sssd.git/src/util, branch nonroot

KRB5: Pass the sssd_be uid and gid to krb5_child

2014-11-28T17:48:23+00:00

Fix: always check return value of unlink()

2014-11-28T15:16:37+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/2506

Reviewed-by: Lukáš Slebodník

krb5: Check return value of sss_krb5_princ_realm

2014-11-28T15:06:11+00:00

sss_krb5_princ_realm set output parameter realm to NULL and len to 0
in case of failure. Clang static analysers reported warning
"Null pointer passed as an argument to a 'nonnull' parameter"
in function match_principal. It was possible, that realm_name with value NULL
could be used in strncmp.

Reviewed-by: Pavel Reichl

krb5: Check return value of krb5_principal_get_realm

2014-11-28T15:06:05+00:00

Function krb5_principal_get_realm can return NULL an it would
case segfault in function strlen.

Reviewed-by: Pavel Reichl

util: sss_get_domain_name regex mismatch not fatal

2014-11-25T12:47:57+00:00

Assume name is not FQDN if sss_parse_name fails to
match domain with regular expression.

Fixes:
https://fedorahosted.org/sssd/ticket/2487

Reviewed-by: Lukáš Slebodník

util: Special-case PCRE_ERROR_NOMATCH in sss_parse_name

2014-11-25T12:47:57+00:00

Add new SSSD specific error code for the case when
pcre_exec returns PCRE_ERROR_NOMATCH.

Reviewed-by: Lukáš Slebodník

AD/IPA: add krb5_confd_path configuration option

2014-11-25T12:28:39+00:00

With this new parameter the directory where Kerberos configuration
snippets are created can be specified.

Fixes https://fedorahosted.org/sssd/ticket/2473

Reviewed-by: Jakub Hrozek

Enable views for all domains

2014-11-20T09:53:01+00:00

Currently views and overrides were only available for sub-domains, this
patch enables the lookup for the configured domains as well.

Related to https://fedorahosted.org/sssd/ticket/2481

Reviewed-by: Jakub Hrozek

KRB5: Do not switch_creds() if already the specified user

2014-11-18T19:33:46+00:00

The code didn't have to handle this case previously as sssd_be was always
running as root and switching to the ccache as the user logging in.

Also handle NULL creds on restore_creds() in case there was no switch.
One less if-condition and fewer indentation levels.

Related:
https://fedorahosted.org/sssd/ticket/2370

Reviewed-by: Sumit Bose 
Reviewed-by: Lukáš Slebodník

KRB5: Move all ccache operations to krb5_child.c

2014-11-18T19:33:42+00:00

The credential cache operations must be now performed by the krb5_child
completely, because the sssd_be process might be running as the sssd
user who doesn't have access to the ccaches.

src/providers/krb5/krb5_ccache.c is still linked against libsss_krb5
until we fix Kerberos ticket renewal as non-root.

Also includes a new error code that indicates that the back end should
remove the old ccache attribute -- the child can't do that if it's
running as the user.

Related:
https://fedorahosted.org/sssd/ticket/2370

Reviewed-by: Sumit Bose 
Reviewed-by: Lukáš Slebodník