sssd-devel April 2014

sssd-devel@lists.fedorahosted.org

22 participants
87 discussions

[PATCHES] Enable sending DEBUG logs to journald
by Stephen Gallagher 09 Jul '14

09 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All of these patches require Nikolai's "DEBUG Macro Refactoring v3" patches to be applied first. Patch 0001: Allow debug_fn to process __FILE__ and __LINE__ In preparation for enabling journald support for the DEBUG logs, we will need to be able to pass in certain additional arguments that will be required, specifically the code file and line number. We will be able to optionally enable this in the file-based logs as well if we so choose, but for right now we will avoid breaking the log format on disk. Patch 0002: Enable sending structured debug logs to journald We are now able to send structured debug logs to journald, tagged with the code file, line number and domain that the log pertains to. To enable this functionality, SSSD must be configured at build-time with - --with-syslog=journald and must be launched without -f/--debug-to-files This behavior is nearly identical to how SSSD will function today on a systemd-based system if --debug-to-files is disabled, since it will redirect stdout and stderr into journald. This patch merely enhances the situation to send structured logs instead of simple string messages. Patch 0003: BUILD: Build with journald support by default on Fedora The journal provided by systemd gives us structured logging capabilities that we should be taking advantage of. Note: this patch explicitly does not change the systemd unit file for SSSD. Right now, an administrator will need to manually remove the '-f' from ExecStart in the unit file to send debug logs to journald. I suspect we'll want to discuss this before we make it the default. This patch DOES change the default for sss_log messages to use sd_journal_send() instead of straight log() for those messages that we traditionally sent to the syslog (such as login events). This is code that has been in place for some time now, but has not been the default because we hadn't build with --with-syslog=journald. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlK0v0QACgkQeiVVYja6o6NwxgCfWnU4IbYyJPXxPe83zWjjsCHt cG8AnitRgM9CAUjHM2ofYg3TgcUxCyCC =Fara -----END PGP SIGNATURE-----

7 34

[PATCH] LDAP: Try all attributes when saving an entry
by Jakub Hrozek 08 Jul '14

08 Jul '14

Hi, this bug was reported on #sssd by a user. He was running some flavor of IBM Tivoli where the entries only had an "ID", not separate "UID" and "GID". But due to a bug in sssd he couldn't use the same value for both, this configuration: ldap_user_uid_number = idAttribute ldap_user_gid_number = idAttribute only saved the ID into UID and left GID empty. It appears we have a long standing bug in sdap_parse where we only consider first match. If this patch is accepted, I would also like to refactor sdap_parse in master because currently it is a 250-lines long function with multiple branches..

2 6

[PATCH] Suppress safealign warnings with DISCARD_ALIGN.
by Michal Židek 01 Jul '14

01 Jul '14

This is the last patch related to ticket https://fedorahosted.org/sssd/ticket/1359 The warnings here are currently all false positives (refcount) or the alignment is calculated during runtime with PADDING_SIZE macro so this patch is just about silencing the compiler. The patch is attached. Michal

3 7

[PATCH v2 0/5] NFSv4 rpc.idmapd plugin
by Noam Meltzer 20 Jun '14

20 Jun '14

Hello sssd-devel & linux-nfs, This is v2 of the patch set. It is now sent to linux-nfs as weel, following Steve Dickson request. The code in the next 5 patches implements the design document: https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin The changes in the code (compared to v1) are following the review done in sssd-devel. I believe that there are still two items in dispute (no final verdict was given in the sssd mailing list) but this new patch set will give a chance to have a cleaner look on things. -- Noam Meltzer Linux Software Engineer PRIMARY DATA P.O. Box 12650, Herzliya Pituach 4673300 9 Hamenofim St. Akerstein Towers, Tower A, 5th fl. Herzliya Office: +972-77-8981888 | Fax: +972-3-7617140 | Mobile: +972-54-5873843 Email: noam(a)primarydata.com -- Noam Meltzer (5): NEW CLIENT: plugin for NFSv4 rpc.idmapd NFSv4 client: (private) headers from libnfsidmap NFSv4 client: add to build system NFSv4 client: man page NFSv4 client: add to RPM spec Makefile.am | 19 ++ configure.ac | 10 + contrib/sssd.spec.in | 8 + src/conf_macros.m4 | 30 ++ src/external/libnfsidmap.m4 | 17 + src/man/Makefile.am | 4 +- src/man/include/seealso.xml | 4 + src/man/sss_rpcidmapd.5.xml | 97 ++++++ src/sss_client/common.c | 5 + src/sss_client/nfs/nfsidmap_internal.h | 78 +++++ src/sss_client/nfs/sss_nfs_client.c | 569 +++++++++++++++++++++++++++++++++ src/sss_client/sss_cli.h | 2 + 12 files changed, 842 insertions(+), 1 deletion(-) create mode 100644 src/external/libnfsidmap.m4 create mode 100644 src/man/sss_rpcidmapd.5.xml create mode 100644 src/sss_client/nfs/nfsidmap_internal.h create mode 100644 src/sss_client/nfs/sss_nfs_client.c -- 1.8.5.3

6 25

[sssd][patches] NSS: netgroups minor fixes
by Pavel Reichl 19 Jun '14

19 Jun '14

Hello, while working on https://fedorahosted.org/sssd/ticket/2102 I noticed a few minor problems regarding netgroups. 1st patch: First check returned value then it is safe to access results. 2nd patch: It is my opinion that function lookup_netgr_step is too long and can be safely (with minimum of changes) divided into 2 separate functions. 3rd patch: Pavel Brezina asked me to solve memory leak in lookup_netgr_step. 4th patch: Fixes two code style issues. Thank for review! Pavel Reichl

3 11

[PATCH] KRB: Prevent dereference of a null pointer
by Lukas Slebodnik 03 Jun '14

03 Jun '14

ehlo, Variable 'cc' needn't be initialised if function sss_open_ccache_as_user fails. Patch is attached. LS

3 3

[PATCH] pam_sss: add ignore_unknown_user option
by Pete Fritchman 03 Jun '14

03 Jun '14

https://fedorahosted.org/sssd/ticket/2232 FreeBSD's openpam doesn't have a built in way of ignoring an unknown user (e.g. treating PAM_USER_UNKNOWN as a pass for a required module, like Linux's user_unknown=ignore tag), so there needs to be an ignore_unknown_user flag built in to the PAM module. This patch makes pam_sss return PAM_IGNORE instead of PAM_USER_UNKNOWN when ignore_unknown_user is passed in from the PAM config. FWIW, this is how pam_ldap works on FreeBSD with local accounts, too. This patch allows us to keep pam_sss marked as required for the PAM "account" facility (to enforce HBAC rules) but still allow local users to log in. jhrozek suggested posting the patch here for review, so thanks in advance for looking it over! -- petef

6 14

[PATCH] IFP: Add GetUserAttrs call
by Jakub Hrozek 03 Jun '14

03 Jun '14

Hi, the attached patches upstream functionality that mod_lookup_identity has been using for a while, but which we couldn't push to master due to the pending sbus changes. Now that these are accepted, it's time to merge the DBus methods themselves. Previously, mod_lookup_identity relied on a private branch with quite a bit of ad-hoc code. Please note that when the work in progress to expose users, groups and domains is merged as well, this interface will become obsolete in favor of the objects. But we shouldn't let a released version of mod_lookup_identity rely on unreleased sssd code any longer. Moreover, all patches except the last one will be used even later on and there's no fixed timeline on converting mod_lookup_identity. [PATCH 1/6] SBUS: two trivial style fixes SSIA [PATCH 2/6] SBUS: Add a convenience function Adds a convenience function that constructs a DBusError internally and as such can be used to mark an sbus request as failed without having to create a DBusError instance by the caller. The error message must be either allocated on top of dbus_req or a constant, DBus itself doesn't copy the error message! This is reflected in the doxygen docstring. [PATCH 3/6] IFP: Add utility functions Adds a number of utility functions, most importanly ifp_req_create(). The ifp_req is a structure that will be passed along with the ifp request and contains the sbus request and some ifp-specific data, like caller ID or the responder context. [PATCH 4/6] IFP: use a list of allowed_uids for authentication Similar to the PAC responder, the InfoPipe uses a list of UIDs that are allowed to communicate with the IFP responder. [PATCH 5/6] IFP: Initialize negative cache timeout In order to avoid hitting the back end with repetitive requests, the InfoPipe responder needs a negative cache, too. This patch follows the convention set by other responders, where the negative cache timeouts are read from the [nss] section. This is not ideal, however, and ticket #2318 tracks moving the configuration to the [ifp] section primarily. The timeout is also a separate parameter in the NSS context. We should consider moving it to the negcache context instead (#2317). [PATCH 6/6] IFP: Add GetUserAttrs call Adds a DBus method that allows the caller to retrieve attributes of a user. The synopsis of the call is as follows: <method name="GetUserAttr"> <arg type="s" name="user" direction="in"/> <arg type="as" name="attr" direction="in"/> <arg type="a{sv}" name="values" direction="out"/> </method> The return value is an array (one attribute per array member) of dictionaries. The key of the dictionary is the attribute name, the value is a variant containing the attribute values as strings. If an attribute does not exist or is not permitted to be read, no error is returned. If the users does not exist, the method returns an error. In future patches this function will be marked as obsolete in favor of object-oriented approach. ifp_user_get_attr_unpack_msg is a separate function to allow extending it in a later patch. The function to check the cache validity duplicates quite a bit of code with the NSS responder. The refactoring would be nice to get done along with #843. I have a patch in my private branch, but it's not complete, sorry.

6 15

[PATCH] SPEC: Remove duplicate sssd_ifp.
by Lukas Slebodnik 03 Jun '14

03 Jun '14

ehlo I wanted to test dbus with sss(ifp responder). but I had a problem with starting sssd. It was small problem with upstream packaging. [sssd] [monitor_service_init] (0x0400): Initializing D-BUS Service [sssd] [mt_svc_exit_handler] (0x0040): Child [ifp] exited with code [3] [sssd] [mt_svc_exit_handler] (0x0010): Process [ifp], definitely stopped! [sssd[ifp]] [sysbus_init] (0x0040): DBus error message: Connection ":1.522" is not allowed to own the service "org.freedesktop.sssd.infopipe" due to security policies in the configuration file [sssd[ifp]] [ifp_process_init] (0x0020): Failed to connect to the system message bus [sssd[ifp]] [sss_responder_ctx_destructor] (0x0400): Responder is being shut down The file sssd_ifp was installed by two subpackages: sssd-common and sssd-dbus I din't have instaled file org.freedesktop.sssd.infopipe.conf, because it is in package sssd-dbus. Missing conf file caused problem with starting the ifp service. Simple patch is attached. LS

2 3

[PATCH] DBus: Automatic pack/unpack of method handler arguments
by Stef Walter 03 Jun '14

03 Jun '14

Here's the next set of DBus patches. This implements automatic packing and unpacking of arguments for method handlers. This means adding a handler to a vtable is now type safe and checked by the compiler. Type safe reply xxx_finish() are also generated. Together these avoid the complexity and the pitfalls of building and parsing DBus messages via varargs (such as dbus_bool_t != bool). Handlers have their pack/unpack method handlers automatically generated unless they have this annotation in their DBus XML definition: <annotation name="org.freedesktop.sssd.RawHandler" value="true"/> Only simple argument types, and arrays of them are supported. More complex arguments can continue to be handled via the "RawHandler" annotation. sbus_codegen will force you to add this annotation for methods that have complex arguments. In later work we could add commit for more complex, but common arguments such as dictionaries. Because so many of the internal sssd DBus methods do strange things with their arguments, I haven't migrated them to automatic packing and unpacking of arguments. They are all now marked with the above "RawHandler" annotation. At some point someone could pick through these and see which ones are candidates for moving away from "RawHandler". You can find this as a branch here: https://github.com/stefwalter/sssd/commits/dbus-invoke Cheers, Stef

4 9

← Newer
1
2
3
4
5
6
7
8
9
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel April 2014