sssd.git/src/responder, branch dpstr

IFP: Skip non-POSIX groups properly

2015-11-11T11:05:29+00:00

When ifp_users_user_get_groups is called, for example via GetAll and
the list of groups contains a non-POSIX group, we skip an array member,
resulting in random memory being passed to the caller.

Resolves:
    https://fedorahosted.org/sssd/ticket/2863

Reviewed-by: Pavel Březina

cache_req: Fix warning -Wshadow

2015-11-10T14:34:32+00:00

src/responder/common/responder_cache_req.c: In function 'cache_req_input_set_name':
src/responder/common/responder_cache_req.c:199: warning: declaration of 'dup' shadows a global declaration
/usr/include/unistd.h:528: warning: shadowed declaration is here

Reviewed-by: Jakub Hrozek

NSS: fix a use-after-free issue

2015-11-04T08:37:57+00:00

While handling well-known SIDs a debug statement tries to access memory that is
already freed. This can be seen with the following output from valgrind.

==17600== Invalid read of size 4
==17600==    at 0x805ACC6: nss_cmd_getbysid (nsssrv_cmd.c:5458)
==17600==    by 0x805AF41: nss_cmd_getnamebysid (nsssrv_cmd.c:5509)
==17600==    by 0x80662F4: sss_cmd_execute (responder_cmd.c:161)
==17600==    by 0x8067015: client_cmd_execute (responder_common.c:249)
==17600==    by 0x80671F5: client_recv (responder_common.c:283)
==17600==    by 0x806741C: client_fd_handler (responder_common.c:335)
==17600==    by 0x45F5112: epoll_event_loop (tevent_epoll.c:728)
==17600==    by 0x45F5112: epoll_event_loop_once (tevent_epoll.c:926)
==17600==    by 0x45F32EE: std_event_loop_once (tevent_standard.c:114)
==17600==    by 0x45EF3BF: _tevent_loop_once (tevent.c:530)
==17600==    by 0x45EF5AB: tevent_common_loop_wait (tevent.c:634)
==17600==    by 0x45F326E: std_event_loop_wait (tevent_standard.c:140)
==17600==    by 0x45EF647: _tevent_loop_wait (tevent.c:653)
==17600==  Address 0x4b248a0 is 72 bytes inside a block of size 88 free'd
==17600==    at 0x402C26D: free (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==17600==    by 0x45FEC9E: _talloc_free_internal (talloc.c:1057)
==17600==    by 0x45FEC9E: _talloc_free (talloc.c:1581)
==17600==    by 0x8066085: sss_cmd_done (responder_cmd.c:93)
==17600==    by 0x805A9B0: nss_check_well_known_sid (nsssrv_cmd.c:5382)
==17600==    by 0x805AC86: nss_cmd_getbysid (nsssrv_cmd.c:5455)
==17600==    by 0x805AF41: nss_cmd_getnamebysid (nsssrv_cmd.c:5509)
==17600==    by 0x80662F4: sss_cmd_execute (responder_cmd.c:161)
==17600==    by 0x8067015: client_cmd_execute (responder_common.c:249)
==17600==    by 0x80671F5: client_recv (responder_common.c:283)
==17600==    by 0x806741C: client_fd_handler (responder_common.c:335)
==17600==    by 0x45F5112: epoll_event_loop (tevent_epoll.c:728)
==17600==    by 0x45F5112: epoll_event_loop_once (tevent_epoll.c:926)
==17600==    by 0x45F32EE: std_event_loop_once (tevent_standard.c:114)
==17600==

The patch contains a change to the unit tests which frees the memory in
the wrapper for sss_cmd_done() too. This allows to detect this kind of
issue in the unit tests as well.

Reviewed-by: Lukáš Slebodník

Refactor some conditions

2015-10-23T08:33:06+00:00

Conditions with get_next_domain were a little
confusing for coverity (but also for developers'
eyes).

Reviewed-by: Jakub Hrozek

util: Update get_next_domain's interface

2015-10-23T08:32:23+00:00

Update get next domain to be able to
include disbled domains and change the
interface to accept flags instead of
multiple booleans.

Ticket:
https://fedorahosted.org/sssd/ticket/2673

Reviewed-by: Jakub Hrozek

PAM: remove unused parameter cdb

2015-10-20T07:39:42+00:00

Reviewed-by: Lukáš Slebodník

REFACTOR: SCKT_RSP_UMASK constant in responder code

2015-10-14T11:27:16+00:00

This patch adds new SCKT_RSP_UMASK constant which stands for 0111. And
it replaces all occurances in responder code.

Resolves:
https://fedorahosted.org/sssd/ticket/2424

Reviewed-by: Jakub Hrozek

REFACTOR: DFL_RSP_UMASK constant in responder code

2015-10-14T11:27:10+00:00

There is DFL_RSP_UMASK constant for very secure umask in responder
code. This patch replaces occurances of value 0177 with this constant.

Resolves:
https://fedorahosted.org/sssd/ticket/2424

Reviewed-by: Jakub Hrozek

sudo: send original name and id with local views if possible

2015-10-14T11:07:45+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/2833

Reviewed-by: Sumit Bose 
Reviewed-by: Jakub Hrozek

sudo: search with view even if user is found

2015-10-14T11:07:42+00:00

If an overriden name is provided and the user is already cache we fail
to refresh it since we won't search with VIEW flag. This patch fix
it.

Reviewed-by: Sumit Bose 
Reviewed-by: Jakub Hrozek