sssd-devel February 2017

sssd-devel@lists.fedorahosted.org

10 participants
61 discussions

[sssd PR#138][opened] IPA: Skip conflict entries associated with sudo rules
by fidencio 07 Feb '17

07 Feb '17

URL: https://github.com/SSSD/sssd/pull/138 Author: justin-stephenson Title: #138: IPA: Skip conflict entries associated with sudo rules Action: opened PR body: """ SSSD retrieves sudo rule information from the IPA LDAP tree, conflict entries will cause problems for SSSD and disallow sudo access when SSSD code is parsing entries associated with sudo rules. This PR sets a skip_entry boolean when it is appropriate and skips over these conflict entries. Ticket: https://fedorahosted.org/sssd/ticket/3288 Reproducer steps: Create host conflict entry and associate it with a sudo rule that is assigned to certain hosts, attempt to sudo as IDM user. I had some difficulty attempting to force replication issues causing the creation of a conflict entry, the below manual ldapmodify steps will work also: - Retrieve the DN of the sudoRule `# ipa sudorule-find --all --raw | grep 'dn: ' dn: ipaUniqueID=e9025c46-ddab-11e6-9096-525400af7498,cn=sudorules,cn=sudo,dc=jstephen,dc=local` - Run ldapmodify similar to below dn: ipaUniqueID=e9025c46-ddab-11e6-9096-525400af7498,cn=sudorules,cn=sudo,dc=jstephen,dc=local changetype: modify add: memberHost memberHost: fqdn=testhost.jstephen.local+nsuniqueid=cb3d7383-ddb511e6-8c9996c1-71a1e36a,cn=computers,cn=accounts,dc=jstephen,dc=local """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/138/head:pr138 git checkout pr138

4 21

[sssd PR#108][opened] Partially revert "CONFIG: Use default config when none provided"
by fidencio 07 Feb '17

07 Feb '17

URL: https://github.com/SSSD/sssd/pull/108 Author: lslebodn Title: #108: Partially revert "CONFIG: Use default config when none provided" Action: opened PR body: """ This reverts part of commit 59744cff6edb106ae799b2321cb8731edadf409a. Removed is copying of default configuration into /etc/sssd/sssd.conf Sample configurations is still part of installation. Copying default configuration from /usr/lib64/sssd/conf/sssd.conf -> /etc/sssd/sssd.conf is not the best idea. There are better way how to use default configuration and we will need to change anyway due to files provider. I can revert sample configuration as well. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/108/head:pr108 git checkout pr108

3 6

[sssd PR#148][opened] SYSTEMD: Update journald drop-in file
by lslebodn 07 Feb '17

07 Feb '17

URL: https://github.com/SSSD/sssd/pull/148 Author: lslebodn Title: #148: SYSTEMD: Update journald drop-in file Action: opened PR body: """ We changed type forking into type notify as part of commit d4063e9a21a4e203bee7e0a0144fa8cabb14cc46. But we forgot to update template drop-in file for logging into journald. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/148/head:pr148 git checkout pr148

2 8

[sssd PR#147][opened] IFP: Update ifp_iface_generated.c
by fidencio 07 Feb '17

07 Feb '17

URL: https://github.com/SSSD/sssd/pull/147 Author: fidencio Title: #147: IFP: Update ifp_iface_generated.c Action: opened PR body: """ These changes are leftovers from commit 78b4b7e. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/147/head:pr147 git checkout pr147

3 10

[sssd PR#112][opened] FAILOVER: Improve port status log messages
by fidencio 06 Feb '17

06 Feb '17

URL: https://github.com/SSSD/sssd/pull/112 Author: justin-stephenson Title: #112: FAILOVER: Improve port status log messages Action: opened PR body: """ This PR is created to ensure administrators do not follow the wrong path troubleshooting issues, especially with messages such as: `Port status of port 636 for server 'server' is 'not working'` This patch should help to clarify that there is no direct relationship between port status and actual networking status. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/112/head:pr112 git checkout pr112

2 17

[sssd PR#142][opened] Fix breakage caused by having the NSS responder socket-activated
by fidencio 04 Feb '17

04 Feb '17

URL: https://github.com/SSSD/sssd/pull/142 Author: fidencio Title: #142: Fix breakage caused by having the NSS responder socket-activated Action: opened PR body: """ **MONITOR: Don't return an error in case we fail to register a service** This patch is a pre-requisite for the next one and both patches could be squashed. Although, I've decided to keep this patch separated as it brings back a behaviour that has been used before the socket-activation series. **MONITOR: Avoid starting an already started service** This patch basically prevents that we end up socket-activating (or systemd enabling) a service that has been explicitly enabled in the services' line. **NSS: Make sssd-nss.service a hard requirement** This patch takes a step back and do not allow the NSS responder to be socket-activated. Instead, it's added as a hard requirement for SSSD (in sssd.service) and will be running whenever SSSD is running. Thankfully to our previous patch we ensure that the only one instance of the responder will be running. So, if nss is not present in the services' line, it will be started as a dep. In case it's part of the services' line, it will be started by the monitor and later on started by systemd. The second instance will be killed during the services' registration part. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/142/head:pr142 git checkout pr142

1 6

sssd-1.14.3 milestone cleanup
by Jakub Hrozek 02 Feb '17

02 Feb '17

Hi, despite new development happening in the sssd-1-15 branch (aka master), there are still too many tickets in the 1.14.3 milestone. The tickets should be moved out to current milestones unless someone is really working on them. These are: * https://fedorahosted.org/sssd/ticket/3063 - add an integration test for the configuration include directories - would it be enough to have two users in two search bases and drop a snippet with the second base, then try to resolve a user? If yes, this is a one-hour effort, any takers? If not, move to CI milestone - Lukas said there would be issue with integration test would be how to detect whether libini_config suports it (rhel6 does not support it). Therefore I suggest we move the ticket to CI milestone. * https://fedorahosted.org/sssd/ticket/3085 - looks fixed in https://git.fedorahosted.org/cgit/sssd.git/commit/?id=11540d9efb85b9ed0341e… OK to close? - Lukas already added a +1 last week on our meeting, so I'll probably close the ticket. * https://fedorahosted.org/sssd/ticket/3197 - add a line to sssd-ad man page on how does the POSIX attrs in GC work - Someone suggested reverting the logic for POSIX-attrs-in-GC lately, but I forgot the details, does anyone remember? Otherwise this is a 5-minute patch, so I suggest just closing it. * https://fedorahosted.org/sssd/ticket/3208 - Need detailed information about config-check option - what is this ticket about? Do we need it? I suggest we just close it * https://fedorahosted.org/sssd/ticket/3222 - sssd still showing ipa user after removed from last group - unless anyone is actively working on the ticket, just move to patches welcome * https://fedorahosted.org/sssd/ticket/2554 - Update spec file according to updated guidelines - Unless anyone would like to clean up our reference upstream specfile, I suggest we close the ticket * https://fedorahosted.org/sssd/ticket/3113 - Please move sudo_timed option to sssd-sudo man page - 5 minutes patch and George is unlikely to send a patch, any takers? * https://fedorahosted.org/sssd/ticket/3074 - Move timestamp cache to tmpfs * https://fedorahosted.org/sssd/ticket/3097 - Measure the difference between tmpfs database and NOSYNC database - tmpfs provides very little benefit, close with an explanation After this milestone is cleaned up, I'll finally populate the 1.15 Beta milestone..

5 11

[sssd PR#126][opened] ldap_child: Fix use after free
by fidencio 01 Feb '17

01 Feb '17

URL: https://github.com/SSSD/sssd/pull/126 Author: lslebodn Title: #126: ldap_child: Fix use after free Action: opened PR body: """ In case on any krb5 related error, we tried to send string interpretation of krb5 error tb parrent in prepare_response. However, we cannot use global krb5 context (krb5_error_ctx) because the context is every time released in done section of ldap_child_get_tgt_sync. This patch rather return duplicated string to prevent use after free. Backtrace: ``` #0 __strchr_sse42 () at ../sysdeps/x86_64/multiarch/strchr.S:100 100 ../sysdeps/x86_64/multiarch/strchr.S: No such file or directory. Thread 1 (Thread 0x7fc96cad5880 (LWP 11201)): #0 __strchr_sse42 () at ../sysdeps/x86_64/multiarch/strchr.S:100 No locals. #1 0x00007fc96be43725 in err_fmt_fmt (msg=0x7fc96d1cf8d0 "Cannot find KDC for requested realm", code=-1765328230, err_fmt=<optimized out>) at kerrs.c:152 buf = {buftype = K5BUF_DYNAMIC, data = 0x7fc96d1cdb10, space = 128, len = 0} p = <optimized out> s = 0xdededededededede <Address 0xdededededededede out of bounds> #2 krb5_get_error_message (ctx=<optimized out>, code=code@entry=-1765328230) at kerrs.c:184 std = 0x7fc96d1cf8d0 "Cannot find KDC for requested realm" #3 0x00007fc96cb224e5 in sss_krb5_get_error_message (ctx=<optimized out>, ec=ec@entry=-1765328230) at src/util/sss_krb5.c:424 No locals. #4 0x00007fc96cb1fbb0 in prepare_response (rsp=<synthetic pointer>, kerr=-1765328230, expire_time=0, ccname=0x0, mem_ctx=0x7fc96d1cb390) at src/providers/ldap/ldap_child.c:553 ret = <optimized out> r = 0x7fc96d1cd8b0 krb5_msg = 0x0 ``` Related parts of logs: ``` [System Logs]: Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'FSERVER-1658118$(a)EXAMPLE.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Client 'FSERVER-1658118$(a)EXAMPLE.COM' not found in Kerberos database Jan 17 06:20:08 fserver-1658118.example.com kernel: traps: ldap_child[15788] general protection ip:7f7faf2e505a sp:7ffd3f768478 error:0 in libc-2.17.so[7f7faf260000+1b6000] Jan 17 06:20:08 fserver-1658118.example.com abrt-hook-ccpp[15793]: Process 15788 (ldap_child) of user 0 killed by SIGSEGV - dumping core [User Logs]: Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'FSERVER-1658118$(a)EXAMPLE.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection. Jan 17 06:20:08 fserver-1658118.example.com [sssd[ldap_child[15788]]][15788]: Client 'FSERVER-1658118$(a)EXAMPLE.COM' not found in Kerberos database Jan 17 06:20:08 fserver-1658118.example.com abrt-hook-ccpp[15793]: Process 15788 (ldap_child) of user 0 killed by SIGSEGV - dumping core ``` """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/126/head:pr126 git checkout pr126

1 5

[sssd PR#133][opened] sbus: use sss_ptr_hash for hash tables
by fidencio 01 Feb '17

01 Feb '17

URL: https://github.com/SSSD/sssd/pull/133 Author: pbrezina Title: #133: sbus: use sss_ptr_hash for hash tables Action: opened PR body: """ This patch reuses `sss_ptr_hash` module introduced in NSS patches in `sbus` code. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/133/head:pr133 git checkout pr133

1 13

[sssd PR#140][opened] gcc7 related fixes
by fidencio 01 Feb '17

01 Feb '17

URL: https://github.com/SSSD/sssd/pull/140 Author: lslebodn Title: #140: gcc7 related fixes Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/140/head:pr140 git checkout pr140

1 14

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel February 2017