September 2015 - sssd-devel - Fedora mailing-lists

[PATCHES] PAM: refactor pam_reply
by Pavel Reichl 27 Apr '16

27 Apr '16

Hello, please see attached patch set which contains some refactoring which is in my opinion quite safe. It doesn't touch the recursive call of pam_reply() as I think that changing that would be more risky change. Thanks!

3 6

[PATCH] sudo: use "higher value wins" when ordering rules
by Pavel Březina 16 Feb '16

16 Feb '16

https://fedorahosted.org/sssd/ticket/2682 I think this option should stay undocumented since we want the users to use the correct sorting logic.

3 8

[PATCHES] BUILD: Speed up build of some tests
by Lukas Slebodnik 15 Feb '16

15 Feb '16

ehlo, Attached patches reduce count of compiled ".c" files from 935 -> 815 (almost 9%). This reduction is achieved in deduplication of compiling "*.c" files in tests. BTW the tests were compiled 4 times in our CI script. * make tests * mock build * make distcheck * code coverage The result saving will not be 9% of time due to parallel build but it still worth. (and Makefile.am is simpler) LS

2 3

[PATCHES] [sssd-1.11] Fixes suitable for latest release
by Lukas Slebodnik 10 Feb '16

10 Feb '16

ehlo, We have 19 patches in 1.11 branch on top of latest release (1.11.7) I went through bugs filed against 1.11 branch and filter crashes and the most important bugs. Attached are cherrry-picked patches from 1.12/master So we can release the latest 1.11 version. It will be just a bug-fix release. So some conservative distribution can use it or in another words. we don't want have 1.11 branch neither in unreleased not in unclosed state :-) BTW I test packages with LDAP KRB5 and AD test. Of course there are any regressions because it is a bug fix only release. LS

3 6

[PATCH] intg: Add more LDAP tests
by Nikolai Kondrashov 30 Jan '16

30 Jan '16

Hi everyone, Here is a patch set fixing some things in integration tests and adding more LDAP tests: * Adding/removing a user/group/membership with rfc2307(bis) schema. * Filtering users/groups with rfc2307(bis) schema. * The effect of override_homedir option. * The effect of fallback_homedir option. * The effect of override_shell option. * The effect of shell_fallback option. * The effect of default_shell option. * The effect of vetoed_shells option. These are pretty basic, but I think they're good for the start. Suggestions for more tests are welcome :) NOTE: These still break test_memory_cache.py as seen in the attached log file. We need to figure out why and do something with it. Otherwise, the tests work fine. Nick

6 43

[PATCH] Improve negcache with subdomains
by Jakub Hrozek 14 Jan '16

14 Jan '16

Hi, I noticed this bug while working on the SSH fix with default_domain_suffix. It turns out our filter_users/filter_groups don't work well in this scenario, which might have effect on the server load even. Attached are patches that re-initialize negcache with filter_lists contents after the subdomains are (re)discovered. All patches have tests.

2 5

[PATCH] util-tests: Initialize boolean variable to default value
by Lukas Slebodnik 14 Jan '16

14 Jan '16

ehlo, The boolean variable found_nss could be used uninitialized in test test_known_service if service "nss" would not be found. We would catch it with valgind. Simple patch is attached. LS

3 7

[PATCHES] cleanup task: Expire all memberof targets when removing user
by Michal Židek 14 Dec '15

14 Dec '15

Hi, see the attached patches for ticket https://fedorahosted.org/sssd/ticket/2676 Removing the user during cleanup task completely removes that user from local database, so that user is no longer part of any group in sysdb. Such user may, or may not have been removed from LDAP so the only way to figure out is check on the next refresh otherwise we may get inconsistent results. The third patch adds integration test for this Apply and run the intgcheck without the first 2 patches to see the failed test (you will also see that all the tests after this failed one will end with errors as well, that is probably due to incomplete clean up after the ldap tests and I do not intend to solve this as part of this patchset but will investigate it later). Thanks, Michal -- Senior Principal Intern

4 14

[PATCH] CI: Enforce coverage make check failures
by Nikolai Kondrashov 09 Nov '15

09 Nov '15

Hi everyone, The attached patch enforces make check failures for the CI coverage build, so we can catch more test failures. I think this should also be applied onto sssd-1-12. NOTE: CI won't pass with this patch ATM, as test_ipa_subdom_server needs to be fixed first. Nick

2 4

Review of umask() in SSSD
by Petr Cech 05 Nov '15

05 Nov '15

Hi, I am reviewing umask() in our code according to https://fedorahosted.org/sssd/ticket/2424 There are many use like umask(DFL_RSP_UMASK): src/responder/autofs/autofssrv.c:223 src/responder/ifp/ifpsrv.c:401 src/responder/nss/nsssrv.c:589 src/responder/pac/pacsrv.c:232 src/responder/pam/pamsrv.c:369 src/responder/ssh/sshsrv.c:209 src/responder/sudo/sudosrv.c:215 where DFL_RSP_UMASK is defined as 0177. There are another three use of umask 0177: src/confdb/confdb.c:662 src/util/debug.c:365 src/util/server.c:495 And then I see many use of umask 077: src/p11_child/p11_child_nss.c:485 src/providers/krb5/krb5_child.c:723 src/tests/check_and_open-tests.c:51 src/tests/debug-tests.c:136 src/tests/debug-tests.c:276 src/tests/util-tests.c:596 src/util/domain_info_utils.c:312 src/util/domain_info_utils.c:562 src/tools/tools_util.c:503 I would like to ask you if we would like to use 0077 or 0177 as our very restrictive mask. I see that our code is not consistent on this question. I know the difference is small, but it is. Then we have some unsecure use: src/providers/ipa/selinux_child.c:154: umask = 0 src/providers/krb5/krb5_ccache.c:188: umask = 0000 src/responder/nss/nsssrv_mmap_cache.c:1121: umask = 0022 but I think there is reason for it. And the last one is at src/responder/common/responder_common.c:561: int create_pipe_fd(const char *sock_name, int *_fd, mode_t umaskval) We use it secure (0177) at: src/responder/common/responder_common.c:693 src/responder/pam/pamsrv.c:399 And not so secure: src/responder/common/responder_common.c:670 umask = 0111 src/responder/pam/pamsrv.c:391 umask = 0111 src/tests/cwrap/test_responder_common.c:173 umask = 0111 src/tests/cwrap/test_responder_common.c:179 umask = 0000 So, what could I do? Maybe we could have only one very secure umask and maybe we could have CONSTANT for every use of umask. Any another ideas? Regards Petr

3 17

[PATCH] util: Include disabled domains in link_forest_roots
by Michal Židek 31 Oct '15

31 Oct '15

Hi, patch for ticket https://fedorahosted.org/sssd/ticket/2673 is in the attachment. Thanks. Michal

3 23

[PATCH] DEBUG: Preventing chown_debug_file if journald on
by Petr Cech 27 Oct '15

27 Oct '15

Hi, patch for https://fedorahosted.org/sssd/ticket/2493 is attached. Petr

3 10

[PATCH] SDAP: rem warning - sizelimit exceeded in POSIX check
by Pavel Reichl 22 Oct '15

22 Oct '15

Hello, please see simple patch attached. Thanks!

6 29

Please review: https://fedorahosted.org/sssd/wiki/SecuritySensitiveOptions
by Jakub Hrozek 14 Oct '15

14 Oct '15

Hi, to help the OpenSCAP integration, I prepared a wiki page that contains options which have a security impact -- either positive (drop root) or negative (ignore certificate validation issues). I also tried to explain the effect of the options along with the description. There are some more items that can be included, but I wasn't sure about them myself, like: * should obfuscated passwords be mentioned? I wasn't sure because on one hand it really doesn't provide any benefit, on the other hand, the option can be used to check a compliance box that requires no passwords be stored in files.. * should the page warn against the auth-option-that-shall-not-be-mentioned or politely deny its existence? :-) * What about fd_limit ? Should resource consumption be considered a security property, especially if we already honor system default? I think here the default is enough, so I didn't document that option. Please provide your comments or edit the wiki directly. Thanks!

3 7

[PATCH] cache_req: support UPN
by Pavel Březina 12 Oct '15

12 Oct '15

0001: Use extra flag also in OOB request. 0002: Provide support for UPN. This add an improvement from NSS code, but I'm not sure if it is desired or not. If you have [domain/AD.PB] in sssd.conf and UPN "upn(a)ad.pb" then NSS responder will not find this user, cache_req will. Is this nss behavior intentional or a bug? 0003: I got really sick of the way new test are written in cache_req when writing new tests so I kinda rewrote it.

4 20

[PATCH] LDAP: Inform about small range size
by Lukas Slebodnik 09 Oct '15

09 Oct '15

ehlo, I was reprodicing other bug and it took me some time to find out why I was not able to resolve user. RID was bigger than range size. I saw just general message about id mapping failer [sdap_save_user] (0x0400): Processing user matthewbe [sdap_save_user] (0x1000): Mapping user [matthewbe] objectSID [S-1-5-21-2997650941-1802118864-3094776726-200065] to unix ID [sdap_idmap_sid_to_unix] (0x0080): Could not convert objectSID [S-1-5-21-2997650941-1802118864-3094776726-200065] to a UNIX ID ^^^^^^ Default range size is 200000 [sdap_save_user] (0x0020): Failed to save user [matthewbe] [sdap_save_users] (0x0040): Failed to store user 0. Ignoring. Feel free to propose better debug message. I think it would simplify debugging. LS

4 9

[PATCH] SUDO: Support the IPA schema
by Michal Šrubař 09 Oct '15

09 Oct '15

Hi guys, I spent some time working at this ticket https://fedorahosted.org/sssd/ticket/1108 and I think it's finally ready to be reviewed by others. Description of the problem and scope of the changes can be found in the commit message. I also wrote some unit tests but the patch is a quite long already so I think it would be better to send the tests as an another patch. Or should I create a patch for each modified file?

4 7

More upstream CI tests
by Jakub Hrozek 08 Oct '15

08 Oct '15

Hi, as we're stabilizing the 1.13 branch and before we plan what we want to work on during the 1.14 development, we should use that time to write some more tests! Here are some areas where we could add tests. Please discuss or add your ideas, I would like to turn this list into tickets we can start implementing: * Extend the LDAP provider tests with more dynamic test cases. - add a user to a group, run sss_cache, assert id user displays the new group and getent group displays the new member - conversely with removing users from groups * Background refresh - could be built atop the LDAP NSS tests as well. I think we have all the infrastructure in place. * Local overrides integration test: - this could be relatively easy, just call the overrides tool and request the entry. Could be built atop the existing LDAP tests or even use the local provider. * Add a KDC - until we have a pam_wrapper, this would only be useful to test ldap_child, but adding the KDC instantiation might be worth it nonetheless - there is a protorype of KDC instantiation on the list for some time now, since we enabled rootless SSSD * IFP - could we reuse the existing sbus tests to spawn a custom bus? * SUDO - can we trick sudo into connecting to our test sssd instance? I think the order of priority is roughly as above. I think the LDAP provider is critical enough to be well tested. The refresh and local override tests might be nice to have because we would be refactoring the NSS responder in 1.14, so we should have it tested. I'll be happy to hear other opionions, though!

4 19

[PATCH] man: Minor fixes to filter_groups description
by Nikolai Kondrashov 07 Oct '15

07 Oct '15

Hi everyone, I noticed one little thing was wrong with the combined filter_users/filter_groups description on the sssd.conf(5) manpage and also wanted to add a note WRT nested groups behavior with filter_groups which was a bit surprising to me. The trivial patches are attached. Nick

2 2

[PATCH] GPO: fix memory leak
by Pavel Reichl 07 Oct '15

07 Oct '15

Hello, please see simple patch attached. Thanks!

4 4

[WIKI] Contribute and DevelTips are duplicate
by Petr Cech 06 Oct '15

06 Oct '15

Hi, I've read the wiki according to # https://fedorahosted.org/sssd/ticket/2706 and I think that it could be helpful clean the page # https://fedorahosted.org/sssd/wiki/DevelTutorials from "git topic" and create new page for everything related to git. The motivation is, that: * Contribute briefly describe whole process on basic level, * DevelTips looks like How To, * DevelTutorials are more about technologies, libraries, build process..., * So there could be one page for everything about git. -------------------------------------------------------------------------------- NOTES how we could edit wiki: -------------------------------------------------------------------------------- https://fedorahosted.org/sssd/wiki/Contribute Contribute Contribution Policy Source Code Repository /* * There could be only a link to the repo and * reference to "New Git page". */ Tips and tricks for developers QA, Development and Bug Triage Development Repositories Localization and Internationalization Design Pages Credits Latest Documentation and Presentations https://fedorahosted.org/sssd/wiki/DevelTips SSSD Devel page Are there any introductory tutorials available? /* + Reference to the new "Git page" */ When I debug an SSSD process in a debugger, it always gets killed with … Using valgrind to identify memory access problems Using strace to track the SSSD processes How do I track work-in-progress of other developers? /* * Is it * still valid? * * I tried link * for jhrozek and * his sssd.git * and the url * doesn't exist. */ Why does make check take so long? Using clang to perform static analysis of source code When I compile the SSSD from source there is an error that says … https://fedorahosted.org/sssd/wiki/DevelTutorials /* * Label @new-git-page means * that I would like move given paragraph to the "New git page" */ Talloc Tevent and tevent_req Coding Style Code Contributions /* @new-git-page */ Getting the source /* @new-git-page */ Building SSSD for development and debugging Unit tests Submitting a patch upstream /* @new-git-page */ Patch metadata /* @new-git-page */ Translation Contributions Devel Tips "New Git page" /* Maybe Git Tips? */ + paragraph about git setup from Contribute->Source Code Repository + some paragraphs of DevelTutorials->Code Contributions -------------------------------------------------------------------------------- I am looking forward your opinions. Petr

3 10

[PATCHES] DYDNDS: update quality of input for nsupdate
by Pavel Reichl 06 Oct '15

06 Oct '15

Hello, please see attached patch set. Thanks!

5 35

[PATCH] SDAP: Relax POSIX check
by Pavel Reichl 05 Oct '15

05 Oct '15

Hello, please see attached patch. Thanks!

4 19

[PATCH] Fix memory leak in sssdpac_verify()
by Sumit Bose 05 Oct '15

05 Oct '15

Hi, the attached patch was provided by the reporter of https://fedorahosted.org/sssd/ticket/2803 . I'm sending it here for completeness. I verified with valgrind that it fixes the memory leak and CI passes http://sssd-ci.duckdns.org/logs/job/27/57/summary.html, so I gave ACK and pushed it to master: b4c44ebb8997d3debb33607c123ccfd9926e0cba Since this is a memory leak we might want to add it to other branches as well. bye, Sumit

2 2

[PATCH] UTIL: Alternative way for debug message initialisation
by Lukas Slebodnik 05 Oct '15

05 Oct '15

ehlo, attached patch shoul avoid situation as in commit 7c69221077c780e62f6c536e78675f2dc1c131bc The comments does not guarantee anything. Author: Michal Zidek <mzidek(a)redhat.com> Date: Tue Mar 10 17:30:48 2015 +0100 DEBUG: Add missing strings for error messages We had more error codes than corresponding messages. Also order of two messages was wrong. Unfortunatelly, the index of enum do not start from 0 and need to be converted using SSSD_ERR_IDX. I used shorter version of macro "idx". Feel free to propose nicer name. LS

4 13

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2015