sssd-devel September 2014

sssd-devel@lists.fedorahosted.org

23 participants
95 discussions

[PATCHES] libwbclient: user _sssd suffix to avoid collision with Samba version
by Sumit Bose 08 Sep '14

08 Sep '14

Hi, currently if libwbclient is enabled (and it is enabled be default) 'make install' might overwrite the already installed Samba version of the library. To make this more robust but keep the library enabled by default I would suggest to add a _sssd suffix to all installed files to avoid collisions. If an admin want to use the SSSD version instead of the Samba version the libraries must be replaced manually. Distributions can you their scheme to handle different implementations of the same binary during building the packages, e.g. for Fedora and RHEL this would be /sbin/alternatives. All renaming is done in the second patch. The first patch just fixes an issue during make test when disabling libwbclient and should be applied even if the second is NACKed. bye, Sumit

3 10

[PATCH] sss_sifp: set output parameters if attribute is NULL
by Pavel Březina 08 Sep '14

08 Sep '14

First patch is a minor bug in unit test I found when I was writing new tests. The rest is described in commit message.

3 9

[PATCH] LDAP: Skip dereferenced entries that we are not permitted to read
by Jakub Hrozek 08 Sep '14

08 Sep '14

Hi, the attached patch fixes https://fedorahosted.org/sssd/ticket/2421 To reproduce, it's enough to run "id admin" with an IPA 4.x server.

2 5

[PATCH] IFP: Suppress 'git diff' noise
by Michal Židek 08 Sep '14

08 Sep '14

Hi, this is not very important patch, but suppresses behaviour that is bothering some of us for quite some time. See patch description for details. Michal

3 6

[PATCHES]: incorrect expansion of group membership when encountering a non-POSIX group
by Pavel Reichl 08 Sep '14

08 Sep '14

Hello, I have prepared patches for https://fedorahosted.org/sssd/ticket/2343 Patches actually do not work due to same bug which is causing https://fedorahosted.org/sssd/ticket/2407. So my patches are effectively blocked by #2407, for testing purposes following command may be used (which reverts patches introducing the bug): git revert 983983dd1629ab33eab340a40d9ee83965a339c6 ed346bcc84b8a326996e5550771773d8e63f17c2 Thanks, Pavel Reichl

3 5

[PATCH] AD: add config and processing support gpo_map_* options
by Yassir Elley 08 Sep '14

08 Sep '14

Hi, The attached patches add configuring support (patch 1) and processing support (patch 2) for the gpo_map_* set of options. These options are used to map Linux PAM service names to GPO Logon Rights, which in turn map to specific key/value pairs (one for allow, one for deny) in the GptTmpl.inf file. I'm including my write-up (below) from the Design Page (https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration) Thanks, Yassir. << GPO policy settings can be used to centrally configure several sets of Windows Logon Rights, with each set classified by its logon method (e.g. interactive, remote interactive) and consisting of a whitelist [and blacklist] of users and groups that are allowed [or denied] access to the computer using the set's logon method. In order to integrate Windows Logon Rights into a Linux environment, we allow pam service names to be mapped to a specific Logon Right. We provide default mappings for all of the commonly used pam service names, but we also allow the admin to add/remove mappings as needed (to support custom pam service names, for example). The latter is done by using a new set of config options of the form "gpo_map_<logon_right>" (i.e. gpo_map_interactive, gpo_map_network, etc), each of which consists of a comma-separated list of entries beginning either with a '+' (for adding to default set) or a '-' (for removing from default set). For example, since the RemoteInteractive logon right maps to a single pam service name ("sshd") by default, an admin could map their own pam service name ("my_pam_service") and remove the "sshd" mapping with the following sssd.conf line: "gpo_map_remote_interactive = +my_pam_service, -sshd" For this project, the following options can be used to configure the corresponding Logon Right (default values are also given): * ad_gpo_map_interactive (default: login, su, su-l, gdm-fingerprint, gdm-password, gdm-smartcard, kdm) * ad_gpo_map_remote_interactive (default: sshd) * ad_gpo_map_network (default: ftp, samba) * ad_gpo_map_batch (default: crond) * ad_gpo_map_service (default: <not set>) * ad_gpo_map_permit (default: sudo, sudo-i) * ad_gpo_map_deny (default: <not set>) * ad_gpo_default_right (default: deny) The first five options are used to associate specific pam service names with each logon right. The ad_gpo_map_permit [and ad_gpo_map_deny] is used to specify pam service names for which GPO-based access is always [or never] granted. Unlike the other options, the ad_gpo_map_default_right does not specify pam service names. Rather, it allows the admin to specify a default logon right (or the special permit/deny values)for pam service names that are not explicitly mapped to any of the logon rights. Note that, in many cases, we do not expect the admin will need to specify any of these config options, b/c the defaults have been chosen carefully to cover the most commonly used pam service names (with deny as the default for unmapped service names). The semantics of each whitelist and blacklist are as follows: * whitelist ("allow"): When this policy setting is not defined, any user can logon to the computer. When it is defined, only the users and groups specified in the whitelist are allowed to logon to the computer. In other words, by defining this setting, the semantics go from "everyone allowed access to this computer" to "no one allowed access to this computer, except principals on the whitelist". * blacklist ("deny"): When this policy setting is not defined, it has no effect. When it is defined, the users and groups specified in the blacklist are blocked from performing logons. For a particular Logon Right (e.g. Interactive), if a user/group is specified in both the whitelist and the blacklist, then the blacklist takes precedence. In summary, if a user is trying to login to a computer (e.g. pam_service_name = "login"), we first find which Logon Right the "login" service maps to (i.e. Interactive, by default), and then process only the corresponding policy settings found in GptTmpl.inf (which contains policy settings for the "Security Settings" extension, of which Logon Rights are a part). In the case of Interactive Logon Right, those policy settings are named SeInteractiveLogonRight and SeDenyInteractiveLogonRight in the GptTmpl.inf file. >>

4 11

Re: [SSSD] [PATCH] Add systemd-user-sessions dependency to systemd service file.
by Jakub Hrozek 08 Sep '14

08 Sep '14

On Thu, Aug 21, 2014 at 03:02:54PM +0100, Ian Lee wrote: > Hi, > > Yea, that's a nice target to use, I'd not noticed it before. Does this > now make systemd-user-sessions.service a redundant dependency? > > The patch attached includes both, you can modify as you see fit. > > Cheers > Ian Thank you again for your contribution. One person hit by the bug had verified that the patch fixes the shutdown problem. Pushed to master: ea0a71921ea396f5cc0e9e20d9a2aafc681b3eb9 and sssd-1-11: ddbcd081cfda4e41f7d51721f4f0d4f04a74f4cd

1 0

[PATCH] pysss: test return value of realloc.
by Lukas Slebodnik 05 Sep '14

05 Sep '14

ehlo, warning reported by coverity patch is attached LS

3 10

[PATCH] NSS: Use right domain for group members with fq names
by Lukas Slebodnik 05 Sep '14

05 Sep '14

ehlo, attached patch fixes regression introduced by commit: commit c86904baad32fbf9e66bf1cdc667aa5e683b48ba NSS: Don't use printf(3) on user provided strings. Fortunatelly, it was not backported into 1-11 branch. sh$ git tag --contains c86904baad32fbf9e66bf1cdc667aa5e683b48ba sssd-1_11_90 sssd-1_11_91 sssd-1_12_0 sssd-1_12_0_beta1 sssd-1_12_0_beta2 How to reproduce: a) you need to have 2 AD domains with trust. b) group from subdomain should contain mixed members (from all 2 domains) c) have emty sssd cache. d) getent group subdomain_group_fqname In my case: * without this patch: sh# getent group group2_dom2(a)sssdad_tree.com group2_dom2@sssdad_tree.com:*:525402171:user2_dom3@child1.sssdad.com,user1_dom2@sssdad_tree.com * with this patch: sh# getent group group2_dom2(a)sssdad_tree.com group2_dom2@sssdad_tree.com:*:525402171:user2_dom1@sssdad.com,user2_dom3@child1.sssdad.com,user1_dom2@sssdad_tree.com You can also test with unit test. a) apply attached patch b) revert changes in file src/responder/nss/nsssrv_cmd.c sh$ git checkout HEAD~ src/responder/nss/nsssrv_cmd.c c) run test -- nss-srv-tests will fail and will contain error [ RUN ] test_nss_getgrnam_mix_subdom 0x2 != 0x3 ../sssd/src/tests/cmocka/test_nss_srv.c:1429: error: Failure! [ FAILED ] test_nss_getgrnam_mix_subdom LS

3 4

[PATCH] refcount-tests: Do not force to run test in CK_FORK mode
by Lukas Slebodnik 05 Sep '14

05 Sep '14

ehlo, patch is attached. LS

3 2

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2014