how we handle lines beginning with whitespace. Since the change is breaking existing configurations, we should revert the change. There is a separate ticket to consider the line wrapping functionality: https://fedorahosted.org/sssd/ticket/2118

2 2

[PATCH] MAN: Fix refsect-id
by Jakub Hrozek 11 Oct '13

11 Oct '13

A trivial man page patch.

2 2

[PATCH] krb5: fix warning variable may be used uninitialized
by Lukas Slebodnik 10 Oct '13

10 Oct '13

ehlo, scan-build found a warning. src/providers/krb5/krb5_child.c:1988:9: error: ‘offline’ may be used uninitialized in this function [-Werror=maybe-uninitialized] ret = k5c_setup(kr, offline); gcc also reports this warning with enabled optimization >= "-O2". It seems to me really weird, because compilator assumes that function sss_atomic_read_s return value -1 and errno==0. I tried to modify function sss_atomic_read_s, but I could not fix this warning. Another possible solution is to initialize variable "offline" to some default value. I appreciate any comment. Patch is attached. LS

2 2

[PATCH] LDAP: handle SID requests if noexist_delete is set
by Sumit Bose 10 Oct '13

10 Oct '13

Hi, I found this while testing the cifs-utils plugin I opened https://fedorahosted.org/sssd/ticket/2116 to make sure all affected versions will be fixed. bye, Sumit

2 2

Something to share about fmemopen()
by Dmitri Pal 10 Oct '13

10 Oct '13

Hello, I came across an interesting behavior that is IMO worth sharing with other developers. It turns out that fmemopen() fails with error 22 EINVAL if the buffer passed in is of length 0. Imagine situation: I have a file in the directory of 0 length. I open it with fopen() or with open() and then fdopen() in "r" mode and I can read it with getline(). Of cause the first read will return EOF and I will be done. But if I open file with open() in binary mode, and mirror it into a buffer and the file is of length 0 then the buffer will be of length 0 too but attemt to use fmemopen() would fail. So mirroring in becomes non transparent operation you have to special case the situation when original file in NULL. So question is what should I do with it? File a bug or just ask to document it? Man page does not say anything about it. Advises welcome. -- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 1

[PATCHES] Clean up documentation on debug levels
by Stephen Gallagher 08 Oct '13

08 Oct '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Originally, we planned to deprecate the decimal values for the debug levels, but that has proven to be too difficult for most users to understand. Instead, we will document both the simple decimal and complex bitmask values and recommend the use of the decimal values. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlJStNIACgkQeiVVYja6o6P2mACgjZ8LySsQ+c1ooH/Z14cx7UbZ uoIAoJys2wgpP9r7wEAtdXAarBA33TyC =a4e4 -----END PGP SIGNATURE-----

3 3

[INI][PATCH] Fix for the parsing of the multi value strings
by Dmitri Pal 07 Oct '13

07 Oct '13

Hello, Patch fixes https://fedorahosted.org/sssd/ticket/2110 - Processing miltivalue strings does not return last token -- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 2

[PATCH] CIFS idmap Plugin using SSSD
by Benjamin Franzke 07 Oct '13

07 Oct '13

Hello list, I've started to implement a plugin for the cifs-utils idmap interface. Currently it lives in an own repository and can be build outside the sssd tree, thanks to the public sssd libraries libsss_idmap.so and libsss_nss_idmap.so: http://git.bnfr.net/cifs_idmap_sss/tree/cifs_idmap_sss.c git://git.bnfr.net/cifs_idmap_sss Still missing is the mapping of Samba's Unix SIDs and some well known SIDs (more info in cifs_idmap_sss.c) Are you intrested in reviewing it and/or have it included in the sssd git tree or somehow else as a sssd project? Thanks, Ben

3 4

[PATCH] possible alternative for #2071
by Simo Sorce 07 Oct '13

07 Oct '13

Attached an untested possible alternative for #2071 The other option is the last patch of my previous patchset in the thread named: "[SSSD] [PATCHES] Simplify credential krb5 cache manipulation". Let's discuss if any of these approaches is ok, or if a third way needs to be found. Simo. -- Simo Sorce * Red Hat, Inc * New York

4 17

[INI][PATCH] Fix doc strings
by Dmitri Pal 05 Oct '13

05 Oct '13

Hello, Patch addresses the following ticket: https://fedorahosted.org/sssd/ticket/2107 - Description of the parse flags use is missing in header file -- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 2

[PATCH] AD: properly intitialize GC from ad_server option
by Sumit Bose 04 Oct '13

04 Oct '13

Hi, this patch fixes a copy-n-paste error in the init code of the AD provider. bye, Sumit

3 4

[PATCH] sudo: allow specifying only one time restriction
by Pavel Březina 04 Oct '13

04 Oct '13

https://fedorahosted.org/sssd/ticket/2100

3 7

[PATCH] Two fixes for subdomain krb5 offline auth
by Jakub Hrozek 03 Oct '13

03 Oct '13

Hi, I was playing with different offline krb5 authentication ways today when testing Sumit's patches and I don't think the offline authentication of subdomain users was correct. Attached are two patches -- one is just a better error code, the other actually makes the SSSD search for the right user entry during krb5 offline auth. To test the first one, pause of shutdown a trusted AD while remaining connected to the root domain AD.

3 5

1.11.1 runtime error undefined symbol:sss_idmap_domain_has_algorithmic_mapping
by steve 02 Oct '13

02 Oct '13

Hi openSUSE 12.3 build and installed fine, but fails with: (Sat Sep 28 18:04:27 2013) [sssd[be[default]]] [load_backend_module] (0x0010): Unable to load ad module with path (/usr/local/lib/sssd/libsss_ad.so), error: /usr/local/lib/sssd/libsss_ldap_common.so: undefined symbol: sss_idmap_domain_has_algorithmic_mapping 1.10.0 runs fine on the same box. Can you help me? Cheers, Steve [sssd] #debug_level = 6 services = nss, pam, autofs config_file_version = 2 domains = default [nss] [pam] [autofs] [domain/default] #debug_level = 6 dyndns_update=true #dyndns_refresh_interval = 16 ad_hostname = catral.hh3.site ad_server = hh16.hh3.site ad_domain = hh3.site ldap_schema = ad id_provider = ad access_provider = simple enumerate = false cache_credentials = true #entry_cache_timeout = 60 auth_provider = krb5 chpass_provider = krb5 krb5_realm = HH3.SITE krb5_server = hh16.hh3.site krb5_kpasswd = hh16.hh3.site ldap_id_mapping=false ldap_referrals = false ldap_uri = ldap://hh16.hh3.site ldap_search_base = dc=hh3,dc=site #ldap_tls_cacertdir = /usr/local/samba/private/tls #ldap_id_use_start_tls = true #entry_negative_timeout = 1 ldap_user_object_class = user ldap_user_name = samAccountName ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber ldap_user_home_directory = unixHomeDirectory ldap_user_shell = loginShell ldap_group_object_class = group ldap_group_search_base = dc=hh3,dc=site ldap_group_name = cn ldap_group_member = member ldap_sasl_mech = gssapi ldap_sasl_authid = CATRAL$(a)HH3.SITE #krb5_keytab = /etc/krb5.keytab ldap_krb5_init_creds = true autofs_provider=ldap #ldap_autofs_search_base = CN=hh3,CN=defaultMigrationContainer30,DC=hh3,DC=site #ldap_autofs_map_object_class = nisMap #ldap_autofs_entry_object_class = nisObject #ldap_autofs_map_name = nisMapName #ldap_autofs_entry_key = cn #ldap_autofs_entry_value = nisMapEntry ldap_autofs_search_base = OU=automount,DC=hh3,DC=site ldap_autofs_map_object_class = automountMap ldap_autofs_entry_object_class = automount ldap_autofs_map_name = automountMapName ldap_autofs_entry_key = automountKey ldap_autofs_entry_value = automountInformation

4 14

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel October 2013