3:21 p.m.
URL: https://github.com/SSSD/sssd/pull/792
Author: sumit-bose
Title: #792: PAM: add initial prompting configuration
Action: opened
PR body:
"""
Add new section for sssd.conf to allow more flexible prompting during
authentication.
Related to https://pagure.io/SSSD/sssd/issue/3264
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/792/head:pr792
git checkout pr792
3:22 p.m.
New subject: [sssd PR#792][comment] PAM: add initial prompting configuration
URL: https://github.com/SSSD/sssd/pull/792
Title: #792: PAM: add initial prompting configuration
sumit-bose commented:
"""
Hi,
I plan to add some more test, but code-wise the patches should be complete.
bye,
Sumit
"""
See the full comment at https://github.com/SSSD/sssd/pull/792#issuecomment-477332490
5:16 p.m.
New subject: [sssd PR#792][comment] PAM: add initial prompting configuration
URL: https://github.com/SSSD/sssd/pull/792
Title: #792: PAM: add initial prompting configuration
jhrozek commented:
"""
There are some Coverity warnings:
```
Error: CLANG_WARNING:
sssd-2.1.1/src/responder/pam/pam_prompting_config.c:65:5: warning: Value stored to
'ret' is never read
# ret = confdb_get_bool(cdb, section, CONFDB_PC_2FA_SINGLE_PROMPT, false,
# ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sssd-2.1.1/src/responder/pam/pam_prompting_config.c:65:5: note: Value stored to
'ret' is never read
# ret = confdb_get_bool(cdb, section, CONFDB_PC_2FA_SINGLE_PROMPT, false,
# ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# 63|
# 64|
# 65|-> ret = confdb_get_bool(cdb, section, CONFDB_PC_2FA_SINGLE_PROMPT, false,
# 66| &single_2fa_prompt);
# 67| ret = confdb_get_string(cdb, tmp_ctx, section, CONFDB_PC_2FA_1ST_PROMPT,
Error: CLANG_WARNING:
sssd-2.1.1/src/responder/pam/pam_prompting_config.c:67:5: warning: Value stored to
'ret' is never read
# ret = confdb_get_string(cdb, tmp_ctx, section, CONFDB_PC_2FA_1ST_PROMPT,
# ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sssd-2.1.1/src/responder/pam/pam_prompting_config.c:67:5: note: Value stored to
'ret' is never read
# ret = confdb_get_string(cdb, tmp_ctx, section, CONFDB_PC_2FA_1ST_PROMPT,
# ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# 65| ret = confdb_get_bool(cdb, section, CONFDB_PC_2FA_SINGLE_PROMPT, false,
# 66| &single_2fa_prompt);
# 67|-> ret = confdb_get_string(cdb, tmp_ctx, section,
CONFDB_PC_2FA_1ST_PROMPT,
# 68| NULL, &first_prompt);
# 69| if (single_2fa_prompt) {
Error: CLANG_WARNING:
sssd-2.1.1/src/responder/pam/pam_prompting_config.c:70:9: warning: Value stored to
'ret' is never read
# ret = pc_list_add_2fa_single(pc_list, first_prompt);
# ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sssd-2.1.1/src/responder/pam/pam_prompting_config.c:70:9: note: Value stored to
'ret' is never read
# ret = pc_list_add_2fa_single(pc_list, first_prompt);
# ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# 68| NULL, &first_prompt);
# 69| if (single_2fa_prompt) {
# 70|-> ret = pc_list_add_2fa_single(pc_list, first_prompt);
# 71| } else {
# 72| ret = confdb_get_string(cdb, tmp_ctx, section,
CONFDB_PC_2FA_2ND_PROMPT,
Error: CLANG_WARNING:
sssd-2.1.1/src/responder/pam/pam_prompting_config.c:72:9: warning: Value stored to
'ret' is never read
# ret = confdb_get_string(cdb, tmp_ctx, section, CONFDB_PC_2FA_2ND_PROMPT,
# ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sssd-2.1.1/src/responder/pam/pam_prompting_config.c:72:9: note: Value stored to
'ret' is never read
# ret = confdb_get_string(cdb, tmp_ctx, section, CONFDB_PC_2FA_2ND_PROMPT,
# ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# 70| ret = pc_list_add_2fa_single(pc_list, first_prompt);
# 71| } else {
# 72|-> ret = confdb_get_string(cdb, tmp_ctx, section,
CONFDB_PC_2FA_2ND_PROMPT,
# 73| NULL, &second_prompt);
# 74|
Error: CLANG_WARNING:
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:427:9: warning: Potential leak of memory
pointed to by 'pl'
# SAFEALIGN_COPY_UINT32_CHECK(&type, buf + rp, size, &rp);
# ^
sssd-2.1.1/src/shared/safealign.h:105:62: note: expanded from macro
'SAFEALIGN_COPY_UINT32_CHECK'
# SIZE_T_OVERFLOW(*(pctr), sizeof(uint32_t))) { return EINVAL; } \
# ^
/usr/include/asm-generic/errno-base.h:26:17: note: expanded from macro 'EINVAL'
##define EINVAL 22 /* Invalid argument */
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:419:9: note: Assuming 'buf' is
not equal to NULL
# if (buf == NULL || size < 3 * sizeof(uint32_t)) {
# ^~~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:419:9: note: Left side of '||'
is false
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:419:24: note: Assuming the condition is
false
# if (buf == NULL || size < 3 * sizeof(uint32_t)) {
# ^~~~~~~~~~~~~~~~~~~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:419:5: note: Taking false branch
# if (buf == NULL || size < 3 * sizeof(uint32_t)) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:426:17: note: Assuming 'c' is
< 'count'
# for (c = 0; c < count; c++) {
# ^~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:426:5: note: Loop condition is true.
Entering loop body
# for (c = 0; c < count; c++) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:428:9: note: Control jumps to 'case
PC_TYPE_SC_PIN:' at line 484
# switch (type) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:485:13: note: Execution continues on
line 426
# break;
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:426:17: note: Assuming 'c' is
< 'count'
# for (c = 0; c < count; c++) {
# ^~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:426:5: note: Loop condition is true.
Entering loop body
# for (c = 0; c < count; c++) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:428:9: note: Control jumps to 'case
PC_TYPE_2FA_SINGLE:' at line 469
# switch (type) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:472:17: note: Assuming 'str' is
not equal to NULL
# if (str == NULL) {
# ^~~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:472:13: note: Taking false branch
# if (str == NULL) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:478:19: note: Calling
'pc_list_add_2fa_single'
# ret = pc_list_add_2fa_single(&pl, str);
# ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:276:5: note: Taking false branch
# if (pc_list == NULL) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:281:9: note: Assuming 'pc' is
not equal to NULL
# if (pc == NULL) {
# ^~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:281:5: note: Taking false branch
# if (pc == NULL) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:286:44: note: '?' condition is
true
# pc->data.two_fa_single.prompt = strdup(prompt != NULL ? prompt
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:288:9: note: Assuming the condition is
false
# if (pc->data.two_fa_single.prompt == NULL) {
# ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:288:5: note: Taking false branch
# if (pc->data.two_fa_single.prompt == NULL) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:293:11: note: Calling
'pc_list_add_pc'
# ret = pc_list_add_pc(pc_list, pc);
# ^~~~~~~~~~~~~~~~~~~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:166:34: note: Left side of
'&&' is false
# for (c = 0; *pc_list != NULL && (*pc_list)[c] != NULL; c++); /* just counting
*/
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:168:11: note: Memory is allocated
# pcl = realloc(*pc_list, (c + 2) * sizeof(struct prompt_config *));
# ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:169:9: note: Assuming 'pcl' is
not equal to NULL
# if (pcl == NULL) {
# ^~~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:169:5: note: Taking false branch
# if (pcl == NULL) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:293:11: note: Returned allocated memory
via 1st parameter
# ret = pc_list_add_pc(pc_list, pc);
# ^~~~~~~~~~~~~~~~~~~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:294:5: note: Taking false branch
# if (ret != EOK) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:301:5: note: Taking false branch
# if (ret != EOK) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:478:19: note: Returned allocated memory
via 1st parameter
# ret = pc_list_add_2fa_single(&pl, str);
# ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:480:13: note: Taking false branch
# if (ret != EOK) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:483:13: note: Execution continues on
line 426
# break;
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:426:17: note: Assuming 'c' is
< 'count'
# for (c = 0; c < count; c++) {
# ^~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:426:5: note: Loop condition is true.
Entering loop body
# for (c = 0; c < count; c++) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:427:9: note: Left side of '||'
is true
# SAFEALIGN_COPY_UINT32_CHECK(&type, buf + rp, size, &rp);
# ^
sssd-2.1.1/src/shared/safealign.h:104:46: note: expanded from macro
'SAFEALIGN_COPY_UINT32_CHECK'
# if ((*(pctr) + sizeof(uint32_t)) > (len) || \
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:427:9: note: Potential leak of memory
pointed to by 'pl'
sssd-2.1.1/src/shared/safealign.h:105:62: note: expanded from macro
'SAFEALIGN_COPY_UINT32_CHECK'
# SIZE_T_OVERFLOW(*(pctr), sizeof(uint32_t))) { return EINVAL; } \
# ^
/usr/include/asm-generic/errno-base.h:26:17: note: expanded from macro 'EINVAL'
##define EINVAL 22 /* Invalid argument */
# ^
# 425|
# 426| for (c = 0; c < count; c++) {
# 427|-> SAFEALIGN_COPY_UINT32_CHECK(&type, buf + rp, size, &rp);
# 428| switch (type) {
# 429| case PC_TYPE_PASSWORD:
Error: RESOURCE_LEAK (CWE-772):
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:446: alloc_fn: Storage is returned from
allocation function "strndup".
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:446: var_assign: Assigning:
"str" = storage returned from "strndup((char *)buf + rp, l)".
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:453: leaked_storage: Variable
"str" going out of scope leaks the storage it points to.
# 451| rp += l;
# 452|
# 453|-> SAFEALIGN_COPY_UINT32_CHECK(&l, buf + rp, size, &rp);
# 454| str2 = strndup((char *) buf + rp, l);
# 455| if (str2 == NULL) {
Error: CLANG_WARNING:
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:453:13: warning: Potential leak of
memory pointed to by 'str'
# SAFEALIGN_COPY_UINT32_CHECK(&l, buf + rp, size, &rp);
# ^
sssd-2.1.1/src/shared/safealign.h:105:62: note: expanded from macro
'SAFEALIGN_COPY_UINT32_CHECK'
# SIZE_T_OVERFLOW(*(pctr), sizeof(uint32_t))) { return EINVAL; } \
# ^
/usr/include/asm-generic/errno-base.h:26:17: note: expanded from macro 'EINVAL'
##define EINVAL 22 /* Invalid argument */
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:419:9: note: Assuming 'buf' is
not equal to NULL
# if (buf == NULL || size < 3 * sizeof(uint32_t)) {
# ^~~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:419:9: note: Left side of '||'
is false
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:419:24: note: Assuming the condition is
false
# if (buf == NULL || size < 3 * sizeof(uint32_t)) {
# ^~~~~~~~~~~~~~~~~~~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:419:5: note: Taking false branch
# if (buf == NULL || size < 3 * sizeof(uint32_t)) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:426:17: note: Assuming 'c' is
< 'count'
# for (c = 0; c < count; c++) {
# ^~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:426:5: note: Loop condition is true.
Entering loop body
# for (c = 0; c < count; c++) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:428:9: note: Control jumps to 'case
PC_TYPE_2FA:' at line 444
# switch (type) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:446:19: note: Memory is allocated
# str = strndup((char *) buf + rp, l);
# ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:447:17: note: Assuming 'str' is
not equal to NULL
# if (str == NULL) {
# ^~~~~~~~~~~
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:447:13: note: Taking false branch
# if (str == NULL) {
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:453:13: note: Left side of '||'
is true
# SAFEALIGN_COPY_UINT32_CHECK(&l, buf + rp, size, &rp);
# ^
sssd-2.1.1/src/shared/safealign.h:104:46: note: expanded from macro
'SAFEALIGN_COPY_UINT32_CHECK'
# if ((*(pctr) + sizeof(uint32_t)) > (len) || \
# ^
sssd-2.1.1/src/sss_client/pam_sss_prompt_config.c:453:13: note: Potential leak of memory
pointed to by 'str'
sssd-2.1.1/src/shared/safealign.h:105:62: note: expanded from macro
'SAFEALIGN_COPY_UINT32_CHECK'
# SIZE_T_OVERFLOW(*(pctr), sizeof(uint32_t))) { return EINVAL; } \
# ^
/usr/include/asm-generic/errno-base.h:26:17: note: expanded from macro 'EINVAL'
##define EINVAL 22 /* Invalid argument */
# ^
# 451| rp += l;
# 452|
# 453|-> SAFEALIGN_COPY_UINT32_CHECK(&l, buf + rp, size, &rp);
# 454| str2 = strndup((char *) buf + rp, l);
# 455| if (str2 == NULL) {
```
"""
See the full comment at https://github.com/SSSD/sssd/pull/792#issuecomment-477368290
5:16 p.m.
New subject: [sssd PR#792][comment] PAM: add initial prompting configuration
URL: https://github.com/SSSD/sssd/pull/792
Title: #792: PAM: add initial prompting configuration
jhrozek commented:
"""
retest this please
"""
See the full comment at https://github.com/SSSD/sssd/pull/792#issuecomment-477368329
5:28 a.m.
New subject: [sssd PR#792][synchronized] PAM: add initial prompting configuration
URL: https://github.com/SSSD/sssd/pull/792
Author: sumit-bose
Title: #792: PAM: add initial prompting configuration
Action: synchronized
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/792/head:pr792
git checkout pr792
5:29 a.m.
New subject: [sssd PR#792][comment] PAM: add initial prompting configuration
URL: https://github.com/SSSD/sssd/pull/792
Title: #792: PAM: add initial prompting configuration
sumit-bose commented:
"""
Hi Jakub,
the latest version should fix the issues found and adds some more tests.
bye,
Sumit
"""
See the full comment at https://github.com/SSSD/sssd/pull/792#issuecomment-477948849
7:58 a.m.
New subject: [sssd PR#792][+Accepted] PAM: add initial prompting configuration
URL: https://github.com/SSSD/sssd/pull/792
Title: #792: PAM: add initial prompting configuration
Label: +Accepted
3:51 p.m.
New subject: [sssd PR#792][comment] PAM: add initial prompting configuration
URL: https://github.com/SSSD/sssd/pull/792
Title: #792: PAM: add initial prompting configuration
jhrozek commented:
"""
master:
45efba71befd96c8e9fe0a51fc300cafa93bd703
a4d178593bec65a4c7534b841cedfbb74c56f49f
fc26b4a82d4a92b29cf321fba8dbec52c3bff8d6
ac4b33f765ac322949ac7c2f24985d3b9c178168
fa8ef7c6db19a160d807f05b08bbc66c0c25ebfe
"""
See the full comment at https://github.com/SSSD/sssd/pull/792#issuecomment-478742746
4:12 p.m.
New subject: [sssd PR#792][+Pushed] PAM: add initial prompting configuration
URL: https://github.com/SSSD/sssd/pull/792
Title: #792: PAM: add initial prompting configuration
Label: +Pushed
4:13 p.m.
New subject: [sssd PR#792][comment] PAM: add initial prompting configuration
URL: https://github.com/SSSD/sssd/pull/792
Title: #792: PAM: add initial prompting configuration
jhrozek commented:
"""
I'll close this PR as the backport is in PR#799
"""
See the full comment at https://github.com/SSSD/sssd/pull/792#issuecomment-478750247
4:13 p.m.
New subject: [sssd PR#792][closed] PAM: add initial prompting configuration
URL: https://github.com/SSSD/sssd/pull/792
Author: sumit-bose
Title: #792: PAM: add initial prompting configuration
Action: closed
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/792/head:pr792
git checkout pr792
1858
days inactive
1863
days old
sssd-devel@lists.fedorahosted.org
10 comments
2 participants
participants (2)
-
jhrozek -
sumit-bose