summaryrefslogtreecommitdiffstats
path: root/src/providers/krb5
Commit message (Collapse)AuthorAgeFilesLines
* Remove unneeded become_user() callsnonrootJakub Hrozek2014-11-281-22/+2
|
* KRB5: Create the fast ccache in a child processJakub Hrozek2014-11-281-25/+76
|
* KRB5: Pass the sssd_be uid and gid to krb5_childJakub Hrozek2014-11-281-0/+9
|
* krb5/ldap: use MEMORY ccache and keytab in *_child processesSumit Bose2014-11-281-0/+33
|
* krb5: add copy_keytab_into_memory()Sumit Bose2014-11-282-0/+153
|
* krb5: add copy_ccache_into_memory()Sumit Bose2014-11-282-0/+108
|
* krb5: Check return value of sss_krb5_princ_realmLukas Slebodnik2014-11-282-0/+13
| | | | | | | | | | sss_krb5_princ_realm set output parameter realm to NULL and len to 0 in case of failure. Clang static analysers reported warning "Null pointer passed as an argument to a 'nonnull' parameter" in function match_principal. It was possible, that realm_name with value NULL could be used in strncmp. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* KRB5: Move all ccache operations to krb5_child.cJakub Hrozek2014-11-185-244/+267
| | | | | | | | | | | | | | | | | | | The credential cache operations must be now performed by the krb5_child completely, because the sssd_be process might be running as the sssd user who doesn't have access to the ccaches. src/providers/krb5/krb5_ccache.c is still linked against libsss_krb5 until we fix Kerberos ticket renewal as non-root. Also includes a new error code that indicates that the back end should remove the old ccache attribute -- the child can't do that if it's running as the user. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Move checking for illegal RE to krb5_utils.cJakub Hrozek2014-11-185-48/+42
| | | | | | | | | | | | Otherwise we would have to link krb5_child with pcre and transfer the regex, which would be cumbersome. Check for illegal patterns when expanding the template instead. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Move ccache-related functions to krb5_ccache.cJakub Hrozek2014-11-189-709/+783
| | | | | | | | | | | | | Add a new module krb5_ccache.c that contains all ccache-related operations. The only user of this module shall be krb5_child.c as the other modules will run unprivileged and accessing the ccache requires either privileges of root or the ccache owner. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Drop privileges in the child, not the back endJakub Hrozek2014-11-182-21/+56
| | | | | | | | | | | | | | | | | | In future patches, sssd_be will be running as a non-privileged user, who will execute the setuid krb5_child. In this case, the child will start as root and drop the privileges as soon as possible. However, we need to also remove the privilege drop in sssd_be, because if we dropped to the user who is authenticating, we wouldn't be even allowed to execute krb5_child. The krb5_child permissions should be 4750, owned by root.sssd, to make sure only root and sssd can execute the child and if executed by sssd, the child will run as root. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PAM: Remove authtok from PAM stack with OTPLukas Slebodnik2014-11-071-0/+14
| | | | | | | | | | | We remove the password from the PAM stack when OTP is used to make sure that other pam modules (pam-gnome-keyring, pam_mount) cannot use it anymore and have to request a password on their own. Resolves: https://fedorahosted.org/sssd/ticket/2287 Reviewed-by: Nathaniel McCallum <npmccallum@redhat.com>
* UTIL: Remove more code duplication setting up child processesJakub Hrozek2014-11-051-16/+8
| | | | | | | | All our child processes duplicated the same code that set up the debugging all around. Instead of adding yet another copy for the selinux_child, add a common utility function. Reviewed-by: Michal Židek <mzidek@redhat.com>
* UTIL: Remove code duplication of struct ioJakub Hrozek2014-11-051-36/+2
| | | | | | | | We had struct io and the associated destructor copied twice in the code already and need it again in the SELinux provider. Instead of adding another copy, move the code to a shared subtree under util/ Reviewed-by: Michal Židek <mzidek@redhat.com>
* UTIL: Move become_user outside krb5 treeJakub Hrozek2014-10-102-207/+0
| | | | | | | | In order for several other SSSD processes to run as a non-root user, we need to move the functions to become another user to a shared space in our source tree. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Fix debug messages - trailing '.'Pavel Reichl2014-09-291-1/+1
| | | | | | Fix debug messages where '\n' was wrongly followed by '.'. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: rename find_subdomain_by_namePavel Reichl2014-07-221-2/+2
| | | | | | | | | The function was named "find_subdomain" yet it could find both main domain and subdomain. sed 's/find_subdomain_by_name/find_domain_by_name/' -i `find . -name "*.[ch]"` Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: add missing debug-to-stderr option to krb5_childSumit Bose2014-07-201-0/+3
| | | | | | Without this option krb5_child cannot be run in interactive mode. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: Go offline in case of generic errorPavel Reichl2014-04-171-0/+1
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2313
* KRB: do not check ccache directory for GIDPavel Reichl2014-04-171-7/+4
|
* krb5_child: Fix use after free in debug messageLukas Slebodnik2014-04-081-11/+15
| | | | | | | | | | debug_prg_name is used in debug_fn and it was allocated under talloc context "kr". The variable "kr" was removed before the last debug messages in function main. It is very little change that it will be overridden. It is possible to see this issue with exported environment variable TALLOC_FREE_FILL=255 Reviewed-by: Sumit Bose <sbose@redhat.com>
* krb5_child: Remove unused krb5_context from set_changepw_optionsLukas Slebodnik2014-04-071-4/+3
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* KRB5: Do not attempt to get a TGT after a password change using OTPJakub Hrozek2014-03-262-3/+30
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2271 The current krb5_child code attempts to get a TGT for the convenience of the user using the new password after a password change operation. However, an OTP should never be used twice, which means we can't perform the kinit operation after chpass is finished. Instead, we only print a PAM information instructing the user to log out and back in manually. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* krb5-child: add revert_changepw_options()Sumit Bose2014-03-211-0/+22
| | | | | | | | | | After changing the Kerberos password krb5-child will try to get a fresh TGT with the new password. This patch tries to make sure the right gic options are used. Resolves: https://fedorahosted.org/sssd/ticket/2289 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5_client: rename krb5_set_canonicalize() to set_canonicalize_option()Sumit Bose2014-03-211-16/+16
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5-child: extract lifetime settings into set_lifetime_options()Sumit Bose2014-03-211-36/+55
| | | | | | | | Additionally the lifetime option flags are unset if there are no explicit settings to make sure the defaults from krb5.conf are used even if other values were set manually in between. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5_child: remove unused option lifetime_str from k5c_setup_fast()Sumit Bose2014-03-211-6/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: log message - wrong permissions on ccache dirPavel Reichl2014-03-181-2/+3
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2037 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* refactor calls of sss_parse_namePavel Reichl2014-03-181-2/+1
| | | | | | | sss_parse_name now supports NULL as output parameters so existing calls passing arguments which were never read were substituted by NULL. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB: Prevent dereference of a null pointerLukas Slebodnik2014-03-131-2/+4
| | | | | | | | | | | | | Reported by: scan-build krb5_free_principal(cc->context, ccprinc); ^~ warning: Access to field 'context' results in a dereference of a null pointer (loaded from variable 'cc') Variable 'cc' needn't be initialised if function sss_open_ccache_as_user fails. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA/KRB5: handle KRB5_PROG_ETYPE_NOSUPP during IPA password migrationSumit Bose2014-03-121-0/+4
| | | | | | Fixes https://fedorahosted.org/sssd/ticket/2279 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fix krb5 changepw when FAST-only preauth methods are used (like OTP)Nathaniel McCallum2014-03-101-34/+6
| | | | | | | | | | | | | | | | | | | | | Before this patch, a different set of options was used when calling krb5_get_init_creds_password() for the changepw principal. Because this set of options did not contain the same FAST settings as the options for normal requests, all authentication would fail when the password of a FAST-only account would expire. The two sets approach was cargo-cult from kinit where multiple requests could be issued using the same options set. However, in the case of krb5_child, only one request (or occasionally a well-defined second request) will be issued. Two option sets are therefore not required. To fix this problem we removed the second option set used for changepw requests. All requests now use a single option set which is modified, if needed, for well-defined subsequent requests. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* KRB5: Fix condition for empty stringLukas Slebodnik2014-02-261-1/+1
| | | | | | | | | | | | Reported by: cppcheck Finding the same expression on both sides of an operator || is suspicious and might indicate a cut and paste or logic error. Resolves: https://fedorahosted.org/sssd/ticket/2258 Reviewed-by: Michal Žídek <mzidek@redhat.com>
* Update DEBUG* invocations to use new levelsNikolai Kondrashov2014-02-1211-328/+445
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG* macro invocations, which use literal numbers for levels, to use bitmask macros instead: grep -rl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e 'use strict; use File::Slurp; my @map=qw" SSSDBG_FATAL_FAILURE SSSDBG_CRIT_FAILURE SSSDBG_OP_FAILURE SSSDBG_MINOR_FAILURE SSSDBG_CONF_SETTINGS SSSDBG_FUNC_DATA SSSDBG_TRACE_FUNC SSSDBG_TRACE_LIBS SSSDBG_TRACE_INTERNAL SSSDBG_TRACE_ALL "; my $text=read_file(\*STDIN); my $repl; $text=~s/ ^ ( .* \b (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM) \s* \(\s* )( [0-9] )( \s*, ) ( \s* ) ( .* ) $ / $repl = $1.$map[$3].$4.$5.$6, length($repl) <= 80 ? $repl : $1.$map[$3].$4."\n".(" " x length($1)).$6 /xmge; print $text; ' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make DEBUG macro invocations variadicNikolai Kondrashov2014-02-1212-681/+681
| | | | | | | | | | | | | | | | | | | | | | | | Use a script to update DEBUG macro invocations to use it as a variadic macro, supplying format string and its arguments directly, instead of wrapping them in parens. This script was used to update the code: grep -rwl --include '*.[hc]' DEBUG . | while read f; do mv "$f"{,.orig} perl -e \ 'use strict; use File::Slurp; my $text=read_file(\*STDIN); $text=~s#(\bDEBUG\s*\([^(]+)\((.*?)\)\s*\)\s*;#$1$2);#gs; print $text;' < "$f.orig" > "$f" rm "$f.orig" done Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* krb5: hint to increase krb5_auth_timeoutPavel Reichl2014-01-221-1/+4
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2202
* FAST: when parsing krb5_child response, make sure to not miss OTP message if ↵Alexander Bokovoy2014-01-091-3/+4
| | | | | | | | | | | | | it was last one The last message in the stream might be with empty payload which means we get only message type and message length (0) returned, i.e. 8 bytes left remaining in the stream after processing preceding message. This makes our calculation at the end of a message processing loop incorrect -- p+2*sizeof(int32_t) can be equal to len, after all. Fixes FAST processing for FreeIPA native OTP case: https://fedorahosted.org/sssd/ticket/2186
* KRB5: Go offline in case of clock skewJakub Hrozek2013-11-291-0/+1
| | | | | | | | https://fedorahosted.org/sssd/ticket/1096 In case the KDC has skewed time, we can retry with the next one and eventually go offline if no KDC has time in sync with the client. Previously, authentication with wrong time resulted in System Error.
* Remove unused parameter from krb5_auth_store_credsLukas Slebodnik2013-11-271-3/+2
|
* Remove unused parameter from krb5_auth_cache_credsLukas Slebodnik2013-11-271-3/+0
|
* krb5: Alignment warning reported by clangMichal Zidek2013-11-151-7/+7
| | | | | | | Do not store address from byte buffer into pointer of diffrent type! https://fedorahosted.org/sssd/ticket/1359
* SYSDB: Drop the sysdb_ctx parameter - module sysdb_ops (part 2)Michal Zidek2013-11-151-2/+2
|
* SYSDB: Drop the sysdb_ctx parameter - module sysdb_ops (part 1)Michal Zidek2013-11-151-1/+1
|
* SYSDB: Drop the sysdb_ctx parameter from the sysdb_search moduleMichal Zidek2013-11-153-5/+5
|
* Signals: Refactor termination of processesSimo Sorce2013-11-121-1/+1
| | | | | | | | sig_term() was never used as a real signal handler, but only called by tevent signal handlers in the kerberos and ldap children. Also the same code was duplicated with separate local guard variables in other functions. Unify orderly termination handling, between all these functions.
* Include ext headers with #include <foo.h> - contPavel Reichl2013-11-041-1/+1
| | | | Changing style of including header files from outside of sssd tree - from "header.h" to <header.h>
* KRB5: Handle ERR_CHPASS_FAILEDJakub Hrozek2013-10-291-0/+6
| | | | | | | The Kerberos provider didn't handle ERR_CHPASS_FAILED at all, which resulted in the default return code (System Error) to be returned if password change failed for pretty much any reason, including password too recent etc.
* krb5: Use right function to free data.Lukas Slebodnik2013-10-221-1/+2
| | | | | | | In function create_empty_cred, krb5_creds was aloocated using calloc, but krb5_free_creds was used to remove this creds in done section. Therefore clang static analyzer repoted this as warning: Potential leak of memory pointed to by 'cred'
* krb5: Remove warning dereference of a null pointerLukas Slebodnik2013-10-171-4/+2
| | | | | | | | | Variable kr->creds is initialized in function krb5_get_init_creds_password. It does not make sense to check kr->creds for null, because we have already checked return value of function krb5_get_init_creds_password. Resolves: https://fedorahosted.org/sssd/ticket/2112
* KRB5: Return PAM_ACCT_EXPIRED when logging in as expired AD userJakub Hrozek2013-10-172-0/+9
| | | | | | | If an expired AD user logs in, the SSSD receives KRB5KDC_ERR_CLIENT_REVOKED from the KDC. This error code was not handled by the SSSD which resulted in System Error being returned to the PAM stack.
generated by cgit (git 2.34.1) at 2024-05-03 03:04:12 +0000