summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* TOOLS: Compile on old platforms such as RHEL5Jakub Hrozek2013-01-281-37/+140
| | | | | Provides compatible declarations for modern file management functions such as futimens or opening with the O_CLOEXEC flag
* MAN: Clarify that saving users after enumerating large domain might be CPU ↵Jakub Hrozek2013-01-281-1/+9
| | | | | | intensive https://fedorahosted.org/sssd/ticket/1732
* Possible null derefence in ipa_subdomains.c.Michal Zidek2013-01-251-0/+4
| | | | | Found by coverity. https://fedorahosted.org/sssd/ticket/1790
* SYSDB: Expire group if adding ghost users fails with EEXISTJakub Hrozek2013-01-231-2/+36
|
* SYSDB: make the sss_ldb_modify_permissive function publicJakub Hrozek2013-01-232-2/+11
|
* TOOLS: Use file descriptor to avoid races when creating a home directoryJakub Hrozek2013-01-234-354/+364
| | | | | | | | | | | When creating a home directory, the destination tree can be modified in various ways while it is being constructed because directory permissions are set before populating the directory. This can lead to file creation and permission changes outside the target directory tree, using hard links. This security problem was assigned CVE-2013-0219 https://fedorahosted.org/sssd/ticket/1782
* TOOLS: Use openat/unlinkat when removing the homedirJakub Hrozek2013-01-231-42/+41
| | | | | | | | | | The removal of a home directory is sensitive to concurrent modification of the directory tree being removed and can unlink files outside the directory tree. This security issue was assigned CVE-2013-0219 https://fedorahosted.org/sssd/ticket/1782
* Check that strings do not go beyond the end of the packet body in autofs and ↵Jan Cholasta2013-01-232-7/+7
| | | | | | | | SSH requests. This fixes CVE-2013-0220. https://fedorahosted.org/sssd/ticket/1781
* sudo responder: change num_rules type from size_t to uint32_tPavel Březina2013-01-227-25/+25
| | | | | | | | https://fedorahosted.org/sssd/ticket/1779 2^32 should be enough to store sudo rules. size_t type was causing troubles on big endian architectures, because it wasn't used correctly in combination with D-Bus.
* Convert the value of pwd_exp_warning to secondsJakub Hrozek2013-01-221-5/+6
| | | | | | | | When read from the domain section, the pwd_expiration_warning was properly converted to seconds from days, but not the pam_pwd_expiration_warning set in the [pam] section. https://fedorahosted.org/sssd/ticket/1773
* fix backend callbacks: remove callback properly from dlistPavel Březina2013-01-221-6/+18
| | | | | | | | https://fedorahosted.org/sssd/ticket/1776 Although cb->list got updated when the callback is removed, this change did not propagate to be_ctx->*_cb_list which caused dlist having invalid records.
* Fix code styleJakub Hrozek2013-01-221-1/+2
|
* Make struct be_req opaqueSimo Sorce2013-01-212-18/+18
|
* Add be_req_get_data() helper funciton.Simo Sorce2013-01-2117-32/+45
| | | | In preparation for making struct be_req opaque.
* Add be_req_get_be_ctx() helper.Simo Sorce2013-01-2122-133/+155
| | | | In preparation for making be_req opaque
* Add be_req_create() helperSimo Sorce2013-01-213-40/+38
|
* Introduce be_req_terminate() helperSimo Sorce2013-01-2118-129/+84
| | | | | Call it everywhere instead of directly dereferencing be_req->fn This is in preparation of making be_req opaque.
* Remove domain from be_req structureSimo Sorce2013-01-217-64/+46
|
* Pass domain not be_req to access check functionsSimo Sorce2013-01-215-22/+33
|
* Split simple_access_check function outSimo Sorce2013-01-213-206/+225
| | | | | Need to split out the function or new additions to the handler funtion will not allow simple access tests to compile anymore.
* Do not pass NULL to ipa_subdomain_retrieve()Simo Sorce2013-01-211-18/+20
|
* Move hbac_ctx_is_offline()Simo Sorce2013-01-212-7/+6
|
* Remove hbac_ctx_sdap_id_[ctx|op]()Simo Sorce2013-01-212-18/+6
|
* Remove hbac_ctx_ev()Simo Sorce2013-01-212-10/+3
|
* Remove hbac_ctx_be()Simo Sorce2013-01-213-12/+4
|
* Remove hbac_ctx_sysdb()Simo Sorce2013-01-212-12/+4
|
* Remove sysdb argument from hbac_get_cached_rules()Simo Sorce2013-01-213-9/+6
|
* Remove sysdb arg from [ipa_]hbac_sysdb_save()Simo Sorce2013-01-213-36/+25
| | | | Also make ipa_hbac_save_list() static
* Remove sysdb arg from ipa_hbac_service_info_send()Simo Sorce2013-01-213-5/+0
|
* Remove sysdb arg from hbac_*host_attrs_to_rule()Simo Sorce2013-01-213-11/+4
|
* Remove sysdb arg from hbac_service_attrs_to_rule()Simo Sorce2013-01-213-5/+2
|
* Remove sysdb argument from hbac_user_attrs_to_rule()Simo Sorce2013-01-213-6/+4
|
* Remove unused structureSimo Sorce2013-01-211-6/+0
|
* Remove sysdb argument from ipa_host_info_send()Simo Sorce2013-01-215-9/+3
|
* Remove sysdb as a be request structure memberSimo Sorce2013-01-217-12/+9
| | | | The sysdb context is already available through the 'domain' context.
* Remove sysdb as a be context structure memberSimo Sorce2013-01-2127-56/+52
| | | | The sysdb context is already available through the 'domain' structure.
* Move ldap provider access functionsSimo Sorce2013-01-212-59/+86
| | | | | | It was confusing to see the ldap provider own handler mixed with the generic ldap access code used also by the ipa and ad providers. So move the ldap provider handler code in its own file.
* TOOLS: invalidate parent groups in memory cache, tooJakub Hrozek2013-01-214-8/+71
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1775 In addition to invalidating the group being added to when adding a member group/user, we also need to invalidate all its parent groups, otherwise this getgrnam("parent") wouldn't report the members newly added to its child groups.
* LDAP: Compare lists of DNs when saving autofs entriesJakub Hrozek2013-01-213-143/+178
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1758 The autofs entries do not have the key as an unique identifier, but rather the full (key, value) tuple as some keys have a special meaning, such as the direct mount key (/-) and may be present in a single map multiple times. Comparing the full DN that contains both the key and the value will allow for working updates if either key or value changes.
* set struct bet_info->bet_typePavel Březina2013-01-191-0/+1
|
* Invalidate user entry even if there are no groupsJakub Hrozek2013-01-162-11/+8
| | | | | | | | | Related to https://fedorahosted.org/sssd/ticket/1757 Previously we would optimize the mc invalidate code for cases where the user was a member of some groups. But if the user was removed from the server while being in memory cache, we would only invalidate the mc record if he was a member of at least one supplementary group.
* NSS: invalidate memcache user entry on initgr, tooJakub Hrozek2013-01-161-0/+11
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1757 When the user entry was missing completely after initgroups, we would never invalidate the user entry from cache. This led to dangling cache entried in memory cache if the user was removed from the server while still being in memory cache.
* Remove outdated code.Simo Sorce2013-01-161-10/+0
| | | | | This code should not be necessary anymore since June 2010 with commit: 90acbcf20b5f896ca8f631923afe946c90d90de7
* Tidy up BASE dn macrosSimo Sorce2013-01-161-4/+4
|
* tools: Respect use_fully_qualified_namesMichal Zidek2013-01-161-0/+9
| | | | | | | Tools for LOCAL domain should require FQDN if option 'use_fuly_quallified_names = TRUE' was configured. https://fedorahosted.org/sssd/ticket/1746
* sss_cache: Call DEBUG_INIT soonerMichal Zidek2013-01-161-2/+3
| | | | | | | | If bad parameteres were passed to sss_cache, the init function returned without calling DEBUG_INIT macro and unnecessary level 1 debug message was printed. https://fedorahosted.org/sssd/ticket/1745
* autofs: Use SAFEALIGN_SET_UINT32 instead of SAFEALIGN_COPY_UINT32Jakub Hrozek2013-01-161-10/+5
|
* Correct format security for talloc_named of auth tokensStephen Gallagher2013-01-161-1/+1
|
* LDAP: avoid complex realloc logic in save_rfc2307bis_group_membershipsJakub Hrozek2013-01-151-12/+4
| | | | | | | | | https://fedorahosted.org/sssd/ticket/1761 The function tried to be smart and realloc only when needed, but that only lead to hard-to find bugs where the logic would not allocate the proper space. Remove the reallocation and prefer readability over speed in this case.
* TOOLS: Refresh memcache after changes to local users and groupsJakub Hrozek2013-01-152-0/+42
|
generated by cgit (git 2.34.1) at 2024-05-17 14:07:59 +0000