summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* WIPnonroot-libcapJakub Hrozek2014-10-081-1/+7
|
* TESTS: Fix krb5_child testJakub Hrozek2014-10-082-1/+19
|
* RPM: Change file ownership to sssd.sssdJakub Hrozek2014-10-071-11/+15
|
* UTIL: Prefer libcap-ng for privilege drop operationsJakub Hrozek2014-10-076-15/+81
|
* NSS: Run as a user specified by monitorJakub Hrozek2014-10-072-1/+5
|
* SSSD: Load a user to run a service as from configurationJakub Hrozek2014-10-076-1/+111
|
* SBUS: Allow connections from other UIDsJakub Hrozek2014-10-073-0/+27
|
* SBUS: Chown the sbus socket if neededJakub Hrozek2014-10-077-7/+20
|
* BUILD: Add a config option for sssd user, own private directories as the userJakub Hrozek2014-10-073-6/+53
| | | | | | | | Adds two new configure-time options that let you select the user to run SSSD as. The default is 'root' for backwards compatibility. The directories the deamon stores its private data at are also created as owned by this user during install time.
* UTIL: Add a function to convert id_t from a number or a nameJakub Hrozek2014-10-076-7/+211
|
* TESTS: Unit tests for server_setupJakub Hrozek2014-10-072-0/+266
| | | | FIXME - check the PID was created as the user in question.
* TESTS: unit tests can use confdb without using sysdbJakub Hrozek2014-10-071-24/+28
|
* UTIL: Add the possibility to unit test server_setupJakub Hrozek2014-10-071-4/+23
|
* SSSD: Add the possibility to specify a UID and GID to run asJakub Hrozek2014-10-0713-12/+58
|
* UTIL: Do not depend on monitor codeJakub Hrozek2014-10-076-39/+39
| | | | | Just moves code around. There should be a way to use the server.c module without linking the monitor code.
* TESTS: Add a test to change user IDsJakub Hrozek2014-10-079-1/+236
|
* BUILD: Detect nss_wrapper and uid_wrapper during configureJakub Hrozek2014-10-072-0/+34
| | | | | | Unit testing the utilities to become another user requires the use of the cwrap libraries. This patch augments our build system with macros to detect the nss_wrapper and and uid_wrapper libraries.
* UTIL: Move become_user outside krb5 treeJakub Hrozek2014-10-074-17/+21
| | | | | | In order for several other SSSD processes to run as a non-root user, we need to move the functions to become another user to a shared space in our source tree.
* MONITOR: Remove useless memory contextsJakub Hrozek2014-10-071-12/+2
|
* BUILD: Use $(MKDIR_P) in Makefile.amJakub Hrozek2014-10-062-13/+20
| | | | | | | | | It was suggested by the Fedora automake maintainer to use the autoconf macro $(MKDIR_P) instead of calling "mkdir -p" directly as the macro is more portable and might actually expand to something else than "mkdir -p" on some platforms (usually it would be a variant of install.sh) Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: move sysdb_get_real_name() from sysdb.c to sysdb_search.cJakub Hrozek2014-10-064-53/+104
| | | | | | | | | | | The sysdb.c should be reserved for utility and setup functions. Search functions belong to sysdb_search.c Keeping functions in specialized modules helps to maintain nice dependencies and in overall makes unit testing easier. Moreover, the function was not unit tested, which needed fixing. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MONITOR: Make internal functions staticJakub Hrozek2014-10-062-16/+13
| | | | | | | Several functions in the monitor.c file were not marked as static even though they were only used inside monitor.c Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* GPO: remove unused talloc contextsLukas Slebodnik2014-10-031-11/+8
| | | | | | | Talloc context was not used in functions ad_gpo_parse_gpo_child_response ad_gpo_process_cse_recv, ad_gpo_store_policy_settings. Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* GPO: Use argument ndg_flags instead of constantLukas Slebodnik2014-10-031-6/+6
| | | | | | | | | | | | Some internal gpo functions [1] were called just once and with constant NDR_SCALARS as 2nd argument(ndr_flags), but 2nd argument was not used in these functions[1]. They used constant NDR_SCALARS. [1] ndr_pull_security_ace_flags, ndr_pull_security_ace_type, ndr_pull_security_ace_object_flags, ndr_pull_security_acl_revision, ndr_pull_security_descriptor_revision, ndr_pull_security_descriptor_type Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* AD-GPO resolve conflicting policy settings correctlyYassir Elley2014-10-024-555/+743
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2437 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* AD GPO: Fix incorrect return of EACCESStephen Gallagher2014-10-021-2/+2
| | | | | | | | | | | | In the access providers, we expect to receive ERR_ACCESS_DENIED when access is denied, but we were returning EACCES here. The effect was the same, except that it presented ultimately as a system error instead of a proper denial. Related: https://fedorahosted.org/sssd/ticket/2437 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Document the domains option of pam_sssJakub Hrozek2014-10-011-0/+27
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* nss: Preserve case of group membersMichal Zidek2014-10-011-1/+1
| | | | | | | | | | Preserve case of group members in getgrnam when 'case_sensitive = preserving' is set. Fixes: https://fedorahosted.org/sssd/ticket/2453 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* pam: sub-domain authentication fixSumit Bose2014-10-011-1/+11
| | | | | | | | | | With a recent patch sysdb_getpwnam() was replaced by sysdb_get_user_by_name() in the PAM responder. Unfortunately both behave differently with respect to sub-domain users. As a consequence the PAM responder was not able to resolve users from sub-domains. This patch reverts this change and uses sysdb_getpwnam() again. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* sssd.api.conf: Declare case_sensitive as stringMichal Zidek2014-10-011-1/+1
| | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/2452 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: add support for new extdom plugin versionSumit Bose2014-09-301-87/+802
| | | | | | | | | | | | | | | | | | | Initially the extdom plugin was only used to translate SIDs of AD user and groups to names or POSIX IDs. On IPA clients group memberships were resolved with the help of the PAC in the Kerberos ticket which required that the user has logged in at least once. Home directory and the login shell were auto generated. The new version of the extdom plugin can return the complete list of group memberships of a user and the list of all members of a group. Additionally the gecos field, home directory and login shell are returned together with an optional list of key-value pairs for arbitrary data which is written unmodified to the cache. Fixes https://fedorahosted.org/sssd/ticket/2159 and https://fedorahosted.org/sssd/ticket/2041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Do not require a dereference control to be retuned in a replyJakub Hrozek2014-09-291-1/+6
| | | | | | | | | When we attempt to request attributes that are not present in the dereferenced links, some serves might not send the dereference control back at all. Be permissive and treat the search as if it didn't find anything. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM: Add domains= option to pam_sssDaniel Gollub2014-09-294-3/+79
| | | | | | | | | | | | | | Design document: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Fixes: https://fedorahosted.org/sssd/ticket/1021 Signed-off-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Sven-Thorsten Dietrich <sven@brocade.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: new options pam_trusted_users & pam_public_domainsPavel Reichl2014-09-299-3/+299
| | | | | | | | | | | | | pam_public_domains option is a list of numerical UIDs or user names that are trusted. pam_public_domains option is a list of domains accessible even for untrusted users. Based on: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD: Add a missing break statement to the GPO codeJakub Hrozek2014-09-291-1/+2
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* AD GPO: Fix incorrect sAMAccountName selectionStephen Gallagher2014-09-291-2/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: make get_primary() a public callStephen Gallagher2014-09-292-3/+13
| | | | | | | This patch changes get_primary() into sss_krb5_get_primary() so it can be used by the AD provider to get the sAMAccountName from the hostname. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fix debug messages - trailing '.'Pavel Reichl2014-09-294-4/+4
| | | | | | Fix debug messages where '\n' was wrongly followed by '.'. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Use GC for group lookups in server modeJakub Hrozek2014-09-251-5/+9
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2412 Even though AD trusts often work with POSIX attributes which are normally not replicated to GC, our group lookups are smart since commit 008e1ee835602023891ac45408483d87f41e4d5c and look up the group itself using the LDAP connection and only use the GC connection to look up the members. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* CI: Don't say Valgrind is ignored in README.mdNikolai Kondrashov2014-09-251-2/+1
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* TESTS: Add a unit test for matching the secondary objectclassJakub Hrozek2014-09-251-0/+37
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Do not change SSSD domains in get_domains_headStephen Gallagher2014-09-241-3/+0
| | | | | | | | | | When there was more than one SSSD domain configured, actions performed against domains later in the list would be incorrectly told to use the first domain as the base for locating subdomains. This was because we were rewinding the ->prev list on the sss_domain_info object, which is only intended to be used by confdb code. The correct approach was to use only the parent linkage, which would take us up to the top-level domain in this SSSD domain.
* CI: Use default config for mock buildLukas Slebodnik2014-09-221-6/+5
| | | | | | | | | | | | | | | The mock config with name default is usually symbolic link to the configuration file of local architecture. The side effect of this patch is that we will not try to rebuild on old architectures src.rpm for new architectures(fedora). It caused issues with mock tmpfs plugin. Resolves: https://fedorahosted.org/sssd/ticket/2441 Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* CI: Remove disabling of Valgrind gdb invocationNikolai Kondrashov2014-09-221-1/+0
| | | | | | | | Remove --vgdb=no option from CI's Valgrind invocation, as default condition for starting gdb (--vgdb-error=999999999) is highly unlikely and therefore this option is unnecessary. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CI: Enforce Valgrind checkNikolai Kondrashov2014-09-221-1/+1
| | | | | | Add check for Valgrind test result to contrib/ci/run. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CI: Suppress all detected Valgrind issuesNikolai Kondrashov2014-09-221-0/+102
| | | | | | | | | | Add suppressions for all issues detected by Valgrind during CI runs. These seem to be false positives, or cannot be fixed. Resolves: https://fedorahosted.org/sssd/ticket/2428 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CI: Add Valgrind suppression supportNikolai Kondrashov2014-09-223-3/+18
| | | | | | | | | | | | | | | | Add an empty Valgrind suppressions file, use it when invoking Valgrind. This prepares for addition of Valgrind suppressions for current false positives and issues that cannot be fixed, preparing for enforcing Valgrind check. Make Valgrind output a suppression for every error and make it output used suppression names and counts at the end of each run. This simplifies discovery and addition of new suppressions and removal of unused ones. Related to https://fedorahosted.org/sssd/ticket/2428 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CI: Don't run dlopen-tests under ValgrindNikolai Kondrashov2014-09-221-1/+2
| | | | | | | | Disable running dlopen-tests under Valgrind as their use of dlclose makes Valgrind drop symbols and produce meaningless backtraces, which cannot be matched with specific suppressions. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* tests: Add a test for storing custom attrs with automatic IDJakub Hrozek2014-09-181-0/+51
| | | | Reviewed-by: Daniel Gollub <dgollub@brocade.com>
* MAN: AD is allowed value of subdomains_providerJakub Hrozek2014-09-181-0/+9
| | | | | | https://fedorahosted.org/sssd/ticket/2442 Reviewed-by: Pavel Reichl <preichl@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-27 03:46:04 +0000