summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* selinux_child: Do not ignore return values.Michal Zidek2014-11-061-0/+8
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* test_sysdb_views: Use unique directory for cacheLukas Slebodnik2014-11-061-1/+3
| | | | | | | | | | | | | | Two tests stored cache in the same directory, It can cause failures with parallel execution of tests. sh$ git grep tests_sysdb src/tests/cmocka/test_sysdb_views.c:#define TESTS_PATH "tests_sysdb" src/tests/sysdb-tests.c:#define TESTS_PATH "tests_sysdb" This patch also clean up potential leftovers after previous failed test_sysdb_views before execution of test suite. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BE: Make struct bet_queue_item private to sssd_beJakub Hrozek2014-11-062-10/+10
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Move setting the SELinux context to a child processJakub Hrozek2014-11-056-20/+691
| | | | | | | | In order for the sssd_be process to run as unprivileged user, we need to move the semanage processing to a process that runs as the root user using setuid privileges. Reviewed-by: Michal Židek <mzidek@redhat.com>
* UTIL: Remove more code duplication setting up child processesJakub Hrozek2014-11-055-58/+42
| | | | | | | | All our child processes duplicated the same code that set up the debugging all around. Instead of adding yet another copy for the selinux_child, add a common utility function. Reviewed-by: Michal Židek <mzidek@redhat.com>
* UTIL: Remove code duplication of struct ioJakub Hrozek2014-11-054-76/+41
| | | | | | | | We had struct io and the associated destructor copied twice in the code already and need it again in the SELinux provider. Instead of adding another copy, move the code to a shared subtree under util/ Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Drop privileges after kinit in ldap_childJakub Hrozek2014-11-053-35/+67
| | | | | | | | After ldap_child initializes privileges using root-owned keytab, it drops privileges to the SSSD user, minimizing the amount of code that runs as root. Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: read the correct data type from ldap_child's input bufferJakub Hrozek2014-11-051-2/+2
| | | | | | The back end wrote uint32_t, the ldap_child process would read int32_t. Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Move sss_krb5_verify_keytab_ex to ldap_childJakub Hrozek2014-11-053-80/+78
| | | | | | | | The function was called from one place only, so it makes no sense to keep it in a shared module. Moreover, the function should only be called from code that runs as root. Reviewed-by: Michal Židek <mzidek@redhat.com>
* BUILD: Install ldap_child and as setuid if running under non-privileged userJakub Hrozek2014-11-052-1/+6
| | | | | | | | The ldap_child permissions should be 4750, owned by root.sssd, to make sure only root and sssd can execute the child and if executed by sssd, the child will run as root. Reviewed-by: Michal Židek <mzidek@redhat.com>
* Add ssh pubkey to origbyname requestSumit Bose2014-11-051-0/+2
| | | | | | | | | Since the IPA clients expects that the extdom plugin delivers the default view data for a given user this patch adds the public SSH key to the list of returned attributes of the getorigbyname request so that it can be send back to the clients. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add test for sysdb_add_overrides_to_object()Sumit Bose2014-11-052-0/+251
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Views: apply user SSH public key overrideSumit Bose2014-11-055-40/+126
| | | | | | | | | | | | | With this patch the SSH public key override attribute is read from the FreeIPA server and saved in the cache with the other override data. Since it is possible to have multiple public SSH keys this override value does not replace any other data but will be added to existing values. Fixes https://fedorahosted.org/sssd/ticket/2454 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb_add_overrides_to_object: add new parameter and multi-value supportSumit Bose2014-11-054-26/+44
| | | | | | | | | | With the new parameter an attribute list other than the default one can be used. Override attributes with multiple values (e.g. SSH public keys) are now supported as well. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb_get_user_attr_with_views: add mandatory override attributesSumit Bose2014-11-051-39/+8
| | | | | | | | | | | | This patch add another attribute with is needs for override processing to the attribute list of sysdb_get_user_attr_with_views(). With two attribute it does not seem useful to check for existence and add each of the attributes conditionally. With this patch they are added unconditionally if the domain has views. Additionally the attributes are not removed in the end because it is expected that they do not cause any harm. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: return user_attributes in origbyname requestSumit Bose2014-11-052-30/+223
| | | | | | | | | | | | | To allow IPA clients to offer special attributes of AD users form trusted domain the extdom plugin on the IPA server must send them to the clients. The extdom plugin already uses sss_nss_getorigbyname() to get attributes like the SID and the user principal name. This patch adds the attributes given by the NSS/IFP user_attributes option to the list of attributes returned by sss_nss_getorigbyname(). Fixes https://fedorahosted.org/sssd/ticket/2464 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: parse user_attributes optionSumit Bose2014-11-053-0/+48
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add parse_attr_list_ex() helper functionSumit Bose2014-11-056-117/+212
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: inherit ldap_user_extra_attrs to AD subdomainsSumit Bose2014-11-051-0/+31
| | | | | | | | | | | | | | Currently the component of the IPA provider which reads the AD user and group attributes in ipa-server-mode uses default settings for the LDAP related attributes. As a result even if ldap_user_extra_attrs is defined in sssd.conf no extra attributes are read from AD. With the patch the value if ldap_user_extra_attrs is inherited to the AD subdomains to allow them to read extra attributes as well. Related to https://fedorahosted.org/sssd/ticket/2464 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add add_strings_lists() utility functionSumit Bose2014-11-053-0/+194
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: use ipaUserGroup object class for groupsPavel Březina2014-11-051-1/+1
| | | | | | | | | | | | | dfb34c6c82ed5014599bf70de6791e6d79106fc2 changed object class of IPA groups from posixGroups to more general groupOfNames. However, this object class is used also for roles, permissions and privileges which caused SSSD to consider those objects to be groups as well during initgroups. Resolves: https://fedorahosted.org/sssd/ticket/2471 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: disable midpoint refresh for netgroupsPavel Reichl2014-11-041-14/+43
| | | | | | | | | | Disable midpoint refresh for netgroups if periodical refresh of expired netgroups is enabled (refresh_expired_interval) Resolves: https://fedorahosted.org/sssd/ticket/2102 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFDB: Detect&fix misconf opt refresh_expired_intervalPavel Reichl2014-11-041-0/+15
| | | | | | | Related to: https://fedorahosted.org/sssd/ticket/2102 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* memberof: check for empty arrays to avoid segfaultsSumit Bose2014-11-041-2/+2
| | | | | | | | | | The arrays with members to add or delete may be empty, i.e. have 0 entries. In this case further processing should be skipped to avoid segfaults later on. Fixes (hopefully) https://fedorahosted.org/sssd/ticket/2430 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MONITOR: Fix warning may be used uninitializedMichal Zidek2014-10-311-1/+3
| | | | | | | | | | | | | | | This warning is caused be change 579e5d4b7a3ca161ea7518b2996905fa22c15995 "MONITOR: Allow confdb to be accessed by nonroot user" src/monitor/monitor.c: In function ‘main’: src/monitor/monitor.c:2953:24: error: ‘monitor’ may be used uninitialized in this function [-Werror=maybe-uninitialized] monitor->is_daemon = !opt_interactive; ^ cc1: all warnings being treated as errors Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Rename user_dom into obj_domJakub Hrozek2014-10-301-12/+12
| | | | | | | | There was a variable in the IPA subdomain code named user_dom, however, it was used in code that processes both users and groups, which was confusing. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: Don't fail the request when BE doesn't find the objectJakub Hrozek2014-10-301-4/+6
| | | | | | | | The IPA subdomain code treated ENOENT as a fatal error, which resulted in a loud error message and the whole request being aborted. This patch ignores ENOENT. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IFP: Fix typo in debug messageSumit Bose2014-10-301-1/+1
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* nss: preserve service name in getsrv callMichal Zidek2014-10-291-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | About case_sensitive=preserving and services. The name of the service can be preserved in result of 'getent service'. However we should still lowercase the protocol and service aliases because they serve as keys in some queries to sysdb. The lowercasing is done by the provider already. If we did not do that, we would lose case insesnsitivity. With this patch the responder preserves the case of service name and protocol, to match the case that is stored in the sysdb (however the protocol is already lowercased by provider, so it was done only for consistent use of the case_sensitive=preserve option in the responders and only the case of name is the same as in ldap). Fixes: https://fedorahosted.org/sssd/ticket/2460 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDERS: Set default value for umaskPavel Reichl2014-10-298-0/+18
| | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2468 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDERS: Don't hard-code umask value in utility functionPavel Reichl2014-10-291-4/+4
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2468 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Fix linking cwrap tests with -Wl,--as-neededLukas Slebodnik2014-10-271-1/+1
| | | | | | | | | | | CCLD responder_common-tests .libs/libsss_util.so: undefined reference to `sss_base64_encode' .libs/libsss_util.so: undefined reference to `s3crypt_gen_salt' .libs/libsss_util.so: undefined reference to `sss_base64_decode' .libs/libsss_util.so: undefined reference to `s3crypt_sha512' collect2: error: ld returned 1 exit status Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDERS: refactor create_pipe_fd()Pavel Reichl2014-10-272-10/+13
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2470 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap_print_server: use getpeername() to get server addressSumit Bose2014-10-271-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* nss: group enumeration fixSumit Bose2014-10-271-0/+3
| | | | | | | | | | The view/override patches introduced and issue with group enumeration where all groups are returned with the same name. This patch should fix it. Fixes: https://fedorahosted.org/sssd/ticket/2475 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Add tests for the views-related option mapsJakub Hrozek2014-10-221-1/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SBUS: Fix error handling after closing containerLukas Slebodnik2014-10-221-0/+2
| | | | | | | | If function dbus_message_iter_close_container fail the return variable ret will be set to EINVAL, but function will not be immediately terminated. "goto done" was missing. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pyhbac,pysss: fix reference leaksPavel Reichl2014-10-222-12/+20
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/1195 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* GPO: Terminate request on errorJakub Hrozek2014-10-221-0/+2
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* NSS: Possibility to use any shells in 'allowed_shells'Denis Kutin2014-10-222-6/+23
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2219 Signed-off-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* MAN PAGE: modified sssd-ldap.5.xml for sssd ticket #2451Dan Lavu2014-10-221-1/+25
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2451 Added a configuration example at the bottom for 'ldap_access_order = lockout'. Also added a line to note that 'ldap_access_provider = ldap' must be specified for this feature to work. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SPEC: Print testsuite log for failed testLukas Slebodnik2014-10-221-1/+1
| | | | | | | | | | Starting from Automake 1.13, the parallel testsuite harness has been made the default one; this harness is quite silent. VERBOSE=yes will displays the logs of the non-passed tests (i.e., only of the failed or skipped ones, or of the ones that passed unexpectedly). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SSH: Run the ssh responder as the SSSD userJakub Hrozek2014-10-222-2/+4
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* SUDO: Run the sudo responder as the SSSD userJakub Hrozek2014-10-222-2/+3
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* PAC: Run the pac responder as the SSSD userJakub Hrozek2014-10-222-2/+4
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* AUTOFS: Run the autofs responder as the SSSD userJakub Hrozek2014-10-222-2/+3
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* PAM: Run pam responder as nonrootMichal Zidek2014-10-222-2/+3
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* PAM: Create pipe file descriptors before privileges are droppedMichal Zidek2014-10-221-4/+26
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* responders: Do not initialize pipe fd if already presentMichal Zidek2014-10-229-14/+24
| | | | | | | | Allow to skip initialization of pipe file descriptor if the responder context already has one. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* TEST: Unit test for create_pipe_fdJakub Hrozek2014-10-221-0/+91
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-11 00:49:08 +0000