sssd-devel July 2016

sssd-devel@lists.fedorahosted.org

18 participants
103 discussions

[PATCH] LDAP: Lookup services by all protocols unless a protocol is specified
by Jakub Hrozek 05 Jul '16

05 Jul '16

Hi, the attached patch makes service lookups great again. To reproduce, just run: getent service -s sss ldap before the patch we would look up ipService="" because DP gives us an empty string after the recent DP patches.

1 0

[PATCH] sssctl: start sssd in remove-cache command
by Pavel Březina 05 Jul '16

05 Jul '16

2 1

[PATCH] MAN: Config file merging
by Michal Židek 04 Jul '16

04 Jul '16

Hi! This patch adds man page for config file merging. Michal

3 5

[PATCH] IPA: Fix uninitialized pointer read (UNINIT)
by Lukas Slebodnik 04 Jul '16

04 Jul '16

ehlo, attached patch fixes coverity issue. src/providers/ipa/ipa_auth.c: 311static void ipa_pam_auth_handler_connect_done(struct tevent_req *subreq) 312{ 313 struct ipa_pam_auth_handler_state *state; 314 struct tevent_req *req; 1. var_decl: Declaring variable sh without initializer. 315 struct sdap_handle *sh; 316 const char *attrs[] = {SYSDB_ORIG_DN, NULL}; 317 struct ldb_message *msg; 318 const char *dn; 319 int timeout; 320 errno_t ret; 321 322 req = tevent_req_callback_data(subreq, struct tevent_req); 323 state = tevent_req_data(req, struct ipa_pam_auth_handler_state); 324 325 state->pd->pam_status = PAM_SYSTEM_ERR; 326 CID 13699 (#1 of 1): Uninitialized pointer read (UNINIT)2. uninit_use_in_call: Using uninitialized value sh when calling sdap_cli_connect_recv. [show details] 327 ret = sdap_cli_connect_recv(subreq, state, NULL, &sh, NULL); src/providers/ldap/sdap_async_connection.c: 2026int sdap_cli_connect_recv(struct tevent_req *req, 2027 TALLOC_CTX *memctx, 2028 bool *can_retry, 2029 struct sdap_handle **gsh, 2030 struct sdap_server_opts **srv_opts) 2031{ 2032 struct sdap_cli_connect_state *state = tevent_req_data(req, 2033 struct sdap_cli_connect_state); 2034 enum tevent_req_state tstate; 2035 uint64_t err_uint64; 2036 int err; 2037 1. Condition can_retry, taking true branch 2038 if (can_retry) { 2039 *can_retry = true; 2040 } 2. Condition tevent_req_is_error(req, &tstate, &err_uint64), taking false branch 2041 if (tevent_req_is_error(req, &tstate, &err_uint64)) { 2042 /* mark the server as bad if connection failed */ 2043 if (state->srv) { 2044 DEBUG(SSSDBG_OP_FAILURE, "Unable to establish connection " 2045 "[%"PRIu64"]: %s\n", err_uint64, sss_strerror(err_uint64)); 2046 2047 be_fo_set_port_status(state->be, state->service->name, 2048 state->srv, PORT_NOT_WORKING); 2049 } else { 2050 if (can_retry) { 2051 *can_retry = false; 2052 } 2053 } 2054 2055 if (tstate == TEVENT_REQ_USER_ERROR) { 2056 err = (int)err_uint64; 2057 if (err == EOK) { 2058 return EINVAL; 2059 } 2060 return err; 2061 } 2062 return EIO; 3. Condition state->srv, taking true branch 2063 } else if (state->srv) { 4. Condition debug_level & __debug_macro_level, taking true branch 2064 DEBUG(SSSDBG_TRACE_FUNC, "Connection established.\n"); 2065 2066 be_fo_set_port_status(state->be, state->service->name, 2067 state->srv, PORT_WORKING); 2068 } 2069 5. Condition gsh, taking true branch 2070 if (gsh) { 6. read_parm: Reading a parameter value. 2071 if (*gsh) { 2072 talloc_zfree(*gsh); 2073 } 2074 *gsh = talloc_steal(memctx, state->sh); 2075 if (!*gsh) { 2076 return ENOMEM; 2077 } LS

2 2

[PATCH] MAN: Update documentation of sss_cache
by Lukas Slebodnik 04 Jul '16

04 Jul '16

ehlo, sss_cache -E can invalidate sudo rules since sssd 1.14 alpha. We just forgot to update man page for option --everything LS

2 2

[PATCH] sssctl: manual page
by Pavel Březina 04 Jul '16

04 Jul '16

I don't think it is necessary to duplicate information from the tool itself into a manual page so a tried to keep the man page simple. This way we will not have to maintain it with any change in sssctl. If you think it is better to include all commands and options in the man page as well, I can do it...

3 3

[PATCH] SSH: Do not print an error message if sss_ssh_authorizedkeys is asked for a local user
by Jakub Hrozek 01 Jul '16

01 Jul '16

Hi, please see the attached patch. I didn't find any information in the ssh man pages about the expected error codes from the AuthorizedKeysCommand, but I think we should at least suppress the error messages.. I tested with: $ sss_ssh_authorizedkeys root $ sss_ssh_authorizedkeys user-from-passwd $ sss_ssh_authorizedkeys user-from-ipa $ sss_ssh_authorizedkeys non-existing-user The first three should be silent, the last one still prints an error message. I think that's acceptable, because I would expect ssh to call getpwnam() on its own before calling the AuthorizedKeysCommand.

3 3

[PATCH] Fix warning sign-compare
by Lukas Slebodnik 01 Jul '16

01 Jul '16

ehlo, python3.5 CFLAGS contains warning Wsign-compare and file confdb_setup.c was added to SSSD_TOOLS_OBJ which is required for python3-sss (pysss.so) python3.5 is on debian >= testing and fedora 24+ LS

2 2

[PATCH] config: Fix filename matching regex
by Michal Židek 01 Jul '16

01 Jul '16

I found this while testing the sssctl config-check command. Michal

2 8

[PATCH] IPA: Handle requests for netgroups from trusted domains gracefully
by Jakub Hrozek 01 Jul '16

01 Jul '16

To reproduce, just run: getent netgroup some_name(a)trusted.domain Please see the commit message for explanation. The other solution would be the other way around, ie always go to the code that handles lookups for trusted domains and shortcut if the lookup is for anything else than a user or a group.

3 6

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel July 2016