sssd-devel March 2020

sssd-devel@lists.fedorahosted.org

5 participants
59 discussions

[sssd PR#988][opened] man: fix typos
by miztake 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/988 Author: miztake Title: #988: man: fix typos Action: opened PR body: """ - add whitespace between words - correct manpage reference - correct wrong word - capitalize the first letter """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/988/head:pr988 git checkout pr988

2 17

[sssd PR#997][opened] Fix sssd-ldap man page
by tscherf 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/997 Author: tscherf Title: #997: Fix sssd-ldap man page Action: opened PR body: """ The option 'ldap_default_authtok_type' also accepts non clear text passwords in the meantime. Signed-off-by: Thorsten Scherf <tscherf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/997/head:pr997 git checkout pr997

3 11

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by scabrero 04 Mar '20

04 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. scabrero commented: """ Fixed, I have skipped `sssd-ldap-attributes.5.xml` because other `ldap_*_entry_usn` are not there either. I have also fixed a couple of issues I found while working in the networks support. """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-594436135

1 0

KCM notifications
by Pavel Březina 03 Mar '20

03 Mar '20

Hi devs, I'm thinking about ways to implement SSSD KCM notification that something has changed (i.e. user called kinit/kdestroy) [1]. The main use case is to notify Gnome Online Accounts (which is a daemon running under logged-in user) when something has changed and it is already a D-Bus service. The basic idea is that we would use D-Bus signals that would be emitted by SSSD KCM responder (sssd_kcm process). Signals are broadcasted messages that are delivered to client that chose to listen to them. The problem is that we 1) can't connect to specific user's session bus because KCM runs as root/sssd and connecting to other user's bus is not allowed 2) can't specify which user is allowed to get the signal 3) therefore we can't send the signal only to specific user So the solution is that KCM connects to system bus and sends org.sssd.kcm.Changed(uid) signal where uid is uid of the user which ccache has changed so the receiver can know which user is affected. This signal is broadcasted to everyone who listens to it. It is perfectly usable, however the question is whether we can broadcast this information (that user A run kinit/kdestroy/other modification of ccache) or it is a security leak that we must avoid and we should seek other solution. I asked this secalert and they reply that there is no security concern "but": > After looking at this issue, honestly I dont see an attack vector here, but i am afraid something like this could be used with some other security flaw to maybe gain privesc? For example a flaw which is some component which can be triggered only when kinit is run? where precise timing is required. > > So in conclusion if there is another "better" solution than it should be preferred. Or in worse case atleast have an option to disable this somehow via some config, so that such situations can be avoided. I don't think a precise timing is necessary and we can send the signal few miliseconds or a second later. That should eliminate this concern (I asked this, waiting for an answer). I can think of two more solutions currently: 1) Have client connect to KCM socket and await signal there. This however would mean that connection between client and KCM need to be always established and KCM responder would be running all the time (currently it is only short-lived socket activated process). 2) Create a temporary file in a directory owned by user. User can then setup inotify watch to the file and sssd would write to the file on changes. Since it is in directory owned by user, other users would not be able to setup the watch. Note that it is possile to setup inotify watch on FILE ccache (keeping distro settings out of the question the default ccache is FILE:/tmp/krb5cc_%{uid} as per krb5.conf manpage) so perhaps we really don't have to care about broadcasting this information. Thanks, Pavel. [1] https://pagure.io/SSSD/sssd/issue/3568

6 13

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by sumit-bose 02 Mar '20

02 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. sumit-bose commented: """ Thanks, sorry for nitpicking, but `ldap_iphost_entry_usn` is still missing in some files: ``` $ git grep -E '(ldap_iphost_name|ldap_iphost_entry_usn)' ../ ../src/config/SSSDConfig/sssdoptions.py: 'ldap_iphost_name': _('IP host name attribute'), ../src/config/cfg_rules.ini:option = ldap_iphost_name ../src/config/etc/sssd.api.d/sssd-ad.conf:ldap_iphost_name = str, None, false ../src/config/etc/sssd.api.d/sssd-ldap.conf:ldap_iphost_name = str, None, false ../src/man/sssd-ldap-attributes.5.xml: <term>ldap_iphost_name (string)</term> ../src/providers/ad/ad_opts.c: { "ldap_iphost_name", "cn", SYSDB_NAME, NULL }, ../src/providers/ad/ad_opts.c: { "ldap_iphost_entry_usn", NULL, SYSDB_USN, NULL }, ../src/providers/ldap/ldap_opts.c: { "ldap_iphost_name", "cn", SYSDB_NAME, NULL }, ../src/providers/ldap/ldap_opts.c: { "ldap_iphost_entry_usn", NULL, SYSDB_USN, NULL }, ``` bye, Sumit """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-593489917

1 0

[sssd PR#918][comment] Add support for NSS hosts database lookup.
by scabrero 02 Mar '20

02 Mar '20

URL: https://github.com/SSSD/sssd/pull/918 Title: #918: Add support for NSS hosts database lookup. scabrero commented: """ Thanks, I should have noticed... All tests passing now. """ See the full comment at https://github.com/SSSD/sssd/pull/918#issuecomment-593451935

1 0

[sssd PR#970][opened] sss_ptr_hash: pass new hash_entry_t to custom delete callback
by alexey-tikhonov 02 Mar '20

02 Mar '20

URL: https://github.com/SSSD/sssd/pull/970 Author: alexey-tikhonov Title: #970: sss_ptr_hash: pass new hash_entry_t to custom delete callback Action: opened PR body: """ This is backport of f95db37aa8486304d0569d12a876b1c74ee1b0d1 amended with PR 968 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/970/head:pr970 git checkout pr970

2 23

[sssd PR#971][opened] AD: use getaddrinfo with AI_CANONNAME to find the FQDN
by scabrero 02 Mar '20

02 Mar '20

URL: https://github.com/SSSD/sssd/pull/971 Author: scabrero Title: #971: AD: use getaddrinfo with AI_CANONNAME to find the FQDN Action: opened PR body: """ In systems where gethostbyname() does not return the FQDN try calling getaddrinfo(). The same happened to adcli, fixed by https://gitlab.freedesktop.org/sbose/adcli/commit/85b835f8258a57e3b23de47a2… """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/971/head:pr971 git checkout pr971

5 22

[sssd PR#994][opened] sssd.spec: Add recommended packages
by mzidek-gh 02 Mar '20

02 Mar '20

URL: https://github.com/SSSD/sssd/pull/994 Author: mzidek-gh Title: #994: sssd.spec: Add recommended packages Action: opened PR body: """ sssd-dbus is recommended for tools and SSSD's logrotate support can only be useful with the logrotate package in place. It makes sense to recommend them. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/994/head:pr994 git checkout pr994

2 22

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel March 2020