summaryrefslogtreecommitdiffstats
path: root/src/util
Commit message (Collapse)AuthorAgeFilesLines
* KRB5: Do not switch_creds() if already the specified userJakub Hrozek2014-11-181-8/+21
| | | | | | | | | | | | | | The code didn't have to handle this case previously as sssd_be was always running as root and switching to the ccache as the user logging in. Also handle NULL creds on restore_creds() in case there was no switch. One less if-condition and fewer indentation levels. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB5: Move all ccache operations to krb5_child.cJakub Hrozek2014-11-182-0/+2
| | | | | | | | | | | | | | | | | | | The credential cache operations must be now performed by the krb5_child completely, because the sssd_be process might be running as the sssd user who doesn't have access to the ccaches. src/providers/krb5/krb5_ccache.c is still linked against libsss_krb5 until we fix Kerberos ticket renewal as non-root. Also includes a new error code that indicates that the back end should remove the old ccache attribute -- the child can't do that if it's running as the user. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Move setting the SELinux context to a child processJakub Hrozek2014-11-052-0/+2
| | | | | | | | In order for the sssd_be process to run as unprivileged user, we need to move the semanage processing to a process that runs as the root user using setuid privileges. Reviewed-by: Michal Židek <mzidek@redhat.com>
* UTIL: Remove more code duplication setting up child processesJakub Hrozek2014-11-052-0/+31
| | | | | | | | All our child processes duplicated the same code that set up the debugging all around. Instead of adding yet another copy for the selinux_child, add a common utility function. Reviewed-by: Michal Židek <mzidek@redhat.com>
* UTIL: Remove code duplication of struct ioJakub Hrozek2014-11-052-0/+36
| | | | | | | | We had struct io and the associated destructor copied twice in the code already and need it again in the SELinux provider. Instead of adding another copy, move the code to a shared subtree under util/ Reviewed-by: Michal Židek <mzidek@redhat.com>
* LDAP: Move sss_krb5_verify_keytab_ex to ldap_childJakub Hrozek2014-11-052-79/+0
| | | | | | | | The function was called from one place only, so it makes no sense to keep it in a shared module. Moreover, the function should only be called from code that runs as root. Reviewed-by: Michal Židek <mzidek@redhat.com>
* Add add_strings_lists() utility functionSumit Bose2014-11-052-0/+83
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Add a function to convert id_t from a number or a nameJakub Hrozek2014-10-223-0/+47
| | | | | | | | | | | | We need a custom function that would convert a numeric or string input into uid_t. The function will be used to drop privileges in servers and also in the PAC and IFP responders. Includes a unit test to test all code that changed as well as a fix for a misnamed attribute in the csv_to_uid_list function synopsis. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* UTIL: Use a custom PID_PATH and DB_PATH when unit testing server.cJakub Hrozek2014-10-201-4/+31
| | | | | | | | | server.c used hardcoded PID_PATH and DB_PATH from config.h. Normally, this path resides in a system directory (like /var/) and should not be written to by tests. In order to specify a different one for tests, we need to conditionalize normal builds and unit test builds. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SSSD: Chown the log filesJakub Hrozek2014-10-203-0/+40
| | | | | | | | | We need to chown the log files before dropping root to make sure they are usable by the SSSD user. Unfortunately, we can't just rely on passing the fd opened by root, because we need to be also able to rotate the log files. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SSSD: Add the options to specify a UID and GID to run asJakub Hrozek2014-10-202-0/+15
| | | | | | | | | Adds new command line options --uid and --gid to all SSSD servers, making it possible to switch to another user ID if needed. So far all code still runs as root. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* sss_semanage: Add mlsrange parameter to set_seuserMichal Zidek2014-10-202-10/+18
| | | | | | | mlsrange parameter will be needed in IPA provider and probably at some point in the tools as well. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* util: Move semanage related functions to src/utilMichal Zidek2014-10-202-0/+364
| | | | | | These functions will be reused by IPA provider. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb: add overide lookup callsSumit Bose2014-10-201-0/+3
| | | | | | | | | | | sysdb_search_user_override_by_name() and sysdb_search_group_override_by_name() search for overrides in the given view. sysdb_add_overrides_to_object() adds the data from the override object to the original object and makes them available for further processing. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* new_subdomain: copy view data from parentSumit Bose2014-10-201-0/+11
| | | | | | | Since a view applies to the whole domain-subdomain tree the view data is copied from the parent the new created domains. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Always write capathsJakub Hrozek2014-10-162-38/+34
| | | | | | | | | We used to only generate the [capaths] section on the IPA server itself, when running in a trusted setup. But we also found out that the capaths are often required to make SSO fully work, so it's better to always generate them. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* sss_get_domain_name: check for fq name firstPavel Březina2014-10-141-1/+13
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NSS: UPN as a template expansion for homedir mappingsPavel Reichl2014-10-122-0/+12
| | | | | | | Fixes: https://fedorahosted.org/sssd/ticket/2340 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Move become_user outside krb5 treeJakub Hrozek2014-10-102-0/+207
| | | | | | | | In order for several other SSSD processes to run as a non-root user, we need to move the functions to become another user to a shared space in our source tree. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Do not depend on monitor codeJakub Hrozek2014-10-092-1/+37
| | | | | | | Just moves code around. There should be a way to use the server.c module without linking the monitor code. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM: new options pam_trusted_users & pam_public_domainsPavel Reichl2014-09-292-0/+65
| | | | | | | | | | | | | pam_public_domains option is a list of numerical UIDs or user names that are trusted. pam_public_domains option is a list of domains accessible even for untrusted users. Based on: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5: make get_primary() a public callStephen Gallagher2014-09-292-3/+13
| | | | | | | This patch changes get_primary() into sss_krb5_get_primary() so it can be used by the AD provider to get the sAMAccountName from the hostname. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Do not change SSSD domains in get_domains_headStephen Gallagher2014-09-241-3/+0
| | | | | | | | | | When there was more than one SSSD domain configured, actions performed against domains later in the list would be incorrectly told to use the first domain as the base for locating subdomains. This was because we were rewinding the ->prev list on the sss_domain_info object, which is only intended to be used by confdb code. The correct approach was to use only the parent linkage, which would take us up to the top-level domain in this SSSD domain.
* LDAP: Ignore returned referrals if referral support is disabledJakub Hrozek2014-09-022-0/+2
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Replace space: add some checksSumit Bose2014-09-012-4/+24
| | | | | | | | | | | | | | | | | | | | | | | This patch adds some additional checks if the option for replacing spaces in user and group names is used. When replacing space with the replacement character it is checked if the name already contains the replacement character. If it does the unmodified name is returned because in this case a revers operation would not be possible. For the reverse operation is it checked if the input contains both a space and the replacement character. If this is true the unmodified name is returned as well, because we have to assume that it is the original name because otherwise it wouldn't contain both characters. Additionally a shortcut if the replacement characters is a space and tests for the new checks are added. The man page is updated accordingly. Related to https://fedorahosted.org/sssd/ticket/1854 and https://fedorahosted.org/sssd/ticket/2397 . Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_log: fix handling of variable argument listsSumit Bose2014-08-271-9/+19
| | | | | | | | | | | | | | | | SSSD has two public calls to send messages to syslog sss_log() and sss_log_ext() which both expect besides other arguments a printf format string and a variable list of arguments depending on the format. Currently sss_log() calls sss_log_ext() internally after calling va_start(ap, format) and hands over ap as the last argument. This does not work because there is a difference between a varying number of arguments and a va_list type. To fix this I added a new private call which expects a va_list as the last argument and is called by sss_log() and sss_log_ext() after calling va_start(). Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Only replace space with the specified substitutionJakub Hrozek2014-08-132-117/+32
| | | | | | | | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 - make sss_replace_whitespaces only replace space (' ') not any whitespace - make sss_replace_whitespaces only replace a single char, not the whole string - rename CONFDB_NSS_OVERRIDE_DEFAULT_WHITESPACE to CONFDB_NSS_OVERRIDE_DEFAULT_SPACE - rename the override_default_whitespace option to override_space - rename sss_replace_whitespaces() to sss_replace_space() - rename sss_reverse_replace_whitespaces() to sss_reverse_replace_space() - rename nctx->override_default_wsp_str to nctx->override_space - make the return value of sss_replace_space non-const to avoid freeing the result without compilation warnings Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: remove get_username_from_uidJakub Hrozek2014-08-062-14/+0
| | | | | | The function was unused since 2009 and moreover it was synchronous. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* build: Reverse order of libini_config checksNikolai Kondrashov2014-07-291-13/+11
| | | | | | | | | | | | Check for lowest versions of libini_config first, instead of the highest ones in libini_config.m4. Define HAVE_LIBINI_CONFIG_V* for lower versions when higher versions are present. Simplify preprocessor branching in sss_ini.c accordingly. This prepares libini_config.m4 for addition of a check for one more version of libini_config. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Add functions for replacing whitespaces.Lukas Slebodnik2014-07-282-0/+158
| | | | | Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* UTIL: rename find_subdomain_by_object_namePavel Reichl2014-07-222-4/+4
| | | | | | | The function was named "find_subdomain" yet it could find both main domain and subdomain. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: rename find_subdomain_by_namePavel Reichl2014-07-223-8/+8
| | | | | | | | | The function was named "find_subdomain" yet it could find both main domain and subdomain. sed 's/find_subdomain_by_name/find_domain_by_name/' -i `find . -name "*.[ch]"` Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: rename find_subdomain_by_sidPavel Reichl2014-07-222-4/+4
| | | | | | | | | The function was named "find_subdomain" yet it could find both main domain and subdomain. sed 's/find_subdomain_by_sid/find_domain_by_sid/' -i `find . -name "*.[ch]"` Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: tokengroups do not work with id_provider=ldapPavel Reichl2014-07-212-0/+19
| | | | | | | | | | | | | | | | | | With plain LDAP provider we already have a sdap_handle, so it should be possible that in the case where sdom->pvt == NULL sdap_id_op_connect_send() can be skipped and sdap_get_ad_tokengroups_send() can be already send with the sdap_handle passed to sdap_ad_tokengroups_initgr_mapping_send(). So we should only fail if sdom->pvt == NULL and sh == NULL. if find_subdomain_by_sid() failed we can check if there is only one domain in the domain list (state->domain) and in this case continue with this domain since the LDAP provider does not know about sub-domains and hence can only have one configured domain. Resolves: https://fedorahosted.org/sssd/ticket/2345 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TOOLS: Always debug to stderrJakub Hrozek2014-07-091-0/+8
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2348 Programs that are supposed to only be executed on the foreground should log to stderr automatically. Reviewed-by: Michal Židek <mzidek@redhat.com>
* SSSD: Send debug to stderr when running on foregroundJakub Hrozek2014-07-093-1/+15
| | | | | | | | | https://fedorahosted.org/sssd/ticket/2348 When SSSD is running in interactive mode, we should print DEBUG messages directly to stderr, not journal. Reviewed-by: Michal Židek <mzidek@redhat.com>
* IFP: Return a specific value on failure connecting to the system busJakub Hrozek2014-07-082-0/+2
| | | | | | | | We need to treat the failure to connect to the system bus as non-fatal. In this commit, we introduce a special error code and only print a DEBUG message when this error code is returned from the startup function. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Fix access out of bound in parse_argsLukas Slebodnik2014-07-081-13/+13
| | | | | | | | | | | | | | | | While parsing string with multiple whitespaces, it may happen variable i is zero and we want to test end of argument "tmp[i-1] != '\0'". Side effect of this bug is duplicite string output array. Input string: "foo b" Expected output: { "foo", "a", NULL } Output: { "foo", "foo", "a", NULL } This patch uses inverted logic. Instead of testing whether to read next char or skip multiple whitespaces, we will test whether we have new argument which should be stored in output array. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Suppress safealign warnings with DISCARD_ALIGN.Michal Zidek2014-07-011-2/+6
| | | | | | | | These warnings were all false positives. fixes: https://fedorahosted.org/sssd/ticket/1359 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Add type parameter to DISCARD_ALIGN macroMichal Zidek2014-07-011-1/+1
| | | | | | | | | This macro will be used to suppress alignment warnings when casting pointers. fixes: https://fedorahosted.org/sssd/ticket/1359 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD-GPO: Add support for gpo permissive modeYassir Elley2014-07-012-4/+14
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SSH: Allow newline at the end of public key values in LDAPJan Cholasta2014-06-181-6/+12
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2349 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SDAP: Use portable constant as level in setsockoptLukas Slebodnik2014-06-031-1/+1
| | | | | | | | | | | | | | | | | | The macros SOL_TCP and IPPROTO_TCP have the same value on linux, but the first one is not portable. man in.h says: The <netinet/in.h> header shall define the following macros for use as values of the level argument of getsockopt() and setsockopt(): IPPROTO_IP Internet protocol. IPPROTO_IPV6 Internet Protocol Version 6. IPPROTO_ICMP Control message protocol. IPPROTO_RAW Raw IP Packets Protocol. IPPROTO_TCP Transmission control protocol. IPPROTO_UDP User datagram protocol. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* NSS: Add option to expand homedir template formatLukas Slebodnik2014-06-023-0/+13
| | | | | | | | | LDAP server can contain template for home directory instead of plain string. This patch adds new expand option "%H", which will be replaced with value from configuration option homedir_substring (from sssd.conf) Resolves: https://fedorahosted.org/sssd/ticket/1853
* NSS: Refactor expand_homedir_templateLukas Slebodnik2014-06-022-21/+34
| | | | | | | | Function expand_homedir_template had lot of parameters. After adding new expand option, all function call should be rewritten, (usually argument NULL will be added) This patch wraps all necessary arguments to structure.
* UTIL: Add function sss_parse_name_constLukas Slebodnik2014-06-022-0/+28
| | | | | | | | | Variable with type 'const char *' can be used as output argument in function sss_parse_name, but there will be warning. warning: passing 'const char **' to parameter of type 'char **' discards qualifiers in nested pointer types [-Wincompatible-pointer-types-discards-qualifiers]
* utils: add get_known_services()Pavel Březina2014-05-282-0/+10
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Include netinet/in.h for ip adress macrosLukas Slebodnik2014-05-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The manual page in.h (man in.h) says: The <netinet/in.h> header shall define the in6_addr structure that con‐ tains at least the following member: uint8_t s6_addr[16] The <netinet/in.h> header shall define the following macros that test for special IPv6 addresses. Each macro is of type int and takes a sin‐ gle argument of type const struct in6_addr *: IN6_IS_ADDR_LINKLOCAL: Unicast link-local address. IN6_IS_ADDR_LOOPBACK: Loopback address. IN6_IS_ADDR_MULTICAST: Multicast address. The header file netinet/in.h> was not included directly in src/util/util.c and it caused few problems. ./src/util/util.h:378: warning: 'struct in6_addr' declared inside parameter list ./src/util/util.h:378: warning: its scope is only this definition or declaration, which is probably not what you want src/util/util.c: In function 'check_ipv4_addr': src/util/util.c:765: error: implicit declaration of function 'IN_MULTICAST' src/util/util.c:769: error: 'IN_LOOPBACKNET' undeclared (first use in this function) src/util/util.c:769: error: (Each undeclared identifier is reported only once src/util/util.c:769: error: for each function it appears in.) src/util/util.c:778: error: 'INADDR_BROADCAST' undeclared (first use in this function) src/util/util.c: At top level: src/util/util.c:786: warning: 'struct in6_addr' declared inside parameter list src/util/util.c:787: error: conflicting types for 'check_ipv6_addr' ./src/util/util.h:378: error: previous declaration of 'check_ipv6_addr' was here src/util/util.c: In function 'check_ipv6_addr': src/util/util.c:796: error: implicit declaration of function 'IN6_IS_ADDR_LINKLOCAL' src/util/util.c:799: error: implicit declaration of function 'IN6_IS_ADDR_LOOPBACK' src/util/util.c:802: error: implicit declaration of function 'IN6_IS_ADDR_MULTICAST' Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Fix order of header files.Lukas Slebodnik2014-05-261-1/+3
| | | | | | | | | | | | | | | | | | | | | | The older version of glibc and different implementations of libs requires feature macros for enabling function getline. getline(), getdelim(): Since glibc 2.10: _POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700 Before glibc 2.10: _GNU_SOURCE All feature macros are in header file config.h and are detected by configure script. The header file config.h was included after few other header files. The problem is that header files stdio.h is included just once and is included from many external header files. We need to include config.h before any other header file to prevent problems. src/util/nscd.c: In function ‘sss_nscd_parse_conf’: src/util/nscd.c:150: error: implicit declaration of function ‘getline’ Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SBUS: Start implementing property accessStef Walter2014-05-222-0/+2
| | | | | | | | | | | | | | | | This patch adds the basis of SBUS getters and setters. A new module, sssd_dbus_properties.c would contain handlers for the property methods like Get, Set and GetAll. Type-safe property access works in a similar fashion like type-safe method calls - the invoker calls the getter which returns the primitive type, which is in turn marshalled into variant by the invoker. This patch does not contain the complete functionality, see later patches that continue implementing the getters and setters. Reviewed-by: Stef Walter <stefw@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-30 21:01:25 +0000