summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Enable libldap debuggingldapdebugJakub Hrozek2013-02-106-0/+163
|
* NSS: Add original homedir to home directory template optionsStephen Gallagher2013-02-106-8/+29
| | | | https://fedorahosted.org/sssd/ticket/1805
* Don't use srcdir with testsJakub Hrozek2013-02-041-3/+3
| | | | Fixes build with automake 1.13 or newer.
* Correct sss_ssh_knowhostsproxy typo in man pagesJohn Hodrien2013-02-011-1/+1
|
* dp: check whether hostid backend is configured before filing be requestPavel Březina2013-02-011-0/+8
|
* Fix minor grammar error in logStephen Gallagher2013-01-301-1/+1
|
* krb: recreate ccache if it was deletedPavel Březina2013-01-301-1/+8
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1512 If directory where a ccache file was stored was missing and user was still logged in, we erroneously considered the ccache file still active. Thus the ccache file was not recreated and user was unable to login.
* TESTS: include error message on failOndrej Kos2013-01-291-8/+8
|
* TESTS: Fix coverity issues 13126, 13127Ondrej Kos2013-01-291-2/+6
| | | | https://fedorahosted.org/sssd/ticket/1763
* Unchecked return value in files.cMichal Zidek2013-01-291-1/+9
| | | | | Found by coverity. https://fedorahosted.org/sssd/ticket/1791
* nested groups: fix group lookup hangs if member dn is incorrectPavel Březina2013-01-281-0/+24
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1783 When dn in member attribute is invalid (e.g. rdn instead of dn) or it is outside of configured search bases, we might hit a situation when tevent_req is marked as done before any callback could be attached on it.
* TOOLS: Compile on old platforms such as RHEL5Jakub Hrozek2013-01-282-37/+144
| | | | | Provides compatible declarations for modern file management functions such as futimens or opening with the O_CLOEXEC flag
* MAN: Clarify that saving users after enumerating large domain might be CPU ↵Jakub Hrozek2013-01-281-1/+9
| | | | | | intensive https://fedorahosted.org/sssd/ticket/1732
* Possible null derefence in ipa_subdomains.c.Michal Zidek2013-01-251-0/+4
| | | | | Found by coverity. https://fedorahosted.org/sssd/ticket/1790
* SYSDB: Expire group if adding ghost users fails with EEXISTJakub Hrozek2013-01-231-2/+36
|
* SYSDB: make the sss_ldb_modify_permissive function publicJakub Hrozek2013-01-232-2/+11
|
* TOOLS: Use file descriptor to avoid races when creating a home directoryJakub Hrozek2013-01-234-354/+364
| | | | | | | | | | | When creating a home directory, the destination tree can be modified in various ways while it is being constructed because directory permissions are set before populating the directory. This can lead to file creation and permission changes outside the target directory tree, using hard links. This security problem was assigned CVE-2013-0219 https://fedorahosted.org/sssd/ticket/1782
* TOOLS: Use openat/unlinkat when removing the homedirJakub Hrozek2013-01-231-42/+41
| | | | | | | | | | The removal of a home directory is sensitive to concurrent modification of the directory tree being removed and can unlink files outside the directory tree. This security issue was assigned CVE-2013-0219 https://fedorahosted.org/sssd/ticket/1782
* Check that strings do not go beyond the end of the packet body in autofs and ↵Jan Cholasta2013-01-232-7/+7
| | | | | | | | SSH requests. This fixes CVE-2013-0220. https://fedorahosted.org/sssd/ticket/1781
* sudo responder: change num_rules type from size_t to uint32_tPavel Březina2013-01-227-25/+25
| | | | | | | | https://fedorahosted.org/sssd/ticket/1779 2^32 should be enough to store sudo rules. size_t type was causing troubles on big endian architectures, because it wasn't used correctly in combination with D-Bus.
* Convert the value of pwd_exp_warning to secondsJakub Hrozek2013-01-221-5/+6
| | | | | | | | When read from the domain section, the pwd_expiration_warning was properly converted to seconds from days, but not the pam_pwd_expiration_warning set in the [pam] section. https://fedorahosted.org/sssd/ticket/1773
* fix backend callbacks: remove callback properly from dlistPavel Březina2013-01-221-6/+18
| | | | | | | | https://fedorahosted.org/sssd/ticket/1776 Although cb->list got updated when the callback is removed, this change did not propagate to be_ctx->*_cb_list which caused dlist having invalid records.
* Fix code styleJakub Hrozek2013-01-221-1/+2
|
* Make struct be_req opaqueSimo Sorce2013-01-212-18/+18
|
* Add be_req_get_data() helper funciton.Simo Sorce2013-01-2117-32/+45
| | | | In preparation for making struct be_req opaque.
* Add be_req_get_be_ctx() helper.Simo Sorce2013-01-2122-133/+155
| | | | In preparation for making be_req opaque
* Add be_req_create() helperSimo Sorce2013-01-213-40/+38
|
* Introduce be_req_terminate() helperSimo Sorce2013-01-2119-130/+84
| | | | | Call it everywhere instead of directly dereferencing be_req->fn This is in preparation of making be_req opaque.
* Remove domain from be_req structureSimo Sorce2013-01-217-64/+46
|
* Pass domain not be_req to access check functionsSimo Sorce2013-01-215-22/+33
|
* Split simple_access_check function outSimo Sorce2013-01-214-207/+227
| | | | | Need to split out the function or new additions to the handler funtion will not allow simple access tests to compile anymore.
* Do not pass NULL to ipa_subdomain_retrieve()Simo Sorce2013-01-211-18/+20
|
* Move hbac_ctx_is_offline()Simo Sorce2013-01-212-7/+6
|
* Remove hbac_ctx_sdap_id_[ctx|op]()Simo Sorce2013-01-212-18/+6
|
* Remove hbac_ctx_ev()Simo Sorce2013-01-212-10/+3
|
* Remove hbac_ctx_be()Simo Sorce2013-01-213-12/+4
|
* Remove hbac_ctx_sysdb()Simo Sorce2013-01-212-12/+4
|
* Remove sysdb argument from hbac_get_cached_rules()Simo Sorce2013-01-213-9/+6
|
* Remove sysdb arg from [ipa_]hbac_sysdb_save()Simo Sorce2013-01-213-36/+25
| | | | Also make ipa_hbac_save_list() static
* Remove sysdb arg from ipa_hbac_service_info_send()Simo Sorce2013-01-213-5/+0
|
* Remove sysdb arg from hbac_*host_attrs_to_rule()Simo Sorce2013-01-213-11/+4
|
* Remove sysdb arg from hbac_service_attrs_to_rule()Simo Sorce2013-01-213-5/+2
|
* Remove sysdb argument from hbac_user_attrs_to_rule()Simo Sorce2013-01-213-6/+4
|
* Remove unused structureSimo Sorce2013-01-211-6/+0
|
* Remove sysdb argument from ipa_host_info_send()Simo Sorce2013-01-215-9/+3
|
* Remove sysdb as a be request structure memberSimo Sorce2013-01-217-12/+9
| | | | The sysdb context is already available through the 'domain' context.
* Remove sysdb as a be context structure memberSimo Sorce2013-01-2127-56/+52
| | | | The sysdb context is already available through the 'domain' structure.
* Move ldap provider access functionsSimo Sorce2013-01-213-59/+87
| | | | | | It was confusing to see the ldap provider own handler mixed with the generic ldap access code used also by the ipa and ad providers. So move the ldap provider handler code in its own file.
* TOOLS: invalidate parent groups in memory cache, tooJakub Hrozek2013-01-214-8/+71
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1775 In addition to invalidating the group being added to when adding a member group/user, we also need to invalidate all its parent groups, otherwise this getgrnam("parent") wouldn't report the members newly added to its child groups.
* LDAP: Compare lists of DNs when saving autofs entriesJakub Hrozek2013-01-213-143/+178
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1758 The autofs entries do not have the key as an unique identifier, but rather the full (key, value) tuple as some keys have a special meaning, such as the direct mount key (/-) and may be present in a single map multiple times. Comparing the full DN that contains both the key and the value will allow for working updates if either key or value changes.
generated by cgit (git 2.34.1) at 2024-04-25 03:40:18 +0000