sssd-devel October 2014

sssd-devel@lists.fedorahosted.org

16 participants
100 discussions

[PATCHES] Merging INI snippets
by Dmitri Pal 03 Dec '14

03 Dec '14

Hello, Extensive travel in recent months allowed me to finish this code. Here is the updated design: https://fedorahosted.org/sssd/wiki/DesignDocs/ding-libs/INIConfigMerge Patches: 0001 - Fix in case the Ref array is empty and we need to print/debug it 0002 - Declaration of the new function to do access checks 0003 - Big patch with core functionality 0004 - Updated access check code to use new internal access control function 0005 - File with expected output for unit test validation 0006 - Makefile and related changes to start building new code No rush, take your time. :-) -- Thank you, Dmitri Pal Sr. Engineering Manager IdM portfolio Red Hat, Inc.

3 13

[PATCH] BUILD: restrict perms. when installing from source
by Pavel Reichl 02 Dec '14

02 Dec '14

Hello, please see attached patch. Thanks!

3 13

KRB5CCNAME variable broken in second concurrent login shell - bug?
by Joschi Brauchle 02 Dec '14

02 Dec '14

We have a weird problem with the KRB5CCNAME environment variable that seems to be an SSSD bug. Configuration: ------------ /etc/sssd/sssd.conf ------------ ... # Set CCache to Kerberos default krb5_ccachedir = /run/user/%U krb5_ccname_template = DIR:%d/krb5cc ... ------------ /etc/sssd/sssd.conf ------------ Now, user "ne96soh" logs in to the machine for the FIRST time and does a kerberized ldapsearch: ------------ ne96soh@tueilnt-student01:~$ echo $KRB5CCNAME DIR:/run/user/3036404/krb5cc ne96soh@tueilnt-student01:~$ klist Ticket cache: DIR::/run/user/3036404/krb5cc/tktZoweZq ... ne96soh@tueilnt-student01:~$ ldapsearch ...<using GSSAPI> ... <succeeds> ------------ but then logs into the machine a SECOND concurrent time (i.e. leaving first session open): ------------ ne96soh@tueilnt-student01:~$ echo $KRB5CCNAME DIR::/run/user/3036404/krb5cc/tktZoweZq ne96soh@tueilnt-student01:~$ klist Ticket cache: DIR::/run/user/3036404/krb5cc/tktZoweZq ... ne96soh@tueilnt-student01:~$ ldapsearch ...<using GSSAPI> SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No Kerberos credentials available) ------------ For me, the format of 'DIR::/run/user/3036404/krb5cc/tktZoweZq' in the second login seems strange! Is this a valid format? When I manuelly reset the KRB5CCNAME variable in the second login shell to its original value 'DIR:/run/user/3036404/krb5cc', then the ldapsearch using GSSAPI succeeds. The reason of all this seems to be that SSSD reuses existing ccaches for already logged on users, but possibly mixes up formats there. See ------------ /var/log/sssd_default.log ------------ (Wed Oct 15 14:04:54 2014) [sssd[be[default]]] [krb5_auth_send] (0x4000): Ccache_file is [DIR::/run/user/3036404/krb5cc/tktZoweZq] and is active and TGT is valid. ... (Wed Oct 15 14:04:54 2014) [sssd[be[default]]] [krb5_find_ccache_step] (0x0080): Saved ccache DIR::/run/user/3036404/krb5cc/tktZoweZq if of different type than ccache in configuration file, reusing the old ccache ... (Wed Oct 15 14:04:54 2014) [sssd[be[default]]] [safe_remove_old_ccache_file] (0x0400): New and old ccache file are the same, no one will be deleted. (Wed Oct 15 14:04:54 2014) [sssd[be[default]]] [krb5_mod_ccname] (0x4000): Save ccname [DIR::/run/user/3036404/krb5cc/tktZoweZq] for user [ne96soh]. ------------ /var/log/sssd_default.log ------------ Best regards, -- Dipl.-Ing. Joschi Brauchle, M.S. Institute for Communications Engineering (LNT) Technische Universitaet Muenchen (TUM) 80290 Munich, Germany Tel (work): +49 89 289-23474 Fax (work): +49 89 289-23490 E-mail: joschi.brauchle(a)tum.de Web: http://www.lnt.ei.tum.de/

6 15

[PATCH] krb5: Check return value of sss_krb5_princ_realm
by Lukas Slebodnik 28 Nov '14

28 Nov '14

ehlo, yet another warning from clang static analyser. sss_krb5_princ_realm set output parameter realm to NULL and len to 0 in case of failure. Clang static analysers repoted warning "Null pointer passed as an argument to a 'nonnull' parameter" in function match_principal. It was possible, that realm_name with value NULL could be used in strncmp. Function sss_krb5_princ_realm is used on other places for printing(formatting) realm_name and NULL can be safely used as a argument for printf-like functions. Patch is attached. LS

5 13

[PATCH] SYSDB: sysdb_idmap_get_mappings returns ENOENT
by Pavel Reichl 19 Nov '14

19 Nov '14

Hello, please see simple attached patch. Thanks!

3 4

[PATCH] Move ccache operations to krb5_child, allow the krb5_auth code to run unprivileged
by Jakub Hrozek 18 Nov '14

18 Nov '14

Hi, attached are patches that apply on top of my previous ldap_child and selinux_child patches. The complete branch (including tests I'm still working on) can be inspected here: https://fedorapeople.org/cgit/jhrozek/public_git/sssd.git/log/?h=nonroot Simo, Sumit, I added you to CC directly, b/c I suspected you wanted to be included in larger krb5_child changes.. Below are patch descriptinons of the individual changes. [PATCH 1/6] BUILD: Install krb5_child as suid if running under non-privileged user If sssd_be is running unprivileged, then krb5_child must be setuid to be able to access the keytab and become arbitrary user. [PATCH 2/6] KRB5: Drop privileges in the child, not the back end In future patches, sssd_be will be running as a non-privileged user, who will execute the setuid krb5_child. In this case, the child will start as root and drop the privileges as soon as possible. [PATCH 3/6] KRB5: Move ccache-related functions to krb5_ccache.c Add a new module krb5_ccache.c that contains all ccache-related operations. The only user of this module shall be krb5_child.c as the other modules will run unprivileged and accessing the keytab requires either privileges of root or the ccache owner. This patch only /moves/ code, the changes will come in later patches. [PATCH 4/6] KRB5: Move checking for illegal RE to krb5_utils.c Otherwise we would have to link krb5_child with pcre and transfer the regex, which wold be cumbersome. Check for illegal patterns when expanding the template instead. [PATCH 5/6] KRB5: Move all ccache operations to krb5_child.c The credential cache operations must be now performed by the krb5_child completely, because the sssd_be process might be running as the sssd user who doesn't have access to the ccaches. src/providers/krb5/krb5_ccache.c is still linked against libsss_krb5 until we fix Kerberos ticket renewal as non-root. Also includes a new error code that indicates that the back end should remove the old ccache attribute -- the child can't do that if it's running as the user. [PATCH 6/6] KRB5: Do not switch_creds() if already the specified user The code didn't have to handle this case previously as sssd_be was always running as root and switching to the ccache as the user logging in. Also handle NULL creds on restore_creds() in case there was no switch. One less if-condition and fewer indentation levels. Thank you for the review.

5 31

[PATCH] fill_services(): use talloc_free_children()
by Pavel Březina 18 Nov '14

18 Nov '14

Seen this during review... this will save us from creating new temporary context in each iteration.

3 3

[PATCH] CI: Build sssd on debian with samba support
by Lukas Slebodnik 11 Nov '14

11 Nov '14

ehlo, Missing dependency, libini_config >= 1.1 is in debian testing for some time. Simple patch is attached. LS

4 4

[PATCH] PAM: Remove authtok from PAM stack with OTP
by Lukas Slebodnik 07 Nov '14

07 Nov '14

ehlo, We remove the password from the PAM stack when OTP is used to make sure that other pam modules (pam-gnome-keyring, pam_mount) cannot use it anymore and have to request a password on their own. Resolves: https://fedorahosted.org/sssd/ticket/2287 Simple patch is attached. LS

3 15

[PATCH] Move settig the SELinux context into a privileged child process
by Jakub Hrozek 06 Nov '14

06 Nov '14

Hi, this patchset moves setting the SELinux context from the sssd_be process to a privileges child process in preparation for making the sssd_be process running as the sssd user. The first two patches just reduce code duplication between the child processes we already have, the last one implements setting the context. Please note that the Fedora and RHEL SELinux policy must be tweaked, so currently the patches must be tested with SELinux set to Permissive. Additionally, I wasn't able to run Coverity scan on these patches, because our Coverity server was returning errors again for me. I'll run the tests later, or, if the reviewer would find any issues, I'll be happy to fix them.

3 9

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel October 2014