summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* SDAP: fix use after free in async_initgroupsPavel Reichl2014-07-241-1/+0
| | | | | | | | Request is freed if creation of subrequest fails and ENOMEM is returned. This would lead to use after free as returned value is checked on caller's side and (already freed) request would be marked as erroneous. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Only check GID if ID-mappingJakub Hrozek2014-07-233-4/+36
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* No point in searching for gid if we already know the group should be filteredJakub Hrozek2014-07-231-3/+5
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* sss_client: Fix memory leak in nss_mc_{group,passwd}Lukas Slebodnik2014-07-232-0/+16
| | | | | | | | | | | | | | | | | | | | | | | Memory leak can happen with long living clients where there are records with colliding hashes; usually LDAP servers with many users or groups. Function sss_nss_mc_get_record allocates memory that is stored into "rec", with next iteration variable rec is overriden with new record and old one is lost and cannot be freed. Example code flow: src/sss_client/nss_mc_group.c:133: alloc_arg: "sss_nss_mc_get_record" allocates memory that is stored into "rec". src/sss_client/nss_mc_common.c:216:13: alloc_fn: Storage is returned from allocation function "malloc". src/sss_client/nss_mc_common.c:216:13: var_assign: Assigning: "copy_rec" = "malloc(rec_len)". src/sss_client/nss_mc_common.c:225:9: noescape: Resource "copy_rec" is not freed or pointed-to in function "memcpy". [Note: The source code implementation of the function has been overridden by a builtin model.] src/sss_client/nss_mc_common.c:239:5: var_assign: Assigning: "*_rec" = "copy_rec". src/sss_client/nss_mc_group.c:163: noescape: Resource "rec" is not freed or pointed-to in "sss_nss_mc_next_slot_with_hash". src/sss_client/nss_mc_common.c:294:60: noescape: "sss_nss_mc_next_slot_with_hash(struct sss_mc_rec *, uint32_t)" does not free or save its pointer parameter "rec". src/sss_client/nss_mc_group.c:133: overwrite_var: Overwriting "rec" in call to "sss_nss_mc_get_record" leaks the storage that "rec" points to. src/sss_client/nss_mc_common.c:239:5: write_notnull_to_parm: Assigning: "*_rec" = "copy_rec". Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* sss_client: thread safe initialisation of sss_cli_mc_ctxLukas Slebodnik2014-07-231-7/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In multi threaded application, it may happen that more threads will call function getpwuid(or similar) and sss client will not have initialized structure for fast memory cache. This structure is initialized just once. There isn't any problem with multi threaded application after successful initialisation. The race condition will happen if more threads try to initialise structure sss_cli_mc_ctx in function sss_nss_mc_get_ctx (ctx->initialized is false) It takes some time to initialise mmap cache: open file, get file size, mmap file, initialize structure sss_cli_mc_ctx. One of problems is that file with memory cache can be opened more times (file descriptor leak), but the race condition is with initialising structure sss_cli_mc_ctx. One tread will start to initialise this structure; another thread will think that structure is already initialised and will check consistency of this structure. It will fail because 1st thread did not finish initialisation. Therefore 2nd thread will return EINVAL and will do clean up in done section: munmap, close file and reset structure data. The 1st thread will finish an try to use memory cache, but structure was zero initialised by 2nd thread and it will cause dereference of NULL pointer in 1st thread (SIGSEGV) or dividing by zero in murmurhash function(SIGFPE) Function sss_nss_mc_get_ctx was split into two parts for simplification of locking and unlocking. The locking is used only in new static function sss_nss_mc_init_ctx. This function will not be called very often therefore the same mutex is used as in other nss functions. Resolves: https://fedorahosted.org/sssd/ticket/2380 Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: reduce code duplicity-rfc2307bis nested groupsPavel Reichl2014-07-231-41/+29
| | | | | | | Move copy&pasted code for iteration of nested groups into separate function. Reviewed-by: Michal Židek <mzidek@redhat.com>
* ad: update membership after SIDs are resolvedPavel Březina2014-07-221-25/+62
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2385 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ad: comment ENOENT when id mapping is disabledPavel Březina2014-07-221-0/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: remove duplicated codePavel Reichl2014-07-221-44/+3
| | | | | | | | | | | Body of functions sdap_x_deref_search_done(), sdap_asq_search_done(), sdap_sd_search_done and sdap_get_generic_done() are the same. Remove code duplication by calling sdap_get_generic_done() from sdap_x_deref_search_done(), sdap_sd_search_done and from sdap_asq_search_done() instead of having two more duplicate implementations. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: rename find_subdomain_by_object_namePavel Reichl2014-07-223-13/+13
| | | | | | | The function was named "find_subdomain" yet it could find both main domain and subdomain. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: rename find_subdomain_by_namePavel Reichl2014-07-2216-54/+54
| | | | | | | | | The function was named "find_subdomain" yet it could find both main domain and subdomain. sed 's/find_subdomain_by_name/find_domain_by_name/' -i `find . -name "*.[ch]"` Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: rename find_subdomain_by_sidPavel Reichl2014-07-227-23/+23
| | | | | | | | | The function was named "find_subdomain" yet it could find both main domain and subdomain. sed 's/find_subdomain_by_sid/find_domain_by_sid/' -i `find . -name "*.[ch]"` Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ad_handle_acct_info_step: fix typoPavel Březina2014-07-211-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Continue resolving SID even if some failPavel Reichl2014-07-211-1/+6
| | | | | | | | | | | | Resolving groups obtained via Token-Groups in case of disabled ID mapping may lead to failure as non-posix groups are not resolved. This patch amends sdap_ad_resolve_sids_done() not to abruptly finish request if ENOENT is returned. Resolves: https://fedorahosted.org/sssd/ticket/2345 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: tokengroups do not work with id_provider=ldapPavel Reichl2014-07-214-13/+93
| | | | | | | | | | | | | | | | | | With plain LDAP provider we already have a sdap_handle, so it should be possible that in the case where sdom->pvt == NULL sdap_id_op_connect_send() can be skipped and sdap_get_ad_tokengroups_send() can be already send with the sdap_handle passed to sdap_ad_tokengroups_initgr_mapping_send(). So we should only fail if sdom->pvt == NULL and sh == NULL. if find_subdomain_by_sid() failed we can check if there is only one domain in the domain list (state->domain) and in this case continue with this domain since the LDAP provider does not know about sub-domains and hence can only have one configured domain. Resolves: https://fedorahosted.org/sssd/ticket/2345 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD-GPO: Store policy settings in local filesYassir Elley2014-07-206-350/+426
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD: add missing debug-to-stderr option to gpo_childSumit Bose2014-07-201-0/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: add missing debug-to-stderr option to krb5_childSumit Bose2014-07-201-0/+3
| | | | | | Without this option krb5_child cannot be run in interactive mode. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_sifp: set output parameters if attribute is NULLPavel Březina2014-07-162-43/+415
| | | | | | | | | | | | | | | | | | | | | | | | | | There are two cases that may happen when a user calls Get or GetAll: 1) the attribute is missing 2) the attribute is empty sss_sifp has two error code to distinguish between those two cases: 1) SSS_SIFP_ATTR_MISSING 2) SSS_SIFP_ATTR_NULL Usually the caller is not interested on situations when the attribute is empty and it can be considered as error. Having it as a separate error code instead of setting the output value to NULL is necesarry since attribute does not have to be a pointer. This patch however sets pointer type attributes to NULL since it may simplify the code path when the caller is actually interested in this information (e. g. empty server list on domain objects). It is not possible to send a NULL string over a D-Bus nor it is possible to have hash table NULL with current code so these two scenarios are not tested. However, it is handled in sss_sifp_attr code for completeness. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_sifp test: fix object path array testPavel Březina2014-07-161-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: augmented logging when adding new groupPavel Reichl2014-07-152-16/+81
| | | | | | | | | | | This patch adds some more log messages to functionality of storing groups into sysdb. As these functions are low level and failures are often handled on higher levels the commonly chosen level is SSSDBG_TRACE_LIBS. Resolves: https://fedorahosted.org/sssd/ticket/2239 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sudo: fetch sudoRunAs attributePavel Březina2014-07-157-0/+7
| | | | | | | | | | | | | | | | | | This attribute was used in pre 1.7 versions of sudo and it is now deprecated by sudoRunAsUser and sudoRunAsGroup. However, some users still use this attribute so we need to support it to ensure backward compatibility. This patch makes sure that this attribute is downloaded if present and provided to sudo. Sudo than decides how to handle it. The new mapping option is not present in a man page since this attribute is deprecated in sudo for a very long time. Resolves: https://fedorahosted.org/sssd/ticket/2212 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Document that each provider type uses its own set of optionsJakub Hrozek2014-07-141-1/+4
| | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2281 Many users were configuring the combination of id_provider=ad access_provider=ldap expecting that the access_provider would use the same serves the id_provider does. That's not the case, each provider type must be configured separately. Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* MAN: local auth_provider is not documented in sssd.confJakub Hrozek2014-07-141-0/+4
| | | | | | | | https://fedorahosted.org/sssd/ticket/2359 Reported by Stephan Mueller. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* resolv: fix server sort by weightPavel Březina2014-07-141-6/+2
| | | | | | | | | | When the server list consist only from servers with zero weight the output list contained only one server. Resolves: https://fedorahosted.org/sssd/ticket/2357 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* resolv tests: add test for multiple servers with zero weightsPavel Březina2014-07-141-0/+64
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2357 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* resolv tests: remove ununused variable from for cyclusPavel Březina2014-07-141-1/+1
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Updating the version for the 1.12.1 developmentJakub Hrozek2014-07-091-1/+1
|
* Updating the version for the 1.12.0 releasesssd-1_12_0Jakub Hrozek2014-07-091-1/+1
|
* Updating translations for the 1.12.0 releaseJakub Hrozek2014-07-0936-1153/+1307
|
* CONTRIB: Fix creation of tar.gz with old version of gitLukas Slebodnik2014-07-091-3/+3
| | | | | | | | | | git archive needn't have support for tar.gz format: [testm1 contrib]# git --version git version 1.7.1 Thanks Sami K Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CONTRIB: make_srpm.sh can prepare SRPM with patchesLukas Slebodnik2014-07-091-8/+54
| | | | | | | | | | | | | | | | Creating SRPM with patches is useful for some static analysers, which can do two builds. The first time without patches and the second with patches. Bash function add_patches is inspired by file rpm/add_patches.sh from project\ 389-ds-base. commit 2a92a6cccd1002f4fe976ee7a5b79d779b009f87 Author: Mark Reynolds Thanks. Resolves: https://fedorahosted.org/sssd/ticket/2149 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: Test right variable after calling sss_atomic_read_sLukas Slebodnik2014-07-091-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TOOLS: Always debug to stderrJakub Hrozek2014-07-0941-40/+48
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2348 Programs that are supposed to only be executed on the foreground should log to stderr automatically. Reviewed-by: Michal Židek <mzidek@redhat.com>
* SSSD: Send debug to stderr when running on foregroundJakub Hrozek2014-07-095-2/+37
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2348 When SSSD is running in interactive mode, we should print DEBUG messages directly to stderr, not journal. Reviewed-by: Michal Židek <mzidek@redhat.com>
* BUILD: Link sdap-tests with openldap librariesLukas Slebodnik2014-07-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | sdap-tests uses functions from openldap, but it was not linked with libldap or liblber. sh-4.2$ nm --undefined-only .libs/sdap-tests | grep -E "ldap|ber" U ber_free U ldap_control_create U ldap_err2string U ldap_get_option U ldap_init_fd U ldap_install_tls U ldap_is_ldaps_url U ldap_unbind_ext sdap-tests cannot be linked on platfrms with disabled link_all_deplibs. CCLD sdap-tests /usr/bin/ld: src/providers/ldap/sdap_tests-sdap.o: undefined reference to symbol 'ber_free' /usr/bin/ld: note: 'ber_free' is defined in DSO /lib64/liblber-2.4.so.2 so try adding it to the linker command line /lib64/liblber-2.4.so.2: could not read symbols: Invalid operation clang: error: linker command failed with exit code 1 (use -v to see invocation) make[3]: *** [sdap-tests] Error 1 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sdap-tests: Fix off by one.Lukas Slebodnik2014-07-091-1/+2
| | | | | | | | | | | | | | | | | | | | | | | Function sss_base64_decode does not return NUL terminated string and it causes valgrind warning in test "Invalid read of size 1" ==30954== Invalid read of size 1 ==30954== at 0x4A09FB8: strcmp (mc_replace_strmem.c:730) ==30954== by 0x4C2AAFA: _assert_string_equal (in /usr/lib64/libcmocka.so.0.2.1) ==30954== by 0x407DBA: test_parse_with_map (test_sdap.c:285) ==30954== by 0x4C2C817: _run_test (in /usr/lib64/libcmocka.so.0.2.1) ==30954== by 0x4C2CCF8: _run_tests (in /usr/lib64/libcmocka.so.0.2.1) ==30954== by 0x408A6F: main (test_sdap.c:583) ==30954== Address 0x6a8db34 is 0 bytes after a block of size 100 alloc'd ==30954== at 0x4A0645D: malloc (vg_replace_malloc.c:291) ==30954== by 0x35C8204980: _talloc_memdup (talloc.c:613) ==30954== by 0x5080A4B: sss_base64_decode (nss_base64.c:86) ==30954== by 0x407DA0: test_parse_with_map (test_sdap.c:282) ==30954== by 0x4C2C817: _run_test (in /usr/lib64/libcmocka.so.0.2.1) ==30954== by 0x4C2CCF8: _run_tests (in /usr/lib64/libcmocka.so.0.2.1) ==30954== by 0x408A6F: main (test_sdap.c:583) Reviewed-by: Pavel Reichl <preichl@redhat.com>
* BUILD: Add version symbol files for public libraries.Lukas Slebodnik2014-07-095-3/+119
| | | | | | | | | | | | | | | | Version symbol files will help package systems to catch backward compatible changes (newly added functions) into library. The difference between libraries libsss_nss_idmap_test.so and libsss_nss_idmap.so is that the 1st library will not be installed and has more exported functions, which are necessary for mocking with cmocka for test sss_nss_idmap-test. Resolves: https://fedorahosted.org/sssd/ticket/2194 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: touch config when changing debug level temporarilyPavel Březina2014-07-091-0/+13
| | | | | | | If we want the debug level to switch back to the value from configuration file we need to touch sssd.conf so it is reloaded. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sss_sifp: add prefix and exec_prefix to pkg-configPavel Březina2014-07-091-0/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_sifp: pkg-config requires is a comma separated listPavel Březina2014-07-091-2/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Add the DBus service activationJakub Hrozek2014-07-084-0/+10
| | | | | | | | The system bus has the ability to start services on demant. This patch adds the sysbus service activation file that, currently, only calls the sss_signal tool to signal the monitor. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TOOLS: New helper tool sss_signalJakub Hrozek2014-07-083-1/+50
| | | | | | | | A minimal tool whose only purpose is to signal the monitor with SIGUSR2. The tool will be executed by the system bus in order to provide system activation, so it's packaged in libexec. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* MONITOR: Signal InfoPipe to reconnect on SIGUSR2Jakub Hrozek2014-07-081-0/+9
| | | | | | | | When the monitor receives SIGUSR2, it also signals the IFP responder to attempt to reconnect to the system bus using the sysbusReconnect SBUS method. No action is taken by other responders. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Provide a SBUS method to reconnect to sysbusJakub Hrozek2014-07-0811-1/+58
| | | | | | | | | Introduces a new method implemented only by the IFP responder. When this method is received, the responder attempts to reconnect to the system bus, if not connected already. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IFP: Return a specific value on failure connecting to the system busJakub Hrozek2014-07-083-2/+8
| | | | | | | | We need to treat the failure to connect to the system bus as non-fatal. In this commit, we introduce a special error code and only print a DEBUG message when this error code is returned from the startup function. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Fix DEBUG messagesJakub Hrozek2014-07-081-7/+9
| | | | | | | The DEBUG messages in the IFP responder predated Nikolai's mass-patches and were not converted correctly. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BUILD: dbusintrospectdir is not used anymoreJakub Hrozek2014-07-081-3/+0
| | | | | | | We fprintf the introspection data on demand rather than printing an XML file. The directory specification can be removed. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Free bervals on failure in sdap_parse_entryJakub Hrozek2014-07-081-2/+10
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* SDAP: Remove unused function sdap_get_msg_dnJakub Hrozek2014-07-082-34/+0
| | | | | | | This function was not used since 2009. Unused and untested function would just rot, better to remove it completely. Reviewed-by: Michal Židek <mzidek@redhat.com>
generated by cgit (git 2.34.1) at 2024-07-02 14:25:49 +0000