sssd-devel January 2015

sssd-devel@lists.fedorahosted.org

18 participants
89 discussions

[PATCHES] Sig handlers cleanups
by Simo Sorce 12 Jan '15

12 Jan '15

While checking if our custom signal handlers properly handle errno, I stumbled on a few cleanups, they are attached. turns out our few signal hanlders are errno safe, and tevent signal handling function is also fine. Simo. -- Simo Sorce * Red Hat, Inc * New York

5 17

[PATCH] Fix usage of talloc_steal
by Lukas Slebodnik 12 Jan '15

12 Jan '15

ehlo, talloc_steal is a macro around function _talloc_steal_loc and returns the pointer that you pass it. It does not have any failure modes. If the output value is ignored there are compiler warnings. Example of warning src/util/util.c:503:164: warning: expression result unused [-Wunused-value] ({ __typeof__(internal_ctx) __talloc_steal_ret = (__typeof__(internal_ctx))_talloc_steal_loc((table),(internal_ctx), "../sssd/src/util/util.c" ":" "503"); __talloc_steal_ret; }); ^~~~~~~~~~~~~~~~~~ 1 warning generated. I am opened to better solution of this warning. LS

3 3

[PATCH] responder: new interface for cache request
by Pavel Březina 09 Jan '15

09 Jan '15

Hi, this patch set is based on Jakub's original code. The goal was to reduce code duplication among responders - the part that iterates over domains and performs a cache lookup and data provider communication if object is staled. The first three patches are preparation for unit tests to allow testing with multi domain environment. The forth patch is the new interface. The fifth patch enables views with this interface - I made it a separate commit so the changes can be more easily spotted. And finally the last patch make IFP to use this new interface. Only IFP uses it at the moment so we can find potential bugs without hitting NSS and other responders.

3 15

[PATCH] logrotate: Fix warning file size changed while zipping
by Lukas Slebodnik 09 Jan '15

09 Jan '15

ehlo, glustefs, libvirtd use the same aproach with delaycompress for log files. Simple patch is attached. LS

2 2

[PATCH] spec: sifp requires sssd-dbus
by Pavel Březina 09 Jan '15

09 Jan '15

https://fedorahosted.org/sssd/ticket/2550 Simple patch is attached.

3 2

[PATCH] MAN: Fix a typo
by Jakub Hrozek 08 Jan '15

08 Jan '15

A simple patch is attached.

2 2

[PATCH] GPO: Ignore ENOENT result from sysdb_gpo_get_gpo_result_setting()
by Jakub Hrozek 08 Jan '15

08 Jan '15

Fixes offline GPO processing in case no cached GPO result was stored in sysdb. Includes a unit test.

2 2

Master branch is now tracking development of SSSD 1.13
by Jakub Hrozek 08 Jan '15

08 Jan '15

Hi, I branched off sssd-1-12, which means that a) we can finally push some patches that were delayed because we wanted to avoid breaking 1.12 and b) all patches that should be fixed in 1.12.x need to be pushed to both sssd-1-12 and master. Happy coding!

1 0

Announcing SSSD 1.12.3
by Jakub Hrozek 08 Jan '15

08 Jan '15

=== SSSD 1.12.3 === The SSSD team is proud to announce the release of version 1.12.3 of the System Security Services Daemon. As always, the source is available from https://fedorahosted.org/sssd RPM packages will be made available for Fedora 21 and rawhide shortly. == Feedback == Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users == Highlights == * This is mostly a bug fixing release with only minor enhancements visible to the end user * Contains many fixes and enhancements related to the ID views functionality of FreeIPA servers * SSSD now allows the IPA client to move from one ID view to another after SSSD restart * It is possible to apply ID views to IPA domains as well. Previous SSSD versions only allowed views to be applied to AD trusted domains * Overriding SSH public keys is supported in this release * This release contains several fixes and enhancements related to users and groups from trusted AD domains * When a trusted AD domain is disabled on the server side, access is denied for users logging in from these domains * External group memberships (i.e. memberships in IPA groups) are now resolved correctly for trusted AD users * The localauth plugin configuration is written into the pubconf directory which should be included from krb5.conf on IPA clients. As a result, the localauth plugin should be configured automatically on IPA clients. * Password change when One-Time-Passwords are used was fixed * The tokenGroups support was disabled by default in the LDAP provider. The tokenGroups support is still enabled by default in the AD provider * Simple access provider skips user or group names that can't be resolved if only allow rules are configured == Packaging Changes == * Support for running SSSD as a non-privileged user was added. SSSD's directories must be owned by this user, hence SSSD needs to be configured properly at build time, using the new configure option --with-sssd-user. Additionally, the non-privileged user must also be selected in sssd.conf using the "user" configuration option. == Documentation Changes == * A new configuration option "krb5_confd_path" was added. This option specifies the directory where SSSD places Kerberos configuration snippets. * The default value of "ldap_user_uuid" was changed to be "objectSID" for the AD back end and unset for all other back ends. * The option "ldap_use_tokengroups" changed its default value to True for AD and IPA providers only. * The "allowed_shells" option newly accepts the wildcard ("*") value, allowing any shell == Tickets Fixed == https://fedorahosted.org/sssd/ticket/1195 4 functions with reference leaks within sssd (src/python/pyhbac.c) https://fedorahosted.org/sssd/ticket/1939 Create unit test for be_ptask https://fedorahosted.org/sssd/ticket/2102 disable midpoint refresh for netgroups if ptask refresh is enabled https://fedorahosted.org/sssd/ticket/2219 Shell fallback mechanism in SSSD https://fedorahosted.org/sssd/ticket/2370 sssd should run under unprivileged user https://fedorahosted.org/sssd/ticket/2372 SELinux: Audit changes to the SELinux label files https://fedorahosted.org/sssd/ticket/2404 Remove password from the PAM stack if OTP is used https://fedorahosted.org/sssd/ticket/2430 sssd segfaults repeatedly with error 4 in memberof.so https://fedorahosted.org/sssd/ticket/2439 Return a different errno from client when sssd is not running. https://fedorahosted.org/sssd/ticket/2445 Race condition while invalidating memory cache in client code https://fedorahosted.org/sssd/ticket/2451 sssd-ldap man page changes, add 'access_provider = ldap' as a requirement 'ldap_access_order = for lockout' https://fedorahosted.org/sssd/ticket/2454 [RFE] Views: apply user SSH public key override https://fedorahosted.org/sssd/ticket/2456 Error message not helpful if extdom lookup fails https://fedorahosted.org/sssd/ticket/2460 service lookups returned in lowercase with case_sensitive=preserving https://fedorahosted.org/sssd/ticket/2461 Proxy Provider: Fails to lookup case sensitive users and groups with case_sensitive=preserving https://fedorahosted.org/sssd/ticket/2462 Manpage description of case_sensitive=preserving is incomplete https://fedorahosted.org/sssd/ticket/2464 Use ldap_extra_attrs when requesting attributes from extdom plugin https://fedorahosted.org/sssd/ticket/2467 Set the right permissions in Makefile.am when installing from source https://fedorahosted.org/sssd/ticket/2468 Don't set the umask in the utility function that creates sockets https://fedorahosted.org/sssd/ticket/2470 refactor create_pipe_fd() https://fedorahosted.org/sssd/ticket/2473 RFE: Add a configuration option to specify where a snippet with sssd_krb5_localauth_plugin.so is generated https://fedorahosted.org/sssd/ticket/2475 Wrong results returned with enumeration https://fedorahosted.org/sssd/ticket/2477 SSSD doesn't tell that it can't start because of no longer existent ID range https://fedorahosted.org/sssd/ticket/2481 ID Views implementation does not support IPA user&group overrides https://fedorahosted.org/sssd/ticket/2484 Password change over ssh doesn't work with OTP and FreeIPA https://fedorahosted.org/sssd/ticket/2487 sssd does not work with custom value of option re_expression https://fedorahosted.org/sssd/ticket/2490 dereferencing failure against openldap server https://fedorahosted.org/sssd/ticket/2492 Group membership gets lost in IPA server mode https://fedorahosted.org/sssd/ticket/2498 "debug_timestamps = false" and "debug_microseconds = true" do not work after enabling journald with sssd. https://fedorahosted.org/sssd/ticket/2501 pam_sss domains option: Untrusted users from the same domain are allowed to auth. https://fedorahosted.org/sssd/ticket/2503 Use the MEMORY ccache to pass around keytab contents https://fedorahosted.org/sssd/ticket/2506 Check unlink return values to silence Coverity warnings https://fedorahosted.org/sssd/ticket/2510 The Kerberos provider is not properly views-aware https://fedorahosted.org/sssd/ticket/2512 selinuxusermap rule does not apply to trusted AD users https://fedorahosted.org/sssd/ticket/2514 gid is overridden by uid in default trust view https://fedorahosted.org/sssd/ticket/2516 pam_sss domains option: User auth should fail when domains=<emtpy value> https://fedorahosted.org/sssd/ticket/2518 SSSD master doesn't build on RHEL-6 https://fedorahosted.org/sssd/ticket/2519 SSSD should not fail authentication when only allow rules are used https://fedorahosted.org/sssd/ticket/2520 Crash in function get_object_from_cache https://fedorahosted.org/sssd/ticket/2521 be_ptask unit test fails sometimes https://fedorahosted.org/sssd/ticket/2524 getent fails for posix group with AD users after login https://fedorahosted.org/sssd/ticket/2526 User is unable to authenticate if the option krb5_fast_principal is NULL https://fedorahosted.org/sssd/ticket/2529 IPA: incomplete group memberships for AD users on IPA clients https://fedorahosted.org/sssd/ticket/2530 MAN: Document that only usernames are checked for pam_trusted_uids https://fedorahosted.org/sssd/ticket/2535 Access is not rejected for disabled domain https://fedorahosted.org/sssd/ticket/2537 sssd-libwbclient conflicts with Samba's and causes crash in wbinfo == Detailed Changelog == Carlos A. Munoz (1): * Add zanata.xml file for integration with Zanata command line client Dan Lavu (3): * MAN PAGE: modified sssd-ldap.5.xml for sssd ticket #2451 * MAN: page edit for ldap_use_tokengroups * MAN: Clarify ad_gpo_map* options Denis Kutin (1): * NSS: Possibility to use any shells in 'allowed_shells' Jakub Hrozek (68): * Updating the version for the 1.12.3 development * SSSD: Add the options to specify a UID and GID to run as * SSSD: Chown the log files * UTIL: Use a custom PID_PATH and DB_PATH when unit testing server.c * TESTS: Unit tests can use confdb without using sysdb * TESTS: Unit tests for server_setup * RPM: Package the libsss_semanage.so library * IPA: Handle NULL members in process_members() * UTIL: Add a function to convert id_t from a number or a name * BUILD: Add a config option for sssd user, own private directories as the user * RPM: Change file ownership to sssd.sssd * SSSD: Load a user to run a service as from configuration * SBUS: Chown the sbus socket if needed * SBUS: Allow connections from other UIDs * BE: Own the sbus socket as the SSSD user * NSS: Run as a user specified by monitor * TEST: Unit test for create_pipe_fd * AUTOFS: Run the autofs responder as the SSSD user * PAC: Run the pac responder as the SSSD user * SUDO: Run the sudo responder as the SSSD user * SSH: Run the ssh responder as the SSSD user * GPO: Terminate request on error * TESTS: Add tests for the views-related option maps * IPA: Don't fail the request when BE doesn't find the object * IPA: Rename user_dom into obj_dom * BUILD: Install ldap_child and as setuid if running under non-privileged user * LDAP: Move sss_krb5_verify_keytab_ex to ldap_child * LDAP: read the correct data type from ldap_child's input buffer * LDAP: Drop privileges after kinit in ldap_child * UTIL: Remove code duplication of struct io * UTIL: Remove more code duplication setting up child processes * IPA: Move setting the SELinux context to a child process * BE: Make struct bet_queue_item private to sssd_be * BUILD: Install krb5_child as suid if running under non-privileged user * KRB5: Drop privileges in the child, not the back end * KRB5: Move ccache-related functions to krb5_ccache.c * KRB5: Move checking for illegal RE to krb5_utils.c * KRB5: Move all ccache operations to krb5_child.c * KRB5: Do not switch_creds() if already the specified user * BUILD: Use separate chown to make changing ownership to the sssd user non-fatal * BUILD: Make chown of files to sssd user non-fatal * BUILD: Touch files in DESTDIR * BE: Become a regular user after initialization * BE: Fix a debug message * IPA: Handle IPA groups returned from extop plugin * Hint about removing sysdb if initializing ID map fails * PAM: Make pam_forwarder_parse_data static * SBUS: Initialize DBusError before using it * PAM: Check for trusted domain before sending the request to BE * PAM: Move is_uid_trusted from pam_ctx to preq * TESTS: Basic child tests * Add extra_args to exec_child() * KRB5: Create the fast ccache in a child process * LDAP: Remove useless include * sss_atomic_write_s() return value is signed * KRB5: Relax DEBUG message * TESTS: Build test_child even without cmocka * Rename test-child to dummy-child * CI: Suppress memory errors from poptGetNextOpt * tests: Free popt_context * IFP: Return group names with the right case * KRB5: Check FAST kinit errors using get_tgt_times() * Skip CHAUTHTOK_PRELIM when using OTPs * PAM: Domain names are case-insensitive * PAM: Missing argument to domains= should fail auth * MAN: Misspelled username in pam_trusted_users is not fatal * RESPONDER: Log failures to resolve user names in csv_string_to_uid_array * Updating translations for the 1.12.3 release Lukas Slebodnik (28): * BUILD: Fix automake warning * test_server: Fix waiting for background process * SPEC: Print testsuite log for failed test * SBUS: Fix error handling after closing container * BUILD: Fix linking cwrap tests with -Wl,--as-needed * test_sysdb_views: Use unique directory for cache * IPA: Store right username to selinux child context * PAM: Remove authtok from PAM stack with OTP * NSS: Fix warning enumerated type mixed with another type * Revert "LDAP: Change defaults for ldap_user/group_objectsid" * AD: Change level of debug message * CI: Build sssd on debian with samba support * LDAP: Disable token groups by default * sss_client: Extract destroying of mmap cache to function * sss_client: Fix race condition in memory cache * krb5: Check return value of krb5_principal_get_realm * krb5: Check return value of sss_krb5_princ_realm * AD: Set dp_error if gc was not used * TOOLS: sss_debuglevel should worh with ifp responder * CI: Update valgrind suppresion database for libselinux * IPA: Do not append domain name to fq name * sss_client: Work around glibc bug * MAKE: Fix linking of test_child_common * UTIL: Fix dependencies of internal sss libraries * BUILD: Install libsss_crypt after its dependencies * MONITOR: Disable inlining of function load_configuration * krb5_child: Initialize REALM earlier * IPA: properly handle groups from different domains Michal Zidek (21): * util: Move semanage related functions to src/util * sss_semanage: Add mlsrange parameter to set_seuser * IPA: Use set_seuser instead of writing selinux login file * MONITOR: Allow confdb to be accessed by nonroot user * SYSDB: Allow calling chown on the sysdb file from monitor * responder_common: Create fd for pipe in helper * responders: Do not initialize pipe fd if already present * PAM: Create pipe file descriptors before privileges are dropped * PAM: Run pam responder as nonroot * nss: preserve service name in getsrv call * MONITOR: Fix warning may be used uninitialized * selinux_child: Do not ignore return values. * proxy: Do not try to store same alias twice * PROXY: Preserve service name in proxy provider * MAN: Update case_sensitive=Preserving in man pages. * Man: debug_timestamps and debug_microseconds * test: Wrong parameter type in sss_parse_name_check * util: Special-case PCRE_ERROR_NOMATCH in sss_parse_name * util: sss_get_domain_name regex mismatch not fatal * confdb: Make confdb_set_string accept const char pointer * AD: Never store case_sensitive as "true" to confdb Nikolai Kondrashov (1): * CI: Remove Clang analyzer Pavel Březina (8): * IPA: use ipaUserGroup object class for groups * be_ptask: create a private header file * be_ptask: handle OFFLINE_DISABLE mode before task execution * be_ptask: add next_execution time to struct be_ptask * be_ptask: do not store sync ctx to _task * tests: be_ptask * be_ptask: let backoff affect only period * be_ptask: use gettimeofday() instead of time() Pavel Reichl (20): * TESTS: Add -std=gnu99 to cwrap tests CFLAGS * Fix debug messages - trailing '.' * pyhbac,pysss: fix reference leaks * RESPONDERS: refactor create_pipe_fd() * RESPONDERS: Don't hard-code umask value in utility function * RESPONDERS: Set default value for umask * CONFDB: Detect&fix misconf opt refresh_expired_interval * NSS: disable midpoint refresh for netgroups * SYSDB: sysdb_idmap_get_mappings returns ENOENT * Fix: always check return value of unlink() * BUILD: restrict perms. when installing from source * SYSDB: sysdb_get_bool() return ENOENT & unit tests * simple access provider: non-existing object * simple-access-provider: break matching allowed users * LDAP: retain external members * TESTS: sysdb_delete_by_sid() test return value * NSS: nss_cmd_getbysid_search return ENOENT * SYSDB: sysdb_search_object_by_sid returns ENOENT * CONFDB: Typo in debug message * TESTS: typo in 'assert message' Stephen Gallagher (1): * monitor: Service restart fixes Sumit Bose (48): * ipa: fix issues with older servers not supporting views * ipa: improve error reporting for extdom LDAP exop * ipa_subdomains_handler_master_done: initialize reply_count * nss: group enumeration fix * sdap_print_server: use getpeername() to get server address * IFP: Fix typo in debug message * memberof: check for empty arrays to avoid segfaults * Add add_strings_lists() utility function * IPA: inherit ldap_user_extra_attrs to AD subdomains * Add parse_attr_list_ex() helper function * nss: parse user_attributes option * nss: return user_attributes in origbyname request * sysdb_get_user_attr_with_views: add mandatory override attributes * sysdb_add_overrides_to_object: add new parameter and multi-value support * Views: apply user SSH public key override * Add test for sysdb_add_overrides_to_object() * Add ssh pubkey to origbyname request * Revert "LDAP: Remove unused option ldap_user_uuid" * Revert "LDAP: Remove unused option ldap_group_uuid" * Fix uuid defaults * sysdb: add sysdb_search_object_by_uuid() * ipa: add split_ipa_anchor() * LDAP: add support for lookups by UUID * LDAP: always store UUID if available * ipa: add get_be_acct_req_for_uuid() * IPA: make get_object_from_cache() public * IPA: check overrrides for IPA users as well * Enable views for all domains * Fix KRB5_CONF_PATH * AD/IPA: add krb5_confd_path configuration option * sysdb: add sysdb_delete_view_tree() * sysdb: add sysdb_invalidate_overrides() * views: allow view name change at startup * krb5: make krb5 provider view aware * IPA: only update view data if it really changed * krb5: do not fail if checking the old ccache failed * test: avoid leaks in leak tests * krb5: add copy_ccache_into_memory() * krb5: add copy_keytab_into_memory() * ldap_child: copy keytab into memory to drop privileges earlier * krb5_child: become user earlier * krb5: add wrapper for krb5_kt_have_content() * krb5: handle KRB5KRB_ERR_GENERIC as unspecific error * IPA: verify group memberships of trusted domain users * IPA: do not try to add override gid twice * IPA: handle GID overrides for MPG domains on clients * libwbclient: initialize some return values * Add test for sysdb_store_override

1 0

SSSD 1.12.3 release notes
by Jakub Hrozek 08 Jan '15

08 Jan '15

Hi, I'm working at the 1.12.3 release at the moment. Here are the draft release notes: https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.3 Comments or direct edits are mostly welcome!

1 0

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel January 2015