summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* SBUS: Create an sbus_method_meta instance for IntrospectionJakub Hrozek2014-04-193-0/+12
| | | | | Also fixes a warning about uninitialized 'method' as the 'method' variable was unused and not set previously when introspecting.
* KRB5: Go offline in case of generic errorPavel Reichl2014-04-171-0/+1
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2313
* Minor fixes for sss_parse_name_for_domainsJakub Hrozek2014-04-171-6/+11
| | | | | | | | | | | | - use brackets after an if - use the right variable name (candidate_domain instead of candidate_name). - fix a typo in a debug message - only print a debug message about using a default domain when using a default domain - add a comment explaning when is a codepath executed Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Add a unit test for sss_parse_name_for_domainsJakub Hrozek2014-04-171-4/+199
| | | | | | | | The code of sss_parse_name_for_domains is really complex and hard to read. This patch adds a unit test to be able to see the function being used. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* ad_access_filter man page typoYassir Elley2014-04-171-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KRB: do not check ccache directory for GIDPavel Reichl2014-04-171-7/+4
|
* ConfigAPI: Add two missing AD optionsJakub Hrozek2014-04-161-0/+2
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* TEST: Add untested libraries into dlopen testLukas Slebodnik2014-04-161-0/+6
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* SBUS: Generate introspection from the interface meta structureJakub Hrozek2014-04-155-3/+420
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2234 This patch generates the introspection data from the sbus interface meta structure. The generated XML conforms to http://dbus.freedesktop.org/doc/dbus-specification.html#introspection-format The XML description of the interface also always includes the org.freedesktop.DBus.Introspectable interface, which this patch also allows in the policy settings.
* SDAP: augmented logging for group savingPavel Reichl2014-04-142-1/+24
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/2239 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* failover: Shorter retry time for failed SRVPavel Reichl2014-04-143-2/+17
| | | | | | | | | | | Until now there was only one timeout used to re-resolve SRV queries. This patch adds new (shorter) timeout that will be used for queries that previously failed. Resolves: https://fedorahosted.org/sssd/ticket/1885 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD Provider: Fix crash looking up forest on Samba 4Stephen Gallagher2014-04-101-1/+2
| | | | | | | | | | | We were assuming that the forest had been looked up by netlogon, but this is not available on Samba 4 domains. We need to check that the forest is NULL and force the lookup. Resolves: https://fedorahosted.org/sssd/ticket/2311 Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAC: fix clang warningPavel Reichl2014-04-101-0/+8
| | | | | | Return value of sss_dp_get_account_recv is checked and logging is done accordingly. Reviewed-by: Sumit Bose <sbose@redhat.com>
* tests: Don't set the check fork mode explicitlyJakub Hrozek2014-04-102-2/+0
| | | | | | | Instead, let the user pick the fork mode with CK_FORK variable (see info check) Reviewed-by: Sumit Bose <sbose@redhat.com>
* krb5_child: Fix use after free in debug messageLukas Slebodnik2014-04-082-11/+16
| | | | | | | | | | debug_prg_name is used in debug_fn and it was allocated under talloc context "kr". The variable "kr" was removed before the last debug messages in function main. It is very little change that it will be overridden. It is possible to see this issue with exported environment variable TALLOC_FREE_FILL=255 Reviewed-by: Sumit Bose <sbose@redhat.com>
* Fix warning zero-length gnu_printf format stringLukas Slebodnik2014-04-071-1/+1
| | | | | | | There is a warning if nsupdate does not support realm. warning: zero-length gnu_printf format string [-Wformat-zero-length] Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Remove unused argument from resolv_gethostbyname_dns_parseLukas Slebodnik2014-04-071-5/+4
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* krb5_child: Remove unused krb5_context from set_changepw_optionsLukas Slebodnik2014-04-071-4/+3
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Remove dead code from ipa_get_selinux_recvMichal Zidek2014-04-071-38/+23
| | | | | | | | The 'else' branches in ipa_get_selinux_recv are never executed (and even if they were, the result would be the same as if the true branches were taken). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Possible null dereference in SELinux codeMichal Zidek2014-04-041-2/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IFP: do not create client socketPavel Březina2014-04-041-1/+1
| | | | | | | | | | There is no need for client socket in IFP responder, since it uses D-Bus for communication with clients. Resolves: https://fedorahosted.org/sssd/ticket/2290 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* AUTOFS: terminate array after the last entryLukas Slebodnik2014-04-041-1/+2
| | | | | | | | | | | | | | | | If LDAP entries have more then one attribute "automountKey" automount map will be skipped and error message will be printed to log files and sssd_be will crash. DEBUG(SSSDBG_MINOR_FAILURE, "Malformed entry, skipping\n"); The output array with automount maps will contain uninitialized pointers because array was terminated after the expected count of entries and not after the last successfully retrieved entry Resolves: https://fedorahosted.org/sssd/ticket/2288 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Connect to the system busJakub Hrozek2014-04-047-1/+265
| | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2072 Adds the possibility for the InfoPipe responder to connect to the system bus. At the moment, only a dummy method "Ping" is provided. The method only accepts a single string parameter that has to be 'ping'.
* IFP: Re-add the InfoPipe serverJakub Hrozek2014-04-0413-2/+381
| | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2072 This commit only adds the responder and the needed plumbing. No DBus related code is in yet.
* Remove --with-distro-versionNikolai Kondrashov2014-04-032-12/+1
| | | | | | | | | Remove support for "--with-distro-version" configure option as unused. The option was added in August 2011 (d3da1c1). As of now nothing seems to use it. Packaging checked: rpm, deb, pacman, ebuilds, FreeBSD ports. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cmocka-unit-test-for-functions-getpwuid*-addedPallavi Jha2014-04-031-1/+282
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: Fix SELinux mapping order memory hierarchyJakub Hrozek2014-04-031-8/+8
| | | | | | | | | | https://fedorahosted.org/sssd/ticket/2300 The list of SELinux mapping orders was allocated on tmp_ctx and parsed into an array. The array itself was correctly allocated on mem_ctx but its contents remained on tmp_ctx, leading to a use-after-free error. This patch fixes the memory hierarchy so that both the array and its contents are allocated on mem_ctx.
* AD: connect to forest root when downloading the list of subdomainsJakub Hrozek2014-04-021-9/+362
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2285 Only the forest root has the knowledge about all the domains in the forest, the forest leaves only see themselves and the forest root. This patch switches to connecting to the forest root for downloading the trusted domains instead of the server we are connected to. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Use function sysdb_attrs_get_el in safe wayLukas Slebodnik2014-03-311-10/+7
| | | | | | | | | | | | | | | | | | | | Function sysdb_attrs_get_el can enlarge array of ldb_message_element in "struct sysdb_attrs" if attribute is not among available attributes. Array will be enlarged with function talloc_realloc but realloc can move array to another place in memory therefore ldb_message_element should not be used after next call of function sysdb_attrs_get_el sysdb_attrs_get_el(netgroup, SYSDB_ORIG_MEMBER_USER, &user_found); sysdb_attrs_get_el(netgroup, SYSDB_ORIG_MEMBER_HOST, &host_found); With netgroups, it is common to omit user or host from netgroup triple. There is very high probability that realloc will be called. it is possible pointer user_found can refer to the old area after the second call of function sysdb_attrs_get_el. Resolves: https://fedorahosted.org/sssd/ticket/2284 Reviewed-by: Sumit Bose <sbose@redhat.com>
* KRB5: Do not attempt to get a TGT after a password change using OTPJakub Hrozek2014-03-264-3/+52
| | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2271 The current krb5_child code attempts to get a TGT for the convenience of the user using the new password after a password change operation. However, an OTP should never be used twice, which means we can't perform the kinit operation after chpass is finished. Instead, we only print a PAM information instructing the user to log out and back in manually. Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
* krb5-child: add revert_changepw_options()Sumit Bose2014-03-211-0/+22
| | | | | | | | | | After changing the Kerberos password krb5-child will try to get a fresh TGT with the new password. This patch tries to make sure the right gic options are used. Resolves: https://fedorahosted.org/sssd/ticket/2289 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5_client: rename krb5_set_canonicalize() to set_canonicalize_option()Sumit Bose2014-03-211-16/+16
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5-child: extract lifetime settings into set_lifetime_options()Sumit Bose2014-03-211-36/+55
| | | | | | | | Additionally the lifetime option flags are unset if there are no explicit settings to make sure the defaults from krb5.conf are used even if other values were set manually in between. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5_child: remove unused option lifetime_str from k5c_setup_fast()Sumit Bose2014-03-211-6/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSV: Do not call functions success and fail itselfLukas Slebodnik2014-03-201-1/+1
| | | | | | | | | | | | | | | Bash function daemon will call success or fail. It is useless to call them one more time. It may cause strange behaviour with some configurations of terminal. # service sssd restart Stopping sssd: [ OK ] [ OK ] sssd: [ OK ] Resolves: https://fedorahosted.org/sssd/ticket/2280 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: minimal value expected for ldap_idmap_range_sizePavel Reichl2014-03-201-0/+16
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/1451 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: log message - wrong permissions on ccache dirPavel Reichl2014-03-181-2/+3
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2037 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* refactor calls of sss_parse_namePavel Reichl2014-03-184-8/+4
| | | | | | | sss_parse_name now supports NULL as output parameters so existing calls passing arguments which were never read were substituted by NULL. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Option name typo in sssd-krb5Pavel Reichl2014-03-141-1/+1
| | | | | | From krb5ccache_dir to krb5_ccachedir Reviewed-by: Sumit Bose <sbose@redhat.com>
* Use pattern #elif defined(identifier)Lukas Slebodnik2014-03-146-21/+21
| | | | | | | | | | | | | | We had in source code following pattern #elif HAVE_<name> It worked because undefined identifier(in some cases) was evaluated to 0. But we do not care about value of HAVE_SOMETHING. We just need to know whether identifier was defined. There is not equivalent to #ifdef (short for of #if definded) We need to use long form: #elif defined HAVE_<name> It causes also compiler warning with enabled compiler flag -Wundef. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* UTIL: Hide implementation details about unicode libraries.Lukas Slebodnik2014-03-142-7/+9
| | | | | | | Header files from glib or unistring are only necessary in implementation module sss_utf8.c Reviewed-by: Pavel Reichl <preichl@redhat.com>
* PAM: add ignore_unknown_user optionPete Fritchman2014-03-142-0/+24
| | | | | | https://fedorahosted.org/sssd/ticket/2232 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sbus: Add the sbus_request_parse_or_finish() methodStef Walter2014-03-146-81/+287
| | | | | | | | | | | | | | | | | | | | | | Some DBus types returned from dbus_message_get_args() require memory to be released when done. We automatically attach these to the talloc struct sbus_request memory context in this function. This accepts varargs similar to dbus_message_get_args(), which are rather awkward. However instead of reworking them completely, future generated marshalling code will replace most uses of these varargs. If parsing the dbus message fails, then it responds to the DBus caller with an appropriate error such as o.f.D.Error.InvalidArgs. In these cases (ie: when it returns FALSE) the sbus_request is finished. Migrated some, but not all, uses of dbus_message_get_args() to the new function. Some instances have uncommon semantics such as terminating the connection upon failure to parse a message. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sbus_tests: Add some testing of dispatch and handler codeStef Walter2014-03-143-0/+444
| | | | | | | | | | | | | This starts a DBus server with some handlers, and runs some method calls against it. Note that we don't use the codegen in the sbus_tests, as we sorta want to test this non-codegen related functionality on its own before we run the sbus_codegen_tests. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sbus: Make sbus_new_server() work for non-priveleged processesStef Walter2014-03-141-1/+1
| | | | | | | | | | I'd like to use this during testing. We should check that the socket ownership is the same as the process, rather than limiting it to root. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sbus: Refactor how we export DBus interfacesStef Walter2014-03-1421-348/+199
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Most importantly, stop using per connection private data. This doesn't scale when you have more than one thing exporting or exported on a connection. Remove struct sbus_interface and expand sbus_conn_add_interface() function. Remove various struct sbus_interface args to connection initialization functions and make callers use sbus_conn_add_interface() directly. The old method was optimized for exporting one interface on a connection. We'll have connections that export zero, one or more interfaces. To export an interface on a DBus server, call sbus_conn_add_interface() from within the sbus_server_conn_init_fn. To export an interface on a DBus client, call sbus_conn_add_interface() after sbus_new_connection() returns. As before struct sbus_interface represents an object exported via DBus. However it is now talloc allocated. One can set instance data on the struct sbus_interface. This instance data is passed to the various handlers and used in their implementation. However, we now have type safe interface exporting in the various high level sss_process_init() sss_monitor_init() and so on. Introspection support was not in use, and is now gone until we implement it using the metadata (future patch). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sbus: Add struct sbus_request to represent a DBus invocationStef Walter2014-03-1415-498/+468
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | struct sbus_request represents a request from a dbus client being handled by a dbus server implementation. The struct contains the message, connection and method (and in the future teh property) which is being requested. In the future it will contain caller information as well. sbus_request is a talloc memory context, and is a good place to attach any allocations and memory specific to the request. Each handler accepts an sbus_request. If a handler returns EOK, it is assumed that the handler will finish the request. Any of the sbus_request_*finish() methods can be used to complete the request and send back a reply. sbus_request_return_and_finish() uses the same argument varargs syntax as dbus_message_append_args(), which isn't a great syntax. Document it a bit, but don't try to redesign: The marshalling work (will follow this patch set) will remove the need to use varargs for most DBus implementation code. This patch migrates the monitor and data provider dbus code to use sbus_request, but does not try to rework the talloc context's to use it. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* providers: Fix types passed to dbus varargs functionsStef Walter2014-03-142-12/+27
| | | | | | | | | | | | | | | | | | | Fix some incorrect types passed to dbus_message_get_args(), dbus_message_append_args() or functions accepting similar varargs and types. In particular sizeof(bool) != sizeof(dbus_bool_t) on most platforms. This probably only worked because the compiler was aligning stack variables and so writing off the end of one of them wasn't the end of the world. In addition fix cases where int != int32_t != uint32_t. Although these will work on many common platforms, assuming these are interchangeable is not cross platform safe. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: new general options sectionPavel Reichl2014-03-131-39/+62
| | | | | | | | | | Some options are relevant to multiple sections of sssd.conf. This patch adds new sections for those. Resolves: https://fedorahosted.org/sssd/ticket/2218 Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Write SELinux usernames in the right caseJakub Hrozek2014-03-131-5/+21
| | | | | | https://fedorahosted.org/sssd/ticket/2282 Reviewed-by: Michal Židek <mzidek@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-28 05:48:40 +0000