September 2016 - sssd-devel - Fedora mailing-lists

[sssd PR#32][opened] Requesting a pull to SSSD:master from fidencio:wip/#3138
by fidencio 27 Jul '17

27 Jul '17

URL: https://github.com/SSSD/sssd/pull/32 Author: fidencio Title: #32: Requesting a pull to SSSD:master from fidencio:wip/#3138 Action: opened PR body: """ This patch series is intended to solve #3138 by adding a new service that updates the confdb. As part of the series this service is used by secrets service. I only ran CI locally and the two secrets tests have been failing. /o\ Also, I've noticed some weird behavior, where the sssd-update-confdb service starts for apparently no reason, when upgrading fedora packages. Anyways, these pieces of code really need some detailed review as it was the first time I've been "seriously" playing with TEvent requests. So, please, consider it more like an RFC than a well finished and polished code. Best Regards, """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/32/head:pr32 git checkout pr32

3 14

Tlog integration and packages
by Nikolai Kondrashov 10 Mar '17

10 Mar '17

Hi everyone, I'd like to continue the discussion of tlog integration, and also present you the first release of tlog - a development preview, which has the configuration interface necessary to implement the integration: https://github.com/spbnick/tlog/releases/tag/v1 You're more than welcome to download RPMs, install, read tlog-rec(8) and tlog-rec.conf(5), and experiment! Building from the Git tree and the tarball works as well, if you're so inclined. I'm also attaching those manpages for convenience. Here are the integration plans so far, as discussed with Jakub on our devconf.cz trip meetings and before on the list. Jakub, please correct me or add details. * We follow the route similar to that taken by SELinux rule control implementation [1][2]. I.e. store the configuration in LDAP HBAC rules, write to files on the client side and then specify them to tlog upon user login. However, I'm also rather fond of the idea of specifying the whole configuration through an environment variable instead of through a file referenced by an environment variable - it's not big at all, and we'll avoid the hassle of managing the files. I implemented support for both in tlog (was easy). * We'll have to make nss_sss report user's shell as tlog-rec (how?) and specify the actual shell to tlog-rec via an environment variable, through pam_sss (with SSS_PAM_ENV_ITEM messages). I.e.: * Nss_sss would always report tlog-rec as the user's shell. * During login (e.g. through "login" or "sshd") pam_sss would add a variable to the user environment, containing, or pointing at, a tlog-rec configuration (TLOG_REC_CONF_TEXT or TLOG_REC_CONF_FILE). That configuration would contain the user's actual shell. I can also implement support for a separate variable just for the shell (TLOG_REC_SHELL?) to simplify the implementation for the start. * Tlog-rec would read the system-wide configuration and overlay it with the one specified in the environment, adding the specific user shell, and then would spawn it. Please also see the draft integration design page [3] for reference. I hope to refine and extend it in the coming weeks to match FreeIPA standards. Please chime in and suggest, object, discuss! Also, please report tlog bugs at https://github.com/spbnick/tlog/issues Thank you! Nick [1]: http://www.freeipa.org/page/SELinux_user_mapping [2]: http://www.freeipa.org/images/b/b9/Freeipa30_SELinuxUserMap.pdf [3]: http://www.freeipa.org/page/Session_Recording

5 22

[PATCH] Create pidfile after responders have started
by Victor Tapia 10 Jan '17

10 Jan '17

Hi list, The attached patch covers ticket #3080 (https://fedorahosted.org/sssd/ticket/3080) It's based on the following commit: https://git.fedorahosted.org/cgit/sssd.git/commit/?id=d19c4785215305e6eb5f2… Currently, systemd and upstart set the service as 'started' before the responders are available, making service dependencies (with autofs, for instance) unreliable due to a race condition with such dependent services. Creating the pidfile after the responders are up, and monitoring it's creation in the systemd service fixes this race condition. Thanks in advance, Victor

3 23

[RFC] NSS tlog integration
by Nikolai Kondrashov 09 Dec '16

09 Dec '16

Hi everyone, Please find attached proof-of-concept patches for a part of NSS integration with tlog. Namely, addition of shell substitution for getpwnam requests. The code is supposed to replace a user's shell with /usr/bin/tlog-rec, if session recording is enabled for all users, if it is enabled for that particular user, or for a group that it belongs to. The configuration is done in a dedicated section of sssd.conf named "session_recording", which can contain three options "scope", "users", and "groups". Those correspond to the scope of session recording: "none", "some", and "all", corresponding in order to: disabled session recording, session recording enabled for the specified users/groups, and session recording enabled for all users handled by SSSD. An example of a configuration can be: [session_recording] ; Disabled scope = none or [session_recording] ; Enabled for everyone scope = all or [session_recording] ; Enabled for some users and groups scope = some users = user1, user2 groups = group1, group2 The parts to be done still are adding support for getpwuid and getpwent requests, exporting of the original shell in pam_sss, and of course cleaning it up and doing it according to your comments and requirements. The code has some documentation in doxygen format, which I can change later if we decide on some other format, or no documentation at all. Please, tell me if I'm doing anything wrong this far already, or suggest better ways to do it. Thank you! Nick P.S. I'm on PTO for two weeks starting next week, so might not be able to answer quickly.

3 15

[PATCH] Unit tests for pam_sss using pam_wrapper (need help with CI..)
by Jakub Hrozek 08 Dec '16

08 Dec '16

Hi, the attached patches implement unit tests for the pam_sss module using pam_wrapper and libpamtest. In my testing, the coverage is around 75% with mostly the parts that require running as root being untested. I worked on this patchset even though the features for 1.14 are in full swing because there are several tickets that will require us to patch pam_sss, so it's important to have the code that changes tested. In addition, when we merge Dan's patches to use TLS with integration tests, then we'll be able to also test authentication in integration tests easily using libpamtest-python. However, our CI fails for me constantly: http://sssd-ci.duckdns.org/logs/job/42/75/fedora_rawhide/ci.html The strange thing is that running CI locally works fine and so does make check. Can anyone help point me in the right direction as to what should I check next? I suspect some of the environment variables might not be set correctly, but I don't see why..

2 8

[sssd PR#27][opened] Minor code changes
by fidencio 03 Dec '16

03 Dec '16

URL: https://github.com/SSSD/sssd/pull/27 Author: mzidek-rh Title: #27: Minor code changes Action: opened PR body: """ Some small changes in the code. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/27/head:pr27 git checkout pr27

1 8

[PATCH SET] SYSDB: Adding message to inform about cache
by Petr Cech 08 Nov '16

08 Nov '16

Hello list, I am solving ticket [1] now. There are three points mentioned. A have prepared patches for the first two. I would like to ask anybody it is right or if I miss something. The third point is about full LDIFF in special debug level. What does it mean 'special debug level'? Is it new option, for example? [1] https://fedorahosted.org/sssd/ticket/3060 Regards -- Petr^4 Čech

4 45

[PATCHES] views: properly override group member names
by Sumit Bose 08 Nov '16

08 Nov '16

Hi, this is my suggestion to solve https://fedorahosted.org/sssd/ticket/2948 "Handle overriden name of members in the memberUid attribute". The first two patches are for the IPA provider and make sure that all ghost members in a group get resolved because otherwise we cannot determine if the name is overridden or not. This adds an overhead to group lookups, especially for larger groups but I think it is an requirement which cannot be skipped. The third patch adds a sysdb call to recursively resolve all user-members of a group. Since the groups in SSSD's cache are hierarchically organized the member attribute only contains direct user and group members. To get all users the group members must be resolved recursively. Finally the forth patch applies the code-path which is already used for non-default views to the default case as well and adds a new list of members, with correctly overridden names (hopefully :-) which is then used in fill_grmem(). This adds some overhead to the overall group processing in the NSS responder (as can be seen in the test changes because the members are returned in different order in some cases). But I think because the of memory cache this is acceptable and might even help to remove the memberuid attribute in future and make the memberof plugin simpler. I worked on an alternative approach as well which tried to make the memberof plugin aware of the defaultOverrideName attribute. My wip tree is at https://fedorapeople.org/cgit/sbose/public_git/sssd.git/log/?h=memberof_def… but so far it does not work properly. Additionally I would prefer to not touch the memberof plugin. bye, Sumit

3 20

[PATCH] SYSDB: Fix error handling in sysdb_get_user_members_recursively
by Lukas Slebodnik 07 Nov '16

07 Nov '16

ehlo, We should not ignore return values of functions. LS

3 4

fedorahosted.org sunset
by Jakub Hrozek 27 Oct '16

27 Oct '16

Hi, fedorahosted.org is being decomissioned: https://lists.fedoraproject.org/archives/list/announce@lists.fedoraproject.… so we need to find a new home for SSSD.. I wanted to ask: 1) anyone from the core development team who is interested in finding a new home to raise a hand, we need someone to "own" this work 2) anyone from outside or inside the team who has an opinion to voice it :) so far we haven't even thought about the requirements in too much detail, though.. In the meantime I just wrote up what fields we use from Trac and therefore what info we need to keep in the new system: https://fedorahosted.org/sssd/wiki/ticket_fields

6 18

[sssd PR#34][opened] cache_req: move from switch to plugins
by fidencio 20 Oct '16

20 Oct '16

URL: https://github.com/SSSD/sssd/pull/34 Author: pbrezina Title: #34: cache_req: move from switch to plugins Action: opened PR body: """ cache_req grown quite big from the original code and it turned out that using switch statements to branch code for different cases makes the code quite hard to read and further extend and any modification to the logic itself is difficult. This patch changes the switch statements to plugins with small functions and separates logic into multiple modules. This gives us better control over the code and improves readability and maintainability while keeping code duplication to minimum. At the moment only cache req user by name, id and upn is implemented as a proof of concept. If you like it, I will finish the rest, it won't take much time. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/34/head:pr34 git checkout pr34

2 27

[sssd PR#13] MEMBEROF: Don't resolve members if they are removed (opened)
by fidencio 19 Oct '16

19 Oct '16

celestian's pull request #13: "MEMBEROF: Don't resolve members if they are removed" was opened PR body: """ ## TOPIC If we need remove ghost (SYSDB_GHOST, DB_GHOST) attribute from group we use empty structure. This doesn't mean that there is pointer to NULL but it means that there is zero elements. Ghost attribute is array not string. Resolves: https://fedorahosted.org/sssd/ticket/2940 ## REPRODUCER preparing: ``` ipa user-add --first=Adam --last=Adam --email=adam(a)persei.cz adam ipa group-add group_1 ipa group-add-member --users=adam group_1 ipa group-add group_2 ``` reproducer (possible repeat): ``` systemctl daemon-reload sudo su -c "truncate -s0 /var/log/sssd/*.log" sudo su -c "rm -f /var/lib/sss/db/*" sudo su -c "rm -f /var/lib/sss/mc/*" sudo systemctl restart sssd.service ipa group-add-member --groups=group_1 group_2 sss_cache -UG sudo su -c "truncate -s0 /var/log/sssd/*.log" getent group group_2 ipa group-remove-member --groups=group_1 group_2 sss_cache -UG sudo su -c "truncate -s0 /var/log/sssd/*.log" getent group group_2 ``` """ See the full pull-request at https://github.com/SSSD/sssd/pull/13 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/13/head:pr13 git checkout pr13

3 50

[sssd PR#33][opened] SECRETS: Some small misc fixes + fixing #3136
by fidencio 17 Oct '16

17 Oct '16

URL: https://github.com/SSSD/sssd/pull/33 Author: fidencio Title: #33: SECRETS: Some small misc fixes + fixing #3136 Action: opened PR body: """ This series was made on top of Jakub's patches adding Secrets' documentation, that is applied on top of my own patches adding a the update-confdb-process. The patches that needs to be reviewed are the last 6 patches, and they're listed below: f587a7c (Fabiano Fidêncio, 3 days ago) SECRETS: Add a configurable depth limit for nested containers Resolves: https://fedorahosted.org/sssd/ticket/3168 Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> e98bd63 (Fabiano Fidêncio, 7 hours ago) SECRETS: Use a tmp_context on local_db_check_containers() Otherwise the struct ldb_dn will be hanging on the mem_ctx till it gets freed. Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> 4a90c20 (Fabiano Fidêncio, 7 hours ago) SECRETS: Make functions from local.c static There's no reason for those functions to be exposed. Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> 67e1301 (Fabiano Fidêncio, 10 hours ago) CONFIG: Add secrets' provider option The provider option specifies where should the secrets be stored. Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> 5de385f (Jakub Hrozek, 6 weeks ago) CONFIG: List allowed secrets responder options Co-author: Fabiano Fidêncio <fidencio(a)redhat.com> 1f51d50 (Fabiano Fidêncio, 11 hours ago) CONFIG: Add secrets responder to the allowed sections Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> In the last patch (f587a7c) I'm adding a test for the maximum depth, but I decided to, at least for now, do this test based on the default value set for this option instead of trying to implemenet something in python to read the config entries from the ConfDB file. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/33/head:pr33 git checkout pr33

3 27

[PATCHES] Fix warnings Wsign-compare
by Lukas Slebodnik 17 Oct '16

17 Oct '16

ehlo, I found few warnings on rawhide when I build sssd-1.13.2 https://kojipkgs.fedoraproject.org//work/tasks/8618/11918618/build.log LS

2 6

[sssd PR#30][opened] sssctl: use systemd D-Bus API
by fidencio 11 Oct '16

11 Oct '16

URL: https://github.com/SSSD/sssd/pull/30 Author: pbrezina Title: #30: sssctl: use systemd D-Bus API Action: opened PR body: """ If systemd is used we leverage it's D-Bus API instead of running systemctl. Resolves: https://fedorahosted.org/sssd/ticket/3056 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/30/head:pr30 git checkout pr30

3 32

[sssd PR#31][opened] nss: allow UPNs in SSS_NSS_GETSIDBYNAME and SSS_NSS_GETORIGBYNAME
by fidencio 10 Oct '16

10 Oct '16

URL: https://github.com/SSSD/sssd/pull/31 Author: sumit-bose Title: #31: nss: allow UPNs in SSS_NSS_GETSIDBYNAME and SSS_NSS_GETORIGBYNAME Action: opened PR body: """ When adding support for UPNs, email addresses and aliases the SSS_NSS_GETSIDBYNAME and SSS_NSS_GETORIGBYNAME request were forgotten. This patch adds the missing support because it might be irritating if getpwnam() can resolve the name but the other requests fail. The same logic as for the plain user lookup is used, this add some code duplication which is expected to be removed when the nss responder will be switched to use the new cache_req code. Resolves https://fedorahosted.org/sssd/ticket/3194 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/31/head:pr31 git checkout pr31

1 20

[sssd PR#35][opened] sss_cache: improve option argument handling
by fidencio 10 Oct '16

10 Oct '16

URL: https://github.com/SSSD/sssd/pull/35 Author: justin-stephenson Title: #35: sss_cache: improve option argument handling Action: opened PR body: """ Print informational message and exit when multiple arguments are provided for single-argument options with sss_cache Resolves: https://fedorahosted.org/sssd/ticket/3180 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/35/head:pr35 git checkout pr35

1 9

[PATCH ding-libs] Extend API to const key for clients that don't need to modify their keys
by Philip Prindeville 06 Oct '16

06 Oct '16

From: Philip Prindeville <philipp(a)fedoraproject.org> Add c_str as a "const char *" to the hash_key_t. Redux per comments from Michal Zidek. --- dhash/dhash.c | 29 +++++++++++++++++++++-------- dhash/dhash.h | 4 +++- dhash/examples/dhash_test.c | 3 +++ 3 files changed, 27 insertions(+), 9 deletions(-) diff --git a/dhash/dhash.c b/dhash/dhash.c index 45ee0cf..98439e8 100644 --- a/dhash/dhash.c +++ b/dhash/dhash.c @@ -176,7 +176,7 @@ static void sys_free_wrapper(void *ptr, void *pvt) static address_t convert_key(hash_key_t *key) { address_t h; - unsigned char *k; + const unsigned char *k; switch(key->type) { case HASH_KEY_ULONG: @@ -184,7 +184,12 @@ static address_t convert_key(hash_key_t *key) break; case HASH_KEY_STRING: /* Convert string to integer */ - for (h = 0, k = (unsigned char *) key->str; *k; k++) + for (h = 0, k = (const unsigned char *) key->str; *k; k++) + h = h * PRIME_1 ^ (*k - ' '); + break; + case HASH_KEY_CONST_STRING: + /* Convert string to integer */ + for (h = 0, k = (const unsigned char *) key->c_str; *k; k++) h = h * PRIME_1 ^ (*k - ' '); break; default: @@ -212,6 +217,7 @@ static bool is_valid_key_type(hash_key_enum key_type) switch(key_type) { case HASH_KEY_ULONG: case HASH_KEY_STRING: + case HASH_KEY_CONST_STRING: return true; default: return false; @@ -244,6 +250,8 @@ static bool key_equal(hash_key_t *a, hash_key_t *b) return (a->ul == b->ul); case HASH_KEY_STRING: return (strcmp(a->str, b->str) == 0); + case HASH_KEY_CONST_STRING: + return (strcmp(a->c_str, b->c_str) == 0); } return false; } @@ -670,8 +678,11 @@ int hash_destroy(hash_table_t *table) while (p != NULL) { q = p->next; hdelete_callback(table, HASH_TABLE_DESTROY, &p->entry); - if (p->entry.key.type == HASH_KEY_STRING) { - hfree(table, (char *)p->entry.key.str); + if (p->entry.key.type == HASH_KEY_STRING + || p->entry.key.type == HASH_KEY_CONST_STRING) { + /* Internally we do not use constant memory for keys + * in hash table elements. */ + hfree(table, p->entry.key.str); } hfree(table, (char *)p); p = q; @@ -972,13 +983,14 @@ int hash_enter(hash_table_t *table, hash_key_t *key, hash_value_t *value) element->entry.key.ul = key->ul; break; case HASH_KEY_STRING: - len = strlen(key->str)+1; + case HASH_KEY_CONST_STRING: + len = strlen(key->c_str) + 1; element->entry.key.str = halloc(table, len); if (element->entry.key.str == NULL) { hfree(table, element); return HASH_ERROR_NO_MEMORY; } - memcpy((void *)element->entry.key.str, key->str, len); + memcpy(element->entry.key.str, key->str, len); break; } @@ -1070,8 +1082,9 @@ int hash_delete(hash_table_t *table, hash_key_t *key) return error; } } - if (element->entry.key.type == HASH_KEY_STRING) { - hfree(table, (char *)element->entry.key.str); + if (element->entry.key.type == HASH_KEY_STRING + || element->entry.key.type == HASH_KEY_CONST_STRING) { + hfree(table, element->entry.key.str); } hfree(table, element); return HASH_SUCCESS; diff --git a/dhash/dhash.h b/dhash/dhash.h index baa0d6a..c36ab79 100644 --- a/dhash/dhash.h +++ b/dhash/dhash.h @@ -112,7 +112,8 @@ typedef struct hash_table_str hash_table_t; typedef enum { HASH_KEY_STRING, - HASH_KEY_ULONG + HASH_KEY_ULONG, + HASH_KEY_CONST_STRING } hash_key_enum; typedef enum @@ -137,6 +138,7 @@ typedef struct hash_key_t { hash_key_enum type; union { char *str; + const char *c_str; unsigned long ul; }; } hash_key_t; diff --git a/dhash/examples/dhash_test.c b/dhash/examples/dhash_test.c index 303e9f8..7613e23 100644 --- a/dhash/examples/dhash_test.c +++ b/dhash/examples/dhash_test.c @@ -64,6 +64,9 @@ static char *key_string(hash_key_t *key) case HASH_KEY_STRING: snprintf(buf, sizeof(buf), "key string = \"%s\"", key->str); break; + case HASH_KEY_CONST_STRING: + snprintf(buf, sizeof(buf), "key string = \"%s\"", key->c_str); + break; default: snprintf(buf, sizeof(buf), "unknown key type = %d", key->type); break; -- 2.7.4

5 12

[sssd PR#36][opened] Partial fix for #3169
by fidencio 05 Oct '16

05 Oct '16

URL: https://github.com/SSSD/sssd/pull/36 Author: fidencio Title: #36: Partial fix for #3169 Action: opened PR body: """ Ticket #3169 is about having a quota for sssd secrets. This quota depends basically on the number of stored secrets and the size of (the payload of the) each stored secret and this patch implements the former for now. This patch is rebased on top of the series that fixes #3168. Relevant Patches: 1e4e914 (Fabiano Fidêncio, 17 minutes ago) SECRETS: Add a configurable limit of secrets that can be stored Related: https://fedorahosted.org/sssd/ticket/3169 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/36/head:pr36 git checkout pr36

1 14

RFC: github PR workflow
by Jakub Hrozek 03 Oct '16

03 Oct '16

Hi, I documented workflow that we could use for submitting PRs: https://fedorahosted.org/sssd/wiki/GithubWorkflow It's quite similar to what the FreeIPA team uses (although I don't think they publicly document it yet). Comments or edits welcome. If there are none, I'll link the page from the Contribute page later.

3 7

Re: [PATCH ding-libs] Extend API to const key for clients that don't need to modify their keys
by Michal Židek 30 Sep '16

30 Sep '16

Moving this to sssd-devel list. So that other developers can see the patch and review process. I will start the review after today's meeting. Michal (Lukas, Stephen, I put you two to CC only because you were also original recipients of the mail, I will not CC you further) On 09/28/2016 03:00 AM, Philip Prindeville wrote: > From: Philip Prindeville <philipp(a)fedoraproject.org> > > Add c_str as a "const char *" to the hash_key_t. > > --- > dhash/dhash.c | 35 ++++++++++++++++++++++++++++++----- > dhash/dhash.h | 4 +++- > dhash/examples/dhash_test.c | 3 +++ > 3 files changed, 36 insertions(+), 6 deletions(-) > > diff --git a/dhash/dhash.c b/dhash/dhash.c > index 45ee0cf..5f9f631 100644 > --- a/dhash/dhash.c > +++ b/dhash/dhash.c > @@ -44,6 +44,7 @@ > #include <stdio.h> > #include <string.h> > #include <stdlib.h> > +#include <stdint.h> > #include <errno.h> > #include "dhash.h" > > @@ -70,6 +71,9 @@ > } \ > } while(0) > > +#define discard_const(ptr) ((void *)((intptr_t)(ptr))) > +#define discard_const_p(type, ptr) ((type *)discard_const(ptr)) > + > /*****************************************************************************/ > /************************** Internal Type Definitions ************************/ > /*****************************************************************************/ > @@ -176,7 +180,7 @@ static void sys_free_wrapper(void *ptr, void *pvt) > static address_t convert_key(hash_key_t *key) > { > address_t h; > - unsigned char *k; > + const unsigned char *k; > > switch(key->type) { > case HASH_KEY_ULONG: > @@ -184,7 +188,12 @@ static address_t convert_key(hash_key_t *key) > break; > case HASH_KEY_STRING: > /* Convert string to integer */ > - for (h = 0, k = (unsigned char *) key->str; *k; k++) > + for (h = 0, k = (const unsigned char *) key->str; *k; k++) > + h = h * PRIME_1 ^ (*k - ' '); > + break; > + case HASH_KEY_CONST_STRING: > + /* Convert string to integer */ > + for (h = 0, k = (const unsigned char *) key->c_str; *k; k++) > h = h * PRIME_1 ^ (*k - ' '); > break; > default: > @@ -212,6 +221,7 @@ static bool is_valid_key_type(hash_key_enum key_type) > switch(key_type) { > case HASH_KEY_ULONG: > case HASH_KEY_STRING: > + case HASH_KEY_CONST_STRING: > return true; > default: > return false; > @@ -244,6 +254,8 @@ static bool key_equal(hash_key_t *a, hash_key_t *b) > return (a->ul == b->ul); > case HASH_KEY_STRING: > return (strcmp(a->str, b->str) == 0); > + case HASH_KEY_CONST_STRING: > + return (strcmp(a->c_str, b->c_str) == 0); > } > return false; > } > @@ -671,7 +683,9 @@ int hash_destroy(hash_table_t *table) > q = p->next; > hdelete_callback(table, HASH_TABLE_DESTROY, &p->entry); > if (p->entry.key.type == HASH_KEY_STRING) { > - hfree(table, (char *)p->entry.key.str); > + hfree(table, p->entry.key.str); > + } else if (p->entry.key.type == HASH_KEY_CONST_STRING) { > + hfree(table, discard_const(p->entry.key.c_str)); > } > hfree(table, (char *)p); > p = q; > @@ -978,7 +992,16 @@ int hash_enter(hash_table_t *table, hash_key_t *key, hash_value_t *value) > hfree(table, element); > return HASH_ERROR_NO_MEMORY; > } > - memcpy((void *)element->entry.key.str, key->str, len); > + memcpy(element->entry.key.str, key->str, len); > + break; > + case HASH_KEY_CONST_STRING: > + len = strlen(key->c_str)+1; > + element->entry.key.c_str = halloc(table, len); > + if (element->entry.key.c_str == NULL) { > + hfree(table, element); > + return HASH_ERROR_NO_MEMORY; > + } > + memcpy(discard_const(element->entry.key.c_str), key->c_str, len); > break; > } > > @@ -1071,7 +1094,9 @@ int hash_delete(hash_table_t *table, hash_key_t *key) > } > } > if (element->entry.key.type == HASH_KEY_STRING) { > - hfree(table, (char *)element->entry.key.str); > + hfree(table, element->entry.key.str); > + } else if (element->entry.key.type == HASH_KEY_CONST_STRING) { > + hfree(table, discard_const(element->entry.key.c_str)); > } > hfree(table, element); > return HASH_SUCCESS; > diff --git a/dhash/dhash.h b/dhash/dhash.h > index baa0d6a..c36ab79 100644 > --- a/dhash/dhash.h > +++ b/dhash/dhash.h > @@ -112,7 +112,8 @@ typedef struct hash_table_str hash_table_t; > > typedef enum { > HASH_KEY_STRING, > - HASH_KEY_ULONG > + HASH_KEY_ULONG, > + HASH_KEY_CONST_STRING > } hash_key_enum; > > typedef enum > @@ -137,6 +138,7 @@ typedef struct hash_key_t { > hash_key_enum type; > union { > char *str; > + const char *c_str; > unsigned long ul; > }; > } hash_key_t; > diff --git a/dhash/examples/dhash_test.c b/dhash/examples/dhash_test.c > index 303e9f8..7613e23 100644 > --- a/dhash/examples/dhash_test.c > +++ b/dhash/examples/dhash_test.c > @@ -64,6 +64,9 @@ static char *key_string(hash_key_t *key) > case HASH_KEY_STRING: > snprintf(buf, sizeof(buf), "key string = \"%s\"", key->str); > break; > + case HASH_KEY_CONST_STRING: > + snprintf(buf, sizeof(buf), "key string = \"%s\"", key->c_str); > + break; > default: > snprintf(buf, sizeof(buf), "unknown key type = %d", key->type); > break; >

2 3

[sssd PR#24] MAN: Add a manpage for the sssd-secrets responder (opened)
by fidencio 30 Sep '16

30 Sep '16

jhrozek's pull request #24: "MAN: Add a manpage for the sssd-secrets responder" was opened PR body: """ The manpage lists the options and adds API examples. """ See the full pull-request at https://github.com/SSSD/sssd/pull/24 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/24/head:pr24 git checkout pr24

1 21

[RFC] Use GNULIB's compiler warning code
by Fabiano Fidêncio 29 Sep '16

29 Sep '16

Howdy! I've suggested, a long time ago, that we could start making use of GNULIB's compiler warnings from 'manywarnings' module. This is basically what we have been doing in a few projects that I (used to and still) maintain (like spice-gtk and libosinfo, for instance). For now I didn't try to fix any of the warnings that we cannot cope with, mainly because I'm not sure whether you guys will agree on using it or not. Here is an experimental patch that works properly on Fedora 24. I still have to make some tests on RHEL-6, RHEL-7 and a few other systems (Debian, at least) in order to make sure that we won't break the build because of the patch. If you are okay with the change, I'll start going through the warnings that we cannot cope with and slowly start fixing them. Although, I have the feeling that fixing some of them would cause a lot of undesired changes, which will just bring troubles for ourselves when backporting fixes downstream (and here I'm talking about -Wformat-signedess, -Wsign-compare, -Wunused-parameter, ... for instance). I'm looking forward to hear some feedback! Best Regards, -- Fabiano Fidêncio

3 10

[PATCH] BUILD: intgcheck need to fail if pytest fails
by Lukas Slebodnik 27 Sep '16

27 Sep '16

ehlo, make intgcheck silently passed in case of failure/error in pytest. This regression was introduced by spliting make intgcheck into sub-targets. I am soory I had to catch that as part of review. Simple patch is attached. LS

2 2

[PATCH] config_schema: Add ldap_user_email to schema
by Lukas Slebodnik 26 Sep '16

26 Sep '16

ehlo, yet another oneliner. It reminds me that we should generate either schema or data for python test. LS

3 5

[PATCH] sss_override: improve --debug description
by Pavel Březina 24 Sep '16

24 Sep '16

https://fedorahosted.org/sssd/ticket/2813 I wanted to split include/debug_levels.xml into more files so we don't duplicate information, but I didn't figure out how to use xi:include in files that are already beeing included. I always managed to fail on dtd validation. Maybe someone more familiar with docbook may chime in.

4 12

[sssd PR#26] KRB5: Fixing FQ name of user in krb5_setup() (opened)
by fidencio 23 Sep '16

23 Sep '16

celestian's pull request #26: "KRB5: Fixing FQ name of user in krb5_setup()" was opened PR body: """ This patch fixes creation of FQ username if krb5_map_user option ise used. Resolves: https://fedorahosted.org/sssd/ticket/3188 """ See the full pull-request at https://github.com/SSSD/sssd/pull/26 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/26/head:pr26 git checkout pr26

1 40

[PATCH] SPEC: Rename python packages using macro %python_provide
by Lukas Slebodnik 23 Sep '16

23 Sep '16

ehlo, SSSD python packages were renamed in fedora few months ago. python-* -> python2-* But we didn't rename packages in upstream spec file and therefore upgrade from fedora 24 -> sssd master is not possible. Attached patch shoudl fix the issue. BTW here are provides and obsoletes for current master sh$ rpm -qp --provides python-libipa_hbac-1.13.92-0.fc24.x86_64.rpm libipa_hbac-python = 1.13.92-0.fc24 python-libipa_hbac = 1.13.92-0.fc24 python-libipa_hbac(x86-64) = 1.13.92-0.fc24 sh$ rpm -qp --obsoletes python-libipa_hbac-1.13.92-0.fc24.x86_64.rpm libipa_hbac-python < 1.12.90 and after renaming sh$ rpm -qp --provides python2-libipa_hbac-1.13.92-0.el6.x86_64.rpm libipa_hbac-python = 1.13.92-0.el6 python-libipa_hbac = 1.13.92-0.el6 python2-libipa_hbac = 1.13.92-0.el6 python2-libipa_hbac(x86-64) = 1.13.92-0.el6 sh$ rpm -qp --obsoletes python2-libipa_hbac-1.13.92-0.el6.x86_64.rpm libipa_hbac-python < 1.12.90 python-libipa_hbac < 1.13.92-0.el6 LS

2 6

[PATCH] SSSDConfig: Do not fail with nonexisting domains/services
by Lukas Slebodnik 23 Sep '16

23 Sep '16

ehlo, Almost oneliner i there would not be a unit test :-) LS

2 5

Question: LDAP provider doesn't show group member
by Petr Cech 22 Sep '16

22 Sep '16

Hi, I am working on [1] LDAP provider doesn't show group member There is one point what I am not able to understand clearly. I prepared environment by: ipa user-add --first=Test --last=User1 --email=u1(a)domain.sssd cmt_user_1 ipa group-add cmt_group_1 ipa group-add-member --users=cmt_user_1 cmt_group_1 And sssd.conf is attached. I used patch 0007 [2] to simpler grep of interesting messages. And I applied patches 0001 to 0006 (I am waiting for their push to master). [1] https://fedorahosted.org/sssd/ticket/3186 [2] 0007-WIP-Debuging-of-attr-member-in-ldap-answer.patch What I saw is: # COMMAND ON CLIENT: [root@mirach sssd]# systemctl daemon-reload && sudo su -c "truncate -s0 /var/log/sssd/*.log" && sudo su -c "rm -f /var/lib/sss/db/*" && sudo su -c "rm -f /var/lib/sss/mc/*" && sudo systemctl restart sssd.service && getent group cmt_group_1 && grep '>>>' *.log # There is user missing: cmt_group_1:*:1703800166: # SSSD LOG: [sdap_get_generic_ext_step] (0x0400): >>> calling ldap_search_ext with [(&(cn=cmt_group_1)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))][cn=groups,cn=accounts,dc=beta]. [sdap_get_generic_ext_step] (0x1000): >>> Requesting attrs: [objectClass] [sdap_get_generic_ext_step] (0x1000): >>> Requesting attrs: [cn] [sdap_get_generic_ext_step] (0x1000): >>> Requesting attrs: [userPassword] [sdap_get_generic_ext_step] (0x1000): >>> Requesting attrs: [gidNumber] [sdap_get_generic_ext_step] (0x1000): >>> Requesting attrs: [member] [sdap_get_generic_ext_step] (0x1000): >>> Requesting attrs: [modifyTimestamp] [sdap_get_generic_ext_step] (0x1000): >>> Requesting attrs: [entryUSN] [sdap_parse_entry] (0x0080): >>> ----- filter map: [sdap_parse_entry] (0x0080): >>> [posixGroup] [sdap_parse_entry] (0x0080): >>> [(null)] [sdap_parse_entry] (0x0080): >>> [cn] [sdap_parse_entry] (0x0080): >>> [userPassword] [sdap_parse_entry] (0x0080): >>> [gidNumber] [sdap_parse_entry] (0x0080): >>> [member] [sdap_parse_entry] (0x0080): >>> [(null)] [sdap_parse_entry] (0x0080): >>> [(null)] [sdap_parse_entry] (0x0080): >>> [modifyTimestamp] [sdap_parse_entry] (0x0080): >>> [entryUSN] [sdap_parse_entry] (0x0080): >>> [(null)] [sdap_parse_entry] (0x0080): >>> [(null)] [sdap_parse_entry] (0x0080): >>> ----- attributes in ldap answer: [sdap_parse_entry] (0x0020): >>> [objectClass] [sdap_parse_entry] (0x0020): >>> [cn] [sdap_parse_entry] (0x0020): >>> [gidNumber] [sdap_parse_entry] (0x0020): >>> [modifyTimestamp] [sdap_parse_entry] (0x0020): >>> [entryUSN] [sdap_get_groups_process] (0x0400): >>> Group contains: [sdap_get_groups_process] (0x0400): >>> 0: [originalDN] [sdap_get_groups_process] (0x0400): >>> 1: [name] [sdap_get_groups_process] (0x0400): >>> 2: [gidNumber] [sdap_get_groups_process] (0x0400): >>> 3: [originalModifyTimestamp] [sdap_get_groups_process] (0x0400): >>> 4: [entryUSN] [sdap_nested_group_process_send] (0x2000): >>> About to process group [cn=cmt_group_1,cn=groups,cn=accounts,dc=beta] # LDAPSEARCH ON LDAP SERVER: [pcech@algol ~]$ ldapsearch -H ldap://localhost -D uid=admin,cn=users,cn=accounts,dc=beta -w myspulin -b cn=groups,cn=accounts,dc=beta "(&(cn=cmt_group_1)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))" # extended LDIF # # LDAPv3 # base <cn=groups,cn=accounts,dc=beta> with scope subtree # filter: (&(cn=cmt_group_1)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0)))) # requesting: ALL # # cmt_group_1, groups, accounts, beta dn: cn=cmt_group_1,cn=groups,cn=accounts,dc=beta objectClass: ipaobject objectClass: top objectClass: ipausergroup objectClass: posixgroup objectClass: groupofnames objectClass: nestedgroup cn: cmt_group_1 ipaUniqueID: db0b564e-7efe-11e6-a757-5254001a3efa gidNumber: 1703800166 member: uid=cmt_user_1,cn=users,cn=accounts,dc=beta # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Question is why didn't SSSD obtain member attribute if I saw it in ldapsearch call? Is there something what I miss? Lukas pointed out that it may not be the correct way to use IPA for handling users in groups in LDAP server. I understand I am working on AD case too. But -- is it really possible to get different data via SSSD and ldapsearch() with the same filter and base? Regards -- Petr^4 Čech

4 5

[sssd PR#21] IFP: expose user and group unique IDs through DBus (opened)
by fidencio 22 Sep '16

22 Sep '16

tequeter's pull request #21: "IFP: expose user and group unique IDs through DBus" was opened PR body: """ This adds a uniqueID property on User and Group InfoPipe objects. It has a useful value on AD- and IPA-backed domains. For Active Directory, this is the GUID. """ See the full pull-request at https://github.com/SSSD/sssd/pull/21 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/21/head:pr21 git checkout pr21

1 21

[PATCH] ssh: skip invalid certificates
by Sumit Bose 22 Sep '16

22 Sep '16

Hi, currently the code which generates ssh key from the public keys in the user certificates fails if one certificate cannot be validated and terminates the whole request. It is of course valid that the user entry might contain certificates which SSSD cannot validate and since we just won't generate a ssh-key in this case SSSD should just skip those entires and return ssh-keys for every valid certificate. You can test the patch even without a real certificate by e.g. adding a ssh-key to an IPA user object. Then 'sss_ssh_authorizedkeys username' should return this key. If you now add some random data the the userCertificate object of the same user, call 'sss_cache -E' and call 'sss_ssh_authorizedkeys username' again, you get nothing because the random data cannot be validated and hence the whole request is aborted. With the attached patch sss_ssh_authorizedkeys should return the ssh-key again. bye, Sumit

3 7

[sssd PR#29][opened] tests: Add a regression test for upstream ticket #3131
by fidencio 22 Sep '16

22 Sep '16

URL: https://github.com/SSSD/sssd/pull/29 Author: jhrozek Title: #29: tests: Add a regression test for upstream ticket #3131 Action: opened PR body: """ Tests that running two duplicate SRV resolution queries succeeds and returns a valid host name. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/29/head:pr29 git checkout pr29

1 11

[sssd PR#12] failover: proceed normally when no new server is found (opened)
by fidencio 22 Sep '16

22 Sep '16

pbrezina's pull request #12: "failover: proceed normally when no new server is found" was opened PR body: """ https://fedorahosted.org/sssd/ticket/3131 I couldn't reproduce manually so I used the second patch as a by-code reproducer. If you apply the patch then sssd will try to resolve meta server twice simultaneously and triggering the problematic code path. You can search for RESOLV SRV DONE in logs. """ See the full pull-request at https://github.com/SSSD/sssd/pull/12 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/12/head:pr12 git checkout pr12

1 8

[PATCH] Remove double semicolon at the end of line
by Lukas Slebodnik 21 Sep '16

21 Sep '16

ehlo, simple patch attached + shell based unit test. LS

2 2

[sssd PR#4][+Changes requested] Added small tweaks to enable SSSD to be compiled with the musl libc
by fidencio 21 Sep '16

21 Sep '16

URL: https://github.com/SSSD/sssd/pull/4 Title: #4: Added small tweaks to enable SSSD to be compiled with the musl libc Label: +Changes requested

1 0

[PATCH] Fix offline resolution of autofs maps and netgroups
by Jakub Hrozek 21 Sep '16

21 Sep '16

Hi, to reproduce the netgroups failure: * getent netgroup testngr # to verify the netgroup is there * sss_cache -E * pkill -USR1 sssd # make sssd go offline * getent netgroup testngr to reproduce the autofs maps failure: * automount -m # to verify the maps are there * pkill -USR1 sssd # make sssd go offline * automount -m # to verify the maps are there Before the patches, neither offline lookup would return the expected results. Both lookups should return results with the patches.

3 7

[sssd PR#25] TESTS: Add integration tests for the proxy provider of sssd-secrets (opened)
by fidencio 21 Sep '16

21 Sep '16

jhrozek's pull request #25: "TESTS: Add integration tests for the proxy provider of sssd-secrets" was opened PR body: """ Execrcies the basic operations of the sssd-secrets responder and can be used as a basis to add more tests. """ See the full pull-request at https://github.com/SSSD/sssd/pull/25 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/25/head:pr25 git checkout pr25

2 40

[sssd PR#28][opened] PAM: call free only when memory is expected to be allocated
by fidencio 19 Sep '16

19 Sep '16

URL: https://github.com/SSSD/sssd/pull/28 Author: sumit-bose Title: #28: PAM: call free only when memory is expected to be allocated Action: opened PR body: """ This fixes a potential double-free found by Coverity which was introduced by PR #17. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/28/head:pr28 git checkout pr28

1 4

[PATCHES] p11: add no_verification option
by Sumit Bose 19 Sep '16

19 Sep '16

Hi, the following 3 patches are related to the Smartcard authentication feature but imo can be tested even without having one. The first patch just adds some missing pieces. The second adds a new 'no_verification' switch to the 'certificate_verification' option, which is already tested by the unit tests. The third adds two new OCSP related switches. With OCSP a certificate can be validates online by talking to a server which is listed in the certificate. Of course it might not always be possible to directly talk to this server. We already have the 'no_ocsp' switch to disable OCSP completely. The two new switches allow SSSD to talk to a different server or a proxy. To see how it is working you can do to following: - call 'make check' to build and rung all the tests - call './pam-srv-tests' to run the PAM responder tests but do not let it complete but stop it with CTRL-C. This is needed to create the test nss database in /dev/shm/tp_pam_srv_tests-test_pam_srv/, it can be created differently but this way it is most easy :-) - add a OCSP signing cert with echo "MIIDaTCCAlGgAwIBAgIBAjANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlJUEEuREVWRUwxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNTA5MjMxMTI2MjBaFw0xNzA5MTIxMTI2MjBaMC0xEjAQBgNVBAoMCUlQQS5ERVZFTDEXMBUGA1UEAwwOT0NTUCBTdWJzeXN0ZW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDEXVzkTN9R03+hvAbkiCYqdKKe7Nr0YDlchny+IsJl5cYiFBtWqiVJK5N0L6uCS9bVBtuG7y9Vv1TJrv2U8hqjXYZFM6HzYwwmbE2tv1Yyx0dQyYiYTT0nVyXPrXDJe0PFdYTsAlw7C54wZuBsdDADUTA1ThAP22Z6Zy+UyQFtlqEfCErvHK+VolCfkTJ4dYlQb5x7Gs6fEmLbnaGpJXW1JnRzMZ4hM+/mV3xSsjFuYwwoFCHG6GQu/LJgosBX9M+OMavMOO/AzeUlHfUoyMUNn0iNeiDqeYPBCNf4czK0CpeJdE4qBBgu0vSfC0mzjKRuFQEAUuBGxGE+2BP09uXAgMBAAGjgYwwgYkwHwYDVR0jBBgwFoAU0aLh2me2OKzMbu3zckJNNu3Hd1swDgYDVR0PAQH/BAQDAgHGMEEGCCsGAQUFBwEBBDUwMzAxBggrBgEFBQcwAYYlaHR0cDovL2lwYS1kZXZlbC5pcGEuZGV2ZWw6ODAvY2Evb2NzcDATBgNVHSUEDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAQEAAJzUjm39nsMlxc0ivEm77PN9ZFFWIfY6fOteNpJnOADlOatkXKq6PTFS0lRo/53HjYvmvrjnUTYHK3hmRlDvwr+49UqhSkKai8v6PSS4jYJplETME032OwGL17qCjoX2yU55Ovm3CIamUNNOSIvMBbS7HB0EBe/KHMhme5+Uhtfgjql9B9ihuwT1U3vXQP+cavxe37PJOCUuuATLyd0GX+Islkq2v1pEKX0dsXhMpDwLOYLqckBZHOoAKEo2VYZN0P1KZZkJd4kQHGsADYfuIrLACwzLxlEWmCIq4AOwpYtkMSx85DgT6lW3ECgfbFYVVUzqHUuTiogEsgJ0kouCJw==" | base64 -d | certutil -A -d sql:/dev/shm/tp_pam_srv_tests-test_pam_srv -t TC,TC,TC -n ocsp_cert the NSS library call check this certificate first before trying to connect to the OCSP responder, so a valid one with the right key usage must be added to make NSS try to reach the new OCSP responder - call strace -s 128 -f -esend .libs/lt-p11_child --debug-microseconds=1 --debug-timestamps=1 --debug-to-stderr --debug-level=10 --pre --nssdb sql:/dev/shm/tp_pam_srv_tests-test_pam_srv where you should see lines like send(7, "\313D\1\0\0\1\0\0\0\0\0\0\6ipa-ca\3ipa\5devel\0\0\1\0\1", 34, MSG_NOSIGNAL) = 34 from the DNS lookups for ipa-ca.ipa.devel which is the OCSP server from the ticket - call strace -s 128 -f -esend ./p11_child --debug-microseconds=1 --debug-timestamps=1 --debug-to-stderr --debug-level=10 --pre --nssdb sql:/dev/shm/tp_pam_srv_tests-test_pam_srv --verify 'ocsp_default_responder=http://oooo.cccc.ssss.pppp:80,ocsp_default_responder_signing_cert=ocsp_cert' where you should now see lines like send(7, "yO\1\0\0\1\0\0\0\0\0\0\4oooo\4cccc\4ssss\4pppp\0\0\1\0\1", 37, MSG_NOSIGNAL) = 37 from the DNS lookups for the OCSP responder from the command line. Of course all the validations will fail with "Certificate [SSSD Test Token:Server-Cert][CN=ipa-devel.ipa.devel,O=IPA.DEVEL] not valid [-8071], skipping" because none of the OCSP responders are available but I think this test is sufficient to see that the patch is working as expected. bye, Sumit

3 11

[PATCH] Failover to next server if authentication fails
by Pavel Březina 19 Sep '16

19 Sep '16

We can fail in sasl_bind_send() with ERR_AUTH_FAILED for basically unspecified reason but we do not failover to next server. This patch should fix it. As said on the meeting, I didn't reproduce it and I'm not sure if it will fix the customer issue unless they confirm it, but it seems to be a valid patch anyway.

2 6

Re: [PATCH SET] AD_PROVIDER: ad_enabled_domains
by Petr Cech 19 Sep '16

19 Sep '16

Sorry, I experienced some issue with mailing list. So I send it again. -------- Forwarded Message -------- Subject: Re: [SSSD] Re: [PATCH SET] AD_PROVIDER: ad_enabled_domains Date: Tue, 9 Aug 2016 17:29:38 +0200 From: Petr Cech <pcech(a)redhat.com> To: sssd-devel(a)lists.fedorahosted.org On 08/09/2016 11:07 AM, Jakub Hrozek wrote: > On Mon, Jul 25, 2016 at 06:18:28PM +0200, Petr Cech wrote: >> > Hello, >> > >> > there is fixed patch set attached. >> > >> > Segmentation fault was caused by wrong pointer :-(, sorry. >> > >> > This new patch set has new debug message. I am open to dissccus the >> > debug_level and content of message. Any improving idea? >> > >> > I hit one issue during testing -- sometimes if I am connected to subdomain >> > and I enable only sibling subdomain (the master is added automaticaly) and >> > forest root is not enabled -- I see only master and sibling not. But if I >> > added sleep for cycle (for using dbg) to function ad_subdomains_init() >> > everythink is OK. >> > Any idea? > Can you test that case with valgrind? This sounds like some uninitilized > variable condition. I didn't run valgrind but I have new information. If you clear the cache and reset sssd, first attempt to obtain information about user from sibling domain fails. The second and the other attempts runs correctly. I see that the sibling domain is enabled. But if I look more carefully there is message in log (gamma.domain.bootes is sibling domain): [sssd[be[beta.domain.bootes]]] [dp_req_new] (0x0020): Unknown domain: gamma.domain.bootes First attempt should works too but you should wait nearly exactly 6 seconds after restart sssd. New patch set is attached. >> > Anyway, I would like to ask you for testing. >> > >> > Regards >> > >> > -- >> > Petr^4 Čech >> > From 7fd9ad8f42f274463c1d107b195d21290fd0b0f2 Mon Sep 17 00:00:00 2001 >> > From: Petr Cech <pcech(a)redhat.com> >> > Date: Fri, 13 May 2016 05:21:07 -0400 >> > Subject: [PATCH 1/5] AD_PROVIDER: Add ad_enabled_domains option > ACK Thanks. >> > From dfa6e063d3ef4850a7809e2f5a6d3826ea061b27 Mon Sep 17 00:00:00 2001 >> > From: Petr Cech <pcech(a)redhat.com> >> > Date: Tue, 21 Jun 2016 08:34:15 +0200 >> > Subject: [PATCH 2/5] AD_PROVIDER: Initializing of ad_enabled_domains >> > >> > We add ad_enabled_domains into ad_subdomains_ctx. >> > >> > Resolves: >> > https://fedorahosted.org/sssd/ticket/2828 >> > --- >> > src/providers/ad/ad_subdomains.c | 82 ++++++++++++++++++++++++++++++++++++++++ >> > 1 file changed, 82 insertions(+) >> > >> > diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c >> > index e9da04e384e598927f9c8c203a751bcccd29e895..9c0afb19418e44a3e3daa661baf1c7a82439d60d 100644 >> > --- a/src/providers/ad/ad_subdomains.c >> > +++ b/src/providers/ad/ad_subdomains.c >> > @@ -57,6 +57,79 @@ >> > /* do not refresh more often than every 5 seconds for now */ >> > #define AD_SUBDOMAIN_REFRESH_LIMIT 5 >> > >> > +static errno_t ad_get_enabled_domains(TALLOC_CTX *mem_ctx, >> > + struct ad_id_ctx *ad_id_ctx, >> > + const char *ad_domain, >> > + const char ***_ad_enabled_domains) >> > +{ >> > + int ret; >> > + const char *str; >> > + const char *option_name; >> > + const char **domains = NULL; >> > + int count; >> > + bool is_ad_in_domains; >> > + TALLOC_CTX *tmp_ctx = NULL; >> > + >> > + tmp_ctx = talloc_new(NULL); >> > + if (tmp_ctx == NULL) { >> > + return ENOMEM; >> > + } >> > + >> > + str = dp_opt_get_cstring(ad_id_ctx->ad_options->basic, AD_ENABLED_DOMAINS); >> > + if (str == NULL) { >> > + _ad_enabled_domains = NULL; > I think you wanted to dereference the pointer here? (it might also be a > good idea to return EINVAL if the caller passed NULL as the output pointer) Right, thanks, addressed. >> > + ret = EOK; >> > + goto done; >> > + } >> > + >> > From 4cd5c77f09750f9eb20c91eadc4759c3e4166093 Mon Sep 17 00:00:00 2001 >> > From: Petr Cech <pcech(a)redhat.com> >> > Date: Tue, 21 Jun 2016 09:48:52 +0200 >> > Subject: [PATCH 3/5] AD_PROVIDER: ad_enabled_domains - only master >> > >> > We can skip looking up other domains if option ad_enabled_domains >> > contains only master domain. >> > >> > Resolves: >> > https://fedorahosted.org/sssd/ticket/2828 >> > --- >> > src/providers/ad/ad_subdomains.c | 16 ++++++++++++++++ >> > 1 file changed, 16 insertions(+) >> > >> > diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c >> > index 9c0afb19418e44a3e3daa661baf1c7a82439d60d..eaa85f802dbb4022dc632cc4c05d89685eccd901 100644 >> > --- a/src/providers/ad/ad_subdomains.c >> > +++ b/src/providers/ad/ad_subdomains.c >> > @@ -1163,6 +1163,7 @@ static void ad_subdomains_refresh_connect_done(struct tevent_req *subreq) >> > return; >> > } >> > >> > + /* connect to the DC we are a member of */ >> > subreq = ad_master_domain_send(state, state->ev, state->id_ctx->conn, >> > state->sdap_op, state->sd_ctx->domain_name); >> > if (subreq == NULL) { >> > @@ -1211,6 +1212,21 @@ static void ad_subdomains_refresh_master_done(struct tevent_req *subreq) >> > goto done; >> > } >> > >> > + /* >> > + * If ad_enabled_domains contains only master domain >> > + * we shouldn't lookup other domains. >> > + */ >> > + if (state->sd_ctx->ad_enabled_domains != NULL) { >> > + if (talloc_array_length(state->sd_ctx->ad_enabled_domains) == 2) { >> > + if (strcmp(state->sd_ctx->ad_enabled_domains[0], >> > + state->be_ctx->domain->name) == 0) { > I only notices this now, but IIRC the domains are case insensitive, > shouldn't we use strcasecmp here? I see strcasecmp in other places. So I fixed it. >> > + DEBUG(SSSDBG_TRACE_FUNC, >> > + "No other enabled domain than master.\n"); >> > + goto done; >> > + } >> > + } >> > + } >> > + >> > subreq = ad_get_root_domain_send(state, state->ev, forest, >> > sdap_id_op_handle(state->sdap_op), >> > state->sd_ctx); >> > -- >> > 2.7.4 >> > >> > From 0d2b0c67875663d0e614b8361152ec7edc14c37e Mon Sep 17 00:00:00 2001 >> > From: Petr Cech <pcech(a)redhat.com> >> > Date: Mon, 27 Jun 2016 11:51:30 +0200 >> > Subject: [PATCH 4/5] AD_PROVIDER: ad_enabled_domains - other then master >> > >> > We can skip looking up other domains if >> > option ad_enabled_domains doesn't contain them. >> > >> > Resolves: >> > https://fedorahosted.org/sssd/ticket/2828 >> > --- >> > src/providers/ad/ad_subdomains.c | 49 ++++++++++++++++++++++++++++++++++++---- >> > 1 file changed, 45 insertions(+), 4 deletions(-) >> > >> > diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c >> > index eaa85f802dbb4022dc632cc4c05d89685eccd901..32f7d7b3b2c4917d15d516c5e8beac159ffe164f 100644 >> > --- a/src/providers/ad/ad_subdomains.c >> > +++ b/src/providers/ad/ad_subdomains.c >> > @@ -130,6 +130,23 @@ done: >> > return ret; >> > } >> > >> > +static bool is_domain_enabled (const char *domain, >> > + const char **enabled_doms) > ^ > We don't put a space between function name and the argument list. Addressed. >> > +{ >> > + bool ret; >> > + >> > + if (enabled_doms == NULL) { >> > + ret = true; >> > + goto done; > Do we really need to use jump labels instead of just returning true? Addressed. >> > + } >> > + >> > + ret = string_in_list(domain, discard_const_p(char *, enabled_doms), true) ? >> > + true : false; > Can you also fix the indentation here? We could also just return the > function return value and get rid of the 'ret' variable completely. Addressed. >> > + >> > +done: >> > + return ret; >> > +} >> > + >> > static errno_t >> > ad_subdom_ad_ctx_new(struct be_ctx *be_ctx, >> > struct ad_id_ctx *id_ctx, >> > @@ -485,6 +502,7 @@ done: >> > >> > From 92af52a3b4d8fa138282030a72122d6cbe9c5413 Mon Sep 17 00:00:00 2001 >> > From: Petr Cech <pcech(a)redhat.com> >> > Date: Mon, 27 Jun 2016 11:53:19 +0200 >> > Subject: [PATCH 5/5] TESTS: Adding tests for ad_enabled_domains option > ACK Thanks. Regards -- Petr^4 Čech

4 23

[sssd PR#11][closed] SECRETS: Don't remove a container when it has children
by fidencio 16 Sep '16

16 Sep '16

URL: https://github.com/SSSD/sssd/pull/11 Author: fidencio Title: #11: SECRETS: Don't remove a container when it has children Action: closed To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/11/head:pr11 git checkout pr11

1 0

[sssd PR#11][comment] SECRETS: Don't remove a container when it has children
by fidencio 16 Sep '16

16 Sep '16

URL: https://github.com/SSSD/sssd/pull/11 Title: #11: SECRETS: Don't remove a container when it has children jhrozek commented: """ * master: ab7b33fd7d820688545d5994a402cedf4bcdb6e1 """ See the full comment at https://github.com/SSSD/sssd/pull/11#issuecomment-247597744

1 0

[sssd PR#11][+Pushed] SECRETS: Don't remove a container when it has children
by fidencio 16 Sep '16

16 Sep '16

URL: https://github.com/SSSD/sssd/pull/11 Title: #11: SECRETS: Don't remove a container when it has children Label: +Pushed

1 0

[sssd PR#11][-Accepted] SECRETS: Don't remove a container when it has children
by fidencio 16 Sep '16

16 Sep '16

URL: https://github.com/SSSD/sssd/pull/11 Title: #11: SECRETS: Don't remove a container when it has children Label: -Accepted

1 0

[sssd PR#17] Improve support for gdm Smartcard support (opened)
by fidencio 16 Sep '16

16 Sep '16

sumit-bose's pull request #17: "Improve support for gdm Smartcard support" was opened PR body: """ Those two patches try to fix two issues related to the Smartcard handling feature of gdm. The first fixes https://fedorahosted.org/sssd/ticket/3165 and the second fixes an issue which was introduced by the sysdb refactoring. """ See the full pull-request at https://github.com/SSSD/sssd/pull/17 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/17/head:pr17 git checkout pr17

1 9

[PATCH] sudo man page: say that we support IPA schema
by Pavel Březina 16 Sep '16

16 Sep '16

SSIA

5 12

[PATCH] WIP: PROXY: Adding proxy_max_children option
by Petr Cech 14 Sep '16

14 Sep '16

Hello, I am fighting with adding new option to sssd.conf. I slowly running out of breath. I know proxy could be id, auth or chpass provider. I don't know where is the right place for my option. And the second issue is it breaks test for SSSD config. :-( Is there anyone who would like to join to the fight? Please, see attached patch. Regards -- Petr^4 Čech

5 23

[sssd PR#20] sss_override fails to export (opened)
by fidencio 14 Sep '16

14 Sep '16

mzidek-rh's pull request #20: "sss_override fails to export" was opened PR body: """ Here is a fix + CI test for https://fedorahosted.org/sssd/ticket/3179. Michal """ See the full pull-request at https://github.com/SSSD/sssd/pull/20 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/20/head:pr20 git checkout pr20

1 15

[sssd PR#11] SECRETS: Don't remove a container when it has children (+Accepted)
by fidencio 14 Sep '16

14 Sep '16

fidencio's pull request #11: "SECRETS: Don't remove a container when it has children" label *Accepted* has been added See the full pull-request at https://github.com/SSSD/sssd/pull/11

1 0

[sssd PR#11] SECRETS: Don't remove a container when it has children (comment)
by fidencio 14 Sep '16

14 Sep '16

jhrozek commented on a pull request """ The first patch was already pushed. The second looks good to me visually and I wrote a simple patch to verify the fix: https://github.com/jhrozek/sssd/commit/374eff89472a3181548495ed74deadaa690e… """ See the full comment at https://github.com/SSSD/sssd/pull/11#issuecomment-246967824

1 0

[sssd PR#22] In commit c420ce830ac0b0b288a2a887ec2cfce5c748018c we changed a way how we (opened)
by fidencio 14 Sep '16

14 Sep '16

jhrozek's pull request #22: "In commit c420ce830ac0b0b288a2a887ec2cfce5c748018c we changed a way how we" was opened PR body: """ 'try a next server' in order to fix https://fedorahosted.org/sssd/ticket/3009. But since this change, results that return adminlimit exceeded (11) also mark the connection as offline. I think the best way is to special-case the LDAP error. """ See the full pull-request at https://github.com/SSSD/sssd/pull/22 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/22/head:pr22 git checkout pr22

1 12

[sssd PR#11] SECRETS: Don't remove a container when it has children (-Changes requested)
by fidencio 14 Sep '16

14 Sep '16

fidencio's pull request #11: "SECRETS: Don't remove a container when it has children" label *Changes requested* has been removed See the full pull-request at https://github.com/SSSD/sssd/pull/11

1 0

[PATCH] ini_augment: Use full path when reporting pattern mismatch
by Michal Židek 13 Sep '16

13 Sep '16

Hi, see the attached ding-libs patch for ticket #3166. This is how sssctl config-check prints the merging issues without this patch: Messages generated during configuration merging: 2 File blaa did not match provided patterns. Skipping. File /etc/sssd/conf.d/blaa.conf did not pass access check. Skipping. And with the patch: Messages generated during configuration merging: 2 File /etc/sssd/conf.d/blaa did not match provided patterns. Skipping. File /etc/sssd/conf.d/blaa.conf did not pass access check. Skipping. Michal

3 8

[PATCH] SECRETS: Search by the right type when checking containers
by Fabiano Fidêncio 13 Sep '16

13 Sep '16

We've been searching for the wrong type ("simple") in local_db_check_containers(), which always gives us a NULL result. Let's introduce the new LOCAL_CONTAINER_FILTER and do the search for the right type ("container") from now on. Resolves: https://fedorahosted.org/sssd/ticket/3137 Best Regards, -- Fabiano Fidêncio

2 2

[PATCH] SDAP: Fix settig paging attribute in sdap_get_generic_ext_send
by Lukas Slebodnik 13 Sep '16

13 Sep '16

ehlo, We should set pagging flag in state and not in local variable which is not read anywhere in the function. Found by clang static analyzer. Do we need this patch also to stable branch? LS

3 4

[sssd PR#15] Avoid returning System Error on clock skew (opened)
by fidencio 13 Sep '16

13 Sep '16

jhrozek's pull request #15: "Avoid returning System Error on clock skew" was opened PR body: """ Rather return ERR_NETWORK_IO and at least let the user authenticate offline. """ See the full pull-request at https://github.com/SSSD/sssd/pull/15 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/15/head:pr15 git checkout pr15

1 19

[sssd PR#23] sss_groupshow does not work with mpg (opened)
by fidencio 13 Sep '16

13 Sep '16

mzidek-rh's pull request #23: "sss_groupshow does not work with mpg" was opened PR body: """ We recently fixed this with normal groups. The MPG code path was still using shortname in sysdb search operation. Upstream ticket: https://fedorahosted.org/sssd/ticket/3184 """ See the full pull-request at https://github.com/SSSD/sssd/pull/23 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/23/head:pr23 git checkout pr23

1 4

[sssd PR#11] SECRETS: Don't remove a container when it has children (synchronize)
by fidencio 13 Sep '16

13 Sep '16

fidencio's pull request #11: "SECRETS: Don't remove a container when it has children" was synchronize See the full pull-request at https://github.com/SSSD/sssd/pull/11 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/11/head:pr11 git checkout pr11

1 0

MONITOR: Add disable_netlink sssd.conf option
by Justin Stephenson 12 Sep '16

12 Sep '16

Hello, The attached patches resolve https://fedorahosted.org/sssd/ticket/3142 However, I am having difficult with the man page addition to 'src/man/sssd.conf.5.xml' for this new option. I have stared at the open and close xml tags(for far too long) and it looks correct but when I build sssd I never see the sssd.conf man page inclusion. Could anyone tell me what I am missing here? If you feel there is better wording for the description please let me know. Kind regards, Justin Stephenson

4 17

[sssd PR#16] TOOLS: sss_groupshow did not work (opened)
by fidencio 12 Sep '16

12 Sep '16

mzidek-rh's pull request #16: "TOOLS: sss_groupshow did not work" was opened PR body: """ sss_groupshow used shortname to search in sysdb database. We have to u e sysdb_fqname (aka internal_fqname) format for all sysdb oprations. Resolves: https://fedorahosted.org/sssd/ticket/3175 """ See the full pull-request at https://github.com/SSSD/sssd/pull/16 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/16/head:pr16 git checkout pr16

1 11

[sssd PR#11] SECRETS: Don't remove a container when it has children (+Changes requested)
by fidencio 12 Sep '16

12 Sep '16

fidencio's pull request #11: "SECRETS: Don't remove a container when it has children" label *Changes requested* has been added See the full pull-request at https://github.com/SSSD/sssd/pull/11

1 0

[sssd PR#19] KRB5: Send the output username, not internal fqname to krb5_child (opened)
by fidencio 12 Sep '16

12 Sep '16

jhrozek's pull request #19: "KRB5: Send the output username, not internal fqname to krb5_child" was opened PR body: """ Resolves: https://fedorahosted.org/sssd/ticket/3172 krb5_child calls krb5_kuserok() during the access phase which checks if a particular user is allowed to authenticate as a particular principal. We used to pass the internal fqname to krb5_kuserok() which broke the functionality and all users were denied access. This patch changes that to send the 'output' username to krb5_child, because that's the username the system receives through getpwnam() or getpwuid() anyway. The patch also adds a new structure member fo the krb5child_req structure to avoid reusing the pd->user variable but have an explicit one that serves as the input for the child process. """ See the full pull-request at https://github.com/SSSD/sssd/pull/19 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/19/head:pr19 git checkout pr19

1 7

[sssd PR#18] [PATCHES] sss_user/groupmod fixes (opened)
by fidencio 12 Sep '16

12 Sep '16

mzidek-rh's pull request #18: "[PATCHES] sss_user/groupmod fixes" was opened PR body: """ Hi, This PR is blocked by PR#16 (TOOLS: sss_groupshow did not work). It includes fix for the ticket https://fedorahosted.org/sssd/ticket/3178. Michal """ See the full pull-request at https://github.com/SSSD/sssd/pull/18 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/18/head:pr18 git checkout pr18

1 8

[sssd PR#11] SECRETS: Don't remove a container when it has children (synchronize)
by fidencio 09 Sep '16

09 Sep '16

fidencio's pull request #11: "SECRETS: Don't remove a container when it has children" was synchronize See the full pull-request at https://github.com/SSSD/sssd/pull/11 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/11/head:pr11 git checkout pr11

1 0

[PATCH] failover: proceed normally when no new server is found
by Pavel Březina 08 Sep '16

08 Sep '16

https://fedorahosted.org/sssd/ticket/3131 I couldn't reproduce manually so I used the second patch as a by-code reproducer. If you apply the patch then sssd will try to resolve meta server twice simultaneously and triggering the problematic code path. You can search for RESOLV SRV DONE in logs.

2 1

[sssd PR#14] Attempting to create a qualified name from a NULL pointer broke sss_groupadd (opened)
by fidencio 07 Sep '16

07 Sep '16

jhrozek's pull request #14: "Attempting to create a qualified name from a NULL pointer broke sss_groupadd" was opened PR body: """ The log said: (Tue Sep 6 15:18:31:935105 2016) [sss_groupadd] [sysdb_timestamp_cache_connect] (0x0400): No timestamp cache for LOCAL (Tue Sep 6 15:18:31:935255 2016) [sss_groupadd] [sss_names_init_from_args] (0x0100): Using re [(?P<name>[^@]+)@?(?P<domain>[^@]*$)]. (Tue Sep 6 15:18:31:935277 2016) [sss_groupadd] [sss_fqnames_init] (0x0100): Using fq format [%1$s@%2$s]. (Tue Sep 6 15:18:31:935392 2016) [sss_groupadd] [parse_name_domain] (0x0200): Parsed username: group10000 (Tue Sep 6 15:18:31:935418 2016) [sss_groupadd] [ldb] (0x4000): start ldb transaction (nesting: 0) (Tue Sep 6 15:18:31:935504 2016) [sss_groupadd] [ldb] (0x4000): cancel ldb transaction (nesting: 0) (Tue Sep 6 15:18:31:935629 2016) [sss_groupadd] [main] (0x0020): sysdb operation failed (12)[Cannot allocate memory] """ See the full pull-request at https://github.com/SSSD/sssd/pull/14 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/14/head:pr14 git checkout pr14

1 15

Getting overridden shell in pam_sss
by Nikolai Kondrashov 07 Sep '16

07 Sep '16

Hi Sumit, Now I'm again approaching the implementation of tlog integration in pam_sss, and as planned, I need to get the actual user shell to put it into TLOG_REC_SHELL environment variable upon opening of the session. However, the get_shell_override, which does all the hops and tricks to get it, requires nss_ctx, which belongs to NSS responder, specifically various shell-related configuration settings (override_shell/allowed_shells/vetoed_shells/etc_shells). I.e. essentially the PAM responder needs to be an NSS responder to get it. To me it seems that there is no exit but to finally put that override machinery into a library, instead of having it directly in the NSS responder. Am I wrong? Is there perhaps another way? Do you have any suggestion how to best do it? Thanks a lot! Nick

3 6

My development scripts
by Pavel Březina 07 Sep '16

07 Sep '16

Hi folks, while converting my workflow scripts to github [1] I decided to polish them, give them some help and publish them on github. Feel free to use them and improve them as you wish. I'll gladly learn about your workflow and simplification. [1] https://github.com/pbrezina/sssd-dev-utils

1 0

[sssd PR#10] UTIL: Remove support to libini older than 1.0.0 (comment)
by fidencio 07 Sep '16

07 Sep '16

jhrozek commented on a pull request """ On Tue, Sep 06, 2016 at 11:49:09AM -0700, lslebodn wrote: > IMHO, it might be better to close this PR. > If we decide to dor support for libini_config < 1.1 or 1.2 > then it will be a different patch anyway. @see my previous comment The only reason I suggest deferred over closing is that if we close this PR, we will never remember to ressurect it. If it's going to be deferred, it will keep coming up in the PR list. """ See the full comment at https://github.com/SSSD/sssd/pull/10#issuecomment-245204278

1 0

[sssd PR#10] UTIL: Remove support to libini older than 1.0.0 (comment)
by fidencio 07 Sep '16

07 Sep '16

lslebodn commented on a pull request """ IMHO, it might be better to close this PR. If we decide to dor support for libini_config < 1.1 or 1.2 then it will be a different patch anyway. @see my previous comment """ See the full comment at https://github.com/SSSD/sssd/pull/10#issuecomment-245050796

4 5

[sssd PR#10] UTIL: Remove support to libini older than 1.0.0 (+deferred)
by fidencio 06 Sep '16

06 Sep '16

fidencio's pull request #10: "UTIL: Remove support to libini older than 1.0.0" label *deferred* has been added See the full pull-request at https://github.com/SSSD/sssd/pull/10

1 0

[sssd PR#10] UTIL: Remove support to libini older than 1.0.0 (comment)
by fidencio 06 Sep '16

06 Sep '16

jhrozek commented on a pull request """ On Tue, Sep 06, 2016 at 05:16:00AM -0700, fidencio wrote: > The distributions that would break with this patch are: > - RHEL/CentOS 5 and older I don't think we care about RHEL-5 with master and I'm not sure sssd master even builds there. > - Debian Wheezy (from 2013) and older OK, this one I think we care about for the basic functionality: 7.0 Wheezy May 4th 2013 April 26th 2016 (full) / May 2018 (LTS) But LTS means bug fixes and for those I think sssd-1-13 would be OK. > - Ubuntu 12.04 LTS and older 12.04 is often used (for example travis-ci still offers only this distro) and ends its life in 2017. On one hand, it's unlikely that users of LTS distributions will run master, they will probably only run sssd-1-13 or some PPAs, on the other hand, I don't see too much value except for cleaner code. So all in all I suggest we nack this patchset for now and push it when Ubuntu 12.04 goes EOL. Does that sound like a reasonable compromise? """ See the full comment at https://github.com/SSSD/sssd/pull/10#issuecomment-244935329

2 1

[sssd PR#10] UTIL: Remove support to libini older than 1.0.0 (comment)
by fidencio 06 Sep '16

06 Sep '16

lslebodn commented on a pull request """ On (06/09/16 05:16), fidencio wrote: >The distributions that would break with this patch are: >- RHEL/CentOS 5 and older >- Debian Wheezy (from 2013) and older >- Ubuntu 12.04 LTS and older > >I was not able to find what's the version of the package on SLES > * libini_config-0.7.0 is feature wise the same as libini_config-1.0 sssd uses it for basic parsing of ini files * libini_config-1.1 is an optional feature used in ad provider for parsing gpo files * libini_config-1.2 provides optional feature for config snippets in /etc/sssd/conf.d * libini_config-1.3 provides optional feature for validation of ini files After this patch we still have 3 optional features provided by different versions of libini_config. If we want to drop support for older version of libini_config and siplify the wrapper then I would drop support for libini_config < 1.3 and remove wrappers in src/util/sss_ini.c However, libini_config-1.3 is only in fedora. LS """ See the full comment at https://github.com/SSSD/sssd/pull/10#issuecomment-244937445

1 0

[sssd PR#10] UTIL: Remove support to libini older than 1.0.0 (comment)
by fidencio 06 Sep '16

06 Sep '16

fidencio commented on a pull request """ The distributions that would break with this patch are: - RHEL/CentOS 5 and older - Debian Wheezy (from 2013) and older - Ubuntu 12.04 LTS and older I was not able to find what's the version of the package on SLES """ See the full comment at https://github.com/SSSD/sssd/pull/10#issuecomment-244932095

1 0

[sssd PR#10] UTIL: Remove support to libini older than 1.0.0 (comment)
by fidencio 06 Sep '16

06 Sep '16

jhrozek commented on a pull request """ On Thu, Sep 01, 2016 at 09:01:54AM -0700, lslebodn wrote: > On (01/09/16 08:35), fidencio wrote: > >On Thu, Sep 1, 2016 at 2:10 PM, lslebodn <notifications(a)github.com> wrote: > > > >> On (01/09/16 04:32), Jakub Hrozek wrote: > >> >On Thu, Sep 01, 2016 at 03:21:06AM -0700, fidencio wrote: > >> >> On Thu, Sep 1, 2016 at 11:54 AM, lslebodn <notifications(a)github.com> > >> wrote: > >> >> > > >> >> > On (31/08/16 23:18), fidencio wrote: > >> >> > >libini 1.0.0 is part of ding-libs 0.3.0 and has been around since > >> 2013. > >> >> > >Even the old systems that we have to support already have a newer > >> >> > >version of the library. RHEL6, for instance, has ding-libs 0.4.0 > >> which > >> >> > >provides libinit 1.1.0. > >> >> > > > >> >> > >By removing this code we also can stop depending on libcollection. > >> >> > > > >> >> > >Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> > >> >> > >You can view, comment on, or merge this pull request online at: > >> >> > > > >> >> > > https://github.com/SSSD/sssd/pull/10 > >> >> > > > >> >> > >-- Commit Summary -- > >> >> > > > >> >> > > * UTIL: Remove support to libini older than 1.0.0 > >> >> > > > >> >> > >-- File Changes -- > >> >> > > > >> >> > > M configure.ac (1) > >> >> > > M contrib/ci/deps.sh (1) > >> >> > > M contrib/sssd.spec.in (1) > >> >> > > D src/external/libcollection.m4 (9) > >> >> > > M src/util/sss_ini.c (97) > >> >> > > > >> >> > >-- Patch Links -- > >> >> > > > >> >> > >https://github.com/SSSD/sssd/pull/10.patch > >> >> > >https://github.com/SSSD/sssd/pull/10.diff > >> >> > > > >> >> > OpenSUSE LEAP has just ding-libs 0.3.0.1 in official repositories. > >> >> > http://software.opensuse.org/package/ding-libs?search_term=ding-libs > >> >> > >> >> Yep. OpenSUSE LEAP has 0.3.0.1, Debian Stable (Jessie) has 0.4.0, > >> >> latest Ubuntu LTS has 0.5.0. > >> >> And all of them would be able to build SSSD with my patch without any > >> issues. > >> > > >> >Two questions: > >> > 1) how long until the distributions with too old ding-libs go out of > >> > support? > >> > > > >Hmm. Unfortunately I don't have an answer for you. > >What are the major distributions that we want to support? Debian, Ubuntu > >LTS, RHEL, SLES ...? > > > I would prefer if limited version of sssd (ldap + krb5 provider) > could be compiled almost anywhere. (even old distributions) > It is not only about major distributions. > > > > >> > 2) since we will be (likely) supporting sssd-1-13 for the lifetime > >> > of RHEL-6, can we say that the old distributions just use sssd-1-13? > >> > > >> libini_config-1.0 does not provide any new functionality > >> which is not in libini_config < 1.0 > >> > > > >> They have just a different API (and moreover libini_config-1.0 > >> still provides old API) (at least from sssd POV) > >> > > > >There's no new functionality, true. But there's a quite good API > >simplification > I agree that API is better. > But feature wise are the same. So if we wanted to drop > support for libini_config < 1.0 then we could > drop support for libini_config-1.0. > It would simplify more things in sssd > > However, OpenSUSE LEAP has just a libini_config-1.0 This PR has stalled somehow. Can we either move it forward or reject? I admit I got a bit lost in the comments, which distributions would we break with this patch? Are any of them supported/will be supported in th near future? """ See the full comment at https://github.com/SSSD/sssd/pull/10#issuecomment-244928774

1 0

[PATCH SYSDB: Fix handling of version in sysdb_cache_connect_helper
by Lukas Slebodnik 02 Sep '16

02 Sep '16

ehlo, Clang static analyzer assume that ldb_search can found 0 entries in the tree "cn=sysdb". Thenvariable version could be used uninitialized. We cannot get to such state in sssd but we already handle a case for more then one entry. LS

3 7

[sssd PR#11] SECRETS: Don't remove a container when it has children (edited)
by fidencio 02 Sep '16

02 Sep '16

fidencio's pull request #11: "SECRETS: Don't remove a container when it has children" was edited See the full pull-request at https://github.com/SSSD/sssd/pull/11 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/11/head:pr11 git checkout pr11

1 0

[sssd PR#11] SECRETS: Don't remove a container when it has children (synchronize)
by fidencio 02 Sep '16

02 Sep '16

fidencio's pull request #11: "SECRETS: Don't remove a container when it has children" was synchronize See the full pull-request at https://github.com/SSSD/sssd/pull/11 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/11/head:pr11 git checkout pr11

1 0

[sssd PR#11] SECRETS: Don't remove a container when it has children (edited)
by fidencio 02 Sep '16

02 Sep '16

fidencio's pull request #11: "SECRETS: Don't remove a container when it has children" was edited See the full pull-request at https://github.com/SSSD/sssd/pull/11 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/11/head:pr11 git checkout pr11

1 0

[sssd PR#11] SECRETS: Don't remove a container when it has children (synchronize)
by fidencio 02 Sep '16

02 Sep '16

fidencio's pull request #11: "SECRETS: Don't remove a container when it has children" was synchronize See the full pull-request at https://github.com/SSSD/sssd/pull/11 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/11/head:pr11 git checkout pr11

1 0

[sssd PR#10] UTIL: Remove support to libini older than 1.0.0 (comment)
by fidencio 02 Sep '16

02 Sep '16

lslebodn commented on a pull request """ On (01/09/16 08:35), fidencio wrote: >On Thu, Sep 1, 2016 at 2:10 PM, lslebodn <notifications(a)github.com> wrote: > >> On (01/09/16 04:32), Jakub Hrozek wrote: >> >On Thu, Sep 01, 2016 at 03:21:06AM -0700, fidencio wrote: >> >> On Thu, Sep 1, 2016 at 11:54 AM, lslebodn <notifications(a)github.com> >> wrote: >> >> > >> >> > On (31/08/16 23:18), fidencio wrote: >> >> > >libini 1.0.0 is part of ding-libs 0.3.0 and has been around since >> 2013. >> >> > >Even the old systems that we have to support already have a newer >> >> > >version of the library. RHEL6, for instance, has ding-libs 0.4.0 >> which >> >> > >provides libinit 1.1.0. >> >> > > >> >> > >By removing this code we also can stop depending on libcollection. >> >> > > >> >> > >Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> >> >> > >You can view, comment on, or merge this pull request online at: >> >> > > >> >> > > https://github.com/SSSD/sssd/pull/10 >> >> > > >> >> > >-- Commit Summary -- >> >> > > >> >> > > * UTIL: Remove support to libini older than 1.0.0 >> >> > > >> >> > >-- File Changes -- >> >> > > >> >> > > M configure.ac (1) >> >> > > M contrib/ci/deps.sh (1) >> >> > > M contrib/sssd.spec.in (1) >> >> > > D src/external/libcollection.m4 (9) >> >> > > M src/util/sss_ini.c (97) >> >> > > >> >> > >-- Patch Links -- >> >> > > >> >> > >https://github.com/SSSD/sssd/pull/10.patch >> >> > >https://github.com/SSSD/sssd/pull/10.diff >> >> > > >> >> > OpenSUSE LEAP has just ding-libs 0.3.0.1 in official repositories. >> >> > http://software.opensuse.org/package/ding-libs?search_term=ding-libs >> >> >> >> Yep. OpenSUSE LEAP has 0.3.0.1, Debian Stable (Jessie) has 0.4.0, >> >> latest Ubuntu LTS has 0.5.0. >> >> And all of them would be able to build SSSD with my patch without any >> issues. >> > >> >Two questions: >> > 1) how long until the distributions with too old ding-libs go out of >> > support? >> > >Hmm. Unfortunately I don't have an answer for you. >What are the major distributions that we want to support? Debian, Ubuntu >LTS, RHEL, SLES ...? > I would prefer if limited version of sssd (ldap + krb5 provider) could be compiled almost anywhere. (even old distributions) It is not only about major distributions. > >> > 2) since we will be (likely) supporting sssd-1-13 for the lifetime >> > of RHEL-6, can we say that the old distributions just use sssd-1-13? >> > >> libini_config-1.0 does not provide any new functionality >> which is not in libini_config < 1.0 >> > >> They have just a different API (and moreover libini_config-1.0 >> still provides old API) (at least from sssd POV) >> > >There's no new functionality, true. But there's a quite good API >simplification I agree that API is better. But feature wise are the same. So if we wanted to drop support for libini_config < 1.0 then we could drop support for libini_config-1.0. It would simplify more things in sssd However, OpenSUSE LEAP has just a libini_config-1.0 >and we can stop depending on libcollection. > libini_config-devel depends on libcollection-devel :-) and it's a very tiny dependency. sh$ rpm -q --requires libini_config-devel /usr/bin/pkg-config libbasicobjects-devel = 0.1.1-29.fc25 libcollection-devel = 0.7.0-29.fc25 libini_config = 1.3.0-29.fc25 libini_config.so.5()(64bit) libref_array-devel = 0.1.5-29.fc25 pkgconfig(basicobjects) pkgconfig(collection) pkgconfig(ref_array) rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(FileDigests) <= 4.6.0-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(PayloadIsXz) <= 5.2-1 We would not reduce our dependency chain. LS """ See the full comment at https://github.com/SSSD/sssd/pull/10#issuecomment-244127101

1 0

[sssd PR#11] SECRETS: Don't remove a container when it has children (synchronize)
by fidencio 01 Sep '16

01 Sep '16

fidencio's pull request #11: "SECRETS: Don't remove a container when it has children" was synchronize See the full pull-request at https://github.com/SSSD/sssd/pull/11 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/11/head:pr11 git checkout pr11

1 0

[RFC] Cleaning up the IFP responder (mainly) and socket-activatable responders
by Fabiano Fidêncio 01 Sep '16

01 Sep '16

Howdy! Taking a look on https://fedorahosted.org/sssd/ticket/2395 seems that there are a few ways to achieve what's proposed by Simo and I'd like to discuss one of those before start implementing it. As far as I understand the bug, SSSD cannot be run as a non-root user because of IFP responder, which needs to be run as root in order to write to sssd.conf file. Simo's suggestion was to create a new service, which should be socket-activated, to handle this writing to sssd.conf part and Jakub's suggested to completely get rid of this part. However, Dmitri pointed out that we must have some service playing with sssd.conf as it's the way that cockpit and ansible can remotely manage the SSSD configuration. Okay, in order to actually start solving the issue I'd like to propose the follow steps: 1) Create a new service, still explicitly enabled in sssd.conf, that would take care of the managing the SSSD configuration. 2) Get rid of the code dealing with the SSSD configuration from the IFP responder. 3) Get rid of the OpenLMI specific code from the IFP responder Till this point the problem wasn't solved at all, but those seem to be the logical steps in order to make our own lives easier for working in the next two steps. 4) Make the new service (created in 1) socket-activated/bus-activated. 5) Make the IFP responder also bus-activated/socket-activated. So, does it sound like a reasonable way to approach the problem? If yes, I'd like to ask a few questions, mainly about items 4 and 5, as it eems that in order to achieve what we want, https://fedorahosted.org/sssd/ticket/2243 and https://fedorahosted.org/sssd/ticket/3129 have to be solved together, which seems to be a not so small task. So, do we have to care about systems that don't have systemd support? IOW, do we have to keep the current code and also add socket-activation? If yes, would it be explicitly enabled/disabled on configure time? Maybe a lame question, but what are the advantages of the socket-activation over the bus-activation approach (I still didn't look at any of those :-\)? Thanks in advance, -- Fabiano Fidêncio

4 3

[sssd PR#9] SYSDB: Removing of unused parametr (opened)
by fidencio 01 Sep '16

01 Sep '16

celestian's pull request #9: "SYSDB: Removing of unused parametr" was opened PR body: """ There were unused parameter struct ldb_message *cached_group in sysdb_store_group_attrs(). This parameter was introduced by 40de79d69860ec7f04bf7795bd88b641ec42fd23 SYSDB: Check if group attributes differ before saving a group """ See the full pull-request at https://github.com/SSSD/sssd/pull/9 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/9/head:pr9 git checkout pr9

1 5

[sssd PR#7] Fix initgroups with nested groups (+pushed)
by fidencio 01 Sep '16

01 Sep '16

sumit-bose's pull request #7: "Fix initgroups with nested groups" label *pushed* has been added See the full pull-request at https://github.com/SSSD/sssd/pull/7

1 0

[sssd PR#8] MAN: Document the ldap_user_gid_number option (opened)
by fidencio 01 Sep '16

01 Sep '16

jhrozek's pull request #8: "MAN: Document the ldap_user_gid_number option" was opened PR body: """ Some users, mostly those who cannot join the Linux machines to their AD domain resort to using the LDAP provider with ID mapping. But in order for that to work correctly, the ldap_user_gid_number option must be set correctly, otherwise SSSD complains about not finding the primary GID: (Fri Aug 26 13:34:10 2016) [sssd[be[dev]]] [sdap_save_user] (0x0020): Cannot get the GID for [someuser] in domain [extdev]. """ See the full pull-request at https://github.com/SSSD/sssd/pull/8 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/8/head:pr8 git checkout pr8

1 5

[sssd PR#7] Fix initgroups with nested groups (closed)
by fidencio 01 Sep '16

01 Sep '16

sumit-bose's pull request #7: "Fix initgroups with nested groups" was closed See the full pull-request at https://github.com/SSSD/sssd/pull/7 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/7/head:pr7 git checkout pr7

1 0

[sssd PR#7] Fix initgroups with nested groups (comment)
by fidencio 01 Sep '16

01 Sep '16

jhrozek commented on a pull request """ * master: 5bd3bef4a655fdfacd2f5df8a2343fe7bc68a771 """ See the full comment at https://github.com/SSSD/sssd/pull/7#issuecomment-244058146

1 0

[sssd PR#7] Fix initgroups with nested groups (comment)
by fidencio 01 Sep '16

01 Sep '16

jhrozek commented on a pull request """ On Wed, Aug 31, 2016 at 07:15:10AM -0700, lslebodn wrote: > On (31/08/16 01:47), sumit-bose wrote: > >On Wed, Aug 31, 2016 at 01:30:12AM -0700, Jakub Hrozek wrote: > >> On Wed, Aug 31, 2016 at 12:36:37AM -0700, sumit-bose wrote: > >> > On Tue, Aug 30, 2016 at 12:36:20PM -0700, Jakub Hrozek wrote: > >> > > On Tue, Aug 30, 2016 at 11:47:09AM -0700, lslebodn wrote: > >> > > > >> > > About the discussion I saw on #sssd in backscroll, the rfc2307bis schema > >> > > only uses the member attribute because IIRC the RFC doesn't talk about > >> > > memberof at all. But in IPA, we know the specifics on the schema, so we > >> > > are able to dereference the memberof attribute to get a complete list of > >> > > all groups with one call. > >> > > >> > Unfortunately it is more complicated with IPA because memberOf only > >> > contains the direct memberships, there is a second attribute > >> > memberofindirect which hold the indirect memberships. > >> > >> This is only how IPA UI displays indirect memberships, if you check the > >> memberships with ldapsearch, you'll see it's really only memberof. > > > >bummer, you are right, I thought the --raw option of ipa user-show really > >means 'raw' but it looks some of the values are still processed. > > > >Sorry for the noise. > > > I haven't found any regression caused by this patch. > So at least; issues in ipa-trust test are not caused by this bug. > CI: http://sssd-ci.duckdns.org/logs/job/52/88/summary.html """ See the full comment at https://github.com/SSSD/sssd/pull/7#issuecomment-244052286

1 0

[PATCH] DEBUG: Apend line feed to messages from libsemanage
by Lukas Slebodnik 01 Sep '16

01 Sep '16

ehlo, @see (Wed Aug 31 14:12:18 2016) [[sssd[selinux_child[7088]]]] [libsemanage] (0x0020): could not query record value(Wed Aug 31 14:12:18 2016) [[sssd[selinux_child[7088]]]] [get_seuser] (0x0020): Cannot query for dennis (Wed Aug 31 14:12:18 2016) [[sssd[selinux_child[7088]]]] [seuser_needs_update] (0x2000): get_seuser: ret: 5 seuser: unknown mls: unknown (Wed Aug 31 14:12:30 2016) [[sssd[selinux_child[7088]]]] [libsemanage] (0x0020): setfiles returned error code 1.(Wed Aug 31 14:12:33 2016) [[sssd[selinux_child[7088]]]] [libsemanage] (0x0020): setfiles returned error code 1.(Wed Aug 31 14:12:33 2016) [[sssd[selinux_child[7088]]]] [set_seuser] (0x0020): Cannot commit SELinux transaction (Wed Aug 31 14:12:33 2016) [[sssd[selinux_child[7088]]]] [main] (0x0020): Cannot set SELinux login context. LS

2 2

[sssd PR#10] UTIL: Remove support to libini older than 1.0.0 (edited)
by fidencio 01 Sep '16

01 Sep '16

fidencio's pull request #10: "UTIL: Remove support to libini older than 1.0.0" was edited See the full pull-request at https://github.com/SSSD/sssd/pull/10 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/10/head:pr10 git checkout pr10

1 0

[PATCH] GPO: Cat vals with same key from different GPOs
by Michal Židek 01 Sep '16

01 Sep '16

Hi, here is patch for ticket #3161. See more in the ticket description. I was thinking why we originally replaced the lists and I think it comes from confusion on how we handle the same keys in single GPO ini file, however that is handled by libini not by SSSD. Michal

6 7

[sssd PR#10] UTIL: Remove support to libini older than 1.0.0 (synchronize)
by fidencio 01 Sep '16

01 Sep '16

fidencio's pull request #10: "UTIL: Remove support to libini older than 1.0.0" was synchronize See the full pull-request at https://github.com/SSSD/sssd/pull/10 ... or pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/10/head:pr10 git checkout pr10

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel September 2016