sssd.git/src/responder/pam, branch nonroot

PAM: Move is_uid_trusted from pam_ctx to preq

2014-11-25T17:48:34+00:00

Keeping a per-request flag in a global structure is really dangerous.

Reviewed-by: Sumit Bose

PAM: Check for trusted domain before sending the request to BE

2014-11-25T17:48:11+00:00

https://fedorahosted.org/sssd/ticket/2501

Moving the checks to one place has the advantage of not duplicating
security decisions. Previously, the checks were scattered all over the
responder code, making testing hard.

The disadvantage is that we actually check for the presence of the user,
which might trigger some back end lookups. But I think the benefits
overweight the disadvantage.

Also only check the requested domains from a trusted client. An untrusted
client should simply have no say in what domains he wants to talk to, it
should ignore the 'domains' option.

Reviewed-by: Sumit Bose

PAM: Make pam_forwarder_parse_data static

2014-11-24T20:22:48+00:00

Reviewed-by: Pavel Reichl

RESPONDERS: Set default value for umask

2014-10-29T09:41:06+00:00

Resolves: https://fedorahosted.org/sssd/ticket/2468

Reviewed-by: Jakub Hrozek

PAM: Run pam responder as nonroot

2014-10-22T13:44:44+00:00

Reviewed-by: Pavel Reichl 
Reviewed-by: Simo Sorce

PAM: Create pipe file descriptors before privileges are dropped

2014-10-22T13:44:42+00:00

Reviewed-by: Pavel Reichl 
Reviewed-by: Simo Sorce

responders: Do not initialize pipe fd if already present

2014-10-22T13:44:39+00:00

Allow to skip initialization of pipe file descriptor
if the responder context already has one.

Reviewed-by: Pavel Reichl 
Reviewed-by: Simo Sorce

SSSD: Add the options to specify a UID and GID to run as

2014-10-20T19:43:40+00:00

Adds new command line options --uid and --gid to all SSSD servers,
making it possible to switch to another user ID if needed.

So far all code still runs as root.

Reviewed-by: Pavel Reichl

pam: make pam responder aware if views

2014-10-20T14:15:29+00:00

Reviewed-by: Pavel Březina

pam: sub-domain authentication fix

2014-10-01T15:29:17+00:00

With a recent patch sysdb_getpwnam() was replaced by
sysdb_get_user_by_name() in the PAM responder. Unfortunately both behave
differently with respect to sub-domain users. As a consequence the PAM
responder was not able to resolve users from sub-domains. This patch
reverts this change and uses sysdb_getpwnam() again.

Reviewed-by: Alexander Bokovoy