summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* BUILD: Clean up prerelease targetsFabiano Fidêncio2016-08-291-2/+12
| | | | | | | | Clean up the pre-release targets in order to avoid lines exceeding 80 characters. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Add a few more targets for intg testsFabiano Fidêncio2016-08-291-2/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Running "make intgcheck" has been proven to be a bit painful (mainly when the developer is just writing down a single test case), as it cleans up the build directory and fireis a new build before, finally, run the tests. In order to make it a little less painful, let's break the whole operation into 3 new targets: intgcheck-{prepare,run,clean}. As expected, "make intgcheck" calls these 3 new operations in the same order they were presented, not changing then the current behavior. Each operation will trigger the previous one in case there is no "$$prefix" directory created and the directory is _only_ created in the very first operation (intghcheck-prepare). A note must be done about how to run a simple test file or a simple test from a test file when running "make intgcheck-run". The option always been here but only makes sense now that we have the intgcheck split in a few useful steps. See the examples below (and for more detailed information, check the py.test documentation): #Run a single file make intgcheck-run INTGCHECK_PYTEST_ARGS="-k test_netgroup.py" #Run a single test from a single file make intgcheck-run INTGCHECK_PYTEST_ARGS="-k test_add_empty_netgroup" Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SYSDB: Fix uninitialized scalar variableLukas Slebodnik2016-08-291-1/+1
| | | | | | | | | | The boolean variable newly_created could be used uninitialized in done section in case of failure. The variable was firstly initialized to true after succesfull execution of function sysdb_cache_create_empty. Uninitialized variable usually means true for boolean variable. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* PROXY: Share common code of save_{group,user}()Fabiano Fidêncio2016-08-271-80/+65
| | | | | | | | | | | | | | | These two functions (save_user() and save_group()) share, between themselves, the code preparing the attributes that are going to be stored in the sysdb. This patch basically splits this code out of those functions and introduces the new prepare_attrs_for_saving_ops(). Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Mention that save_user()'s parameters are already qualifiedFabiano Fidêncio2016-08-271-2/+3
| | | | | | | | | | Those comments are similar to what we have in the save_group() function. Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Remove cache_timeout attribute from save_group()Fabiano Fidêncio2016-08-271-7/+5
| | | | | | | | | | | | As this function already receives a struct sss_domain_info * parameter as argument, we can simply get the cache_timeout attribute by accessing domain->group_timeout. Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Remove cache_timeout attribute from save_user()Fabiano Fidêncio2016-08-271-7/+7
| | | | | | | | | | | | As this function already receives a struct sss_domain_info * parameter as argument, we can simply get the cache_timeout attribute by accessing domain->user_timeout. Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* PROXY: Remove lowercase attribute from save_user()Fabiano Fidêncio2016-08-271-13/+9
| | | | | | | | | | | | As this function already receives a struct sss_domain_info * parameter as argument, we can simply check whether we will need a lowercase name by accessing domain->case_sensitive. Related: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Parse qualified names when guessing AD user principalJakub Hrozek2016-08-261-2/+12
| | | | | | | | | | | | | | | | | | | Most AD users store their UPN in an attribute. If they don't, or the sssd was configured (typically in earlier versions to work around a bug) to not look at the principal attribute, then sssd is supposed to guess the attribute. That currently doesn't work in 1.14, because the username is already qualified and then we also append the realm name to it. We need to parse the simple username from the qualified name first. The issue can be reproduced simply by authenticating as the Administrator account in IPA-AD trust setups. Resolves: https://fedorahosted.org/sssd/ticket/3127 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SPEC: Fix typo in SummaryLukas Slebodnik2016-08-261-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SECRETS: Return ENOENT when_deleting a non-existent secretFabiano Fidêncio2016-08-261-7/+2
| | | | | | | | | | | | For this, just make use of the sysdb_error_to_errno() function. Resolves: https://fedorahosted.org/sssd/ticket/3125 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Remove the timestamp cache for a newly created cacheFabiano Fidêncio2016-08-261-22/+47
| | | | | | | | | | | | As many users are used to remove the persistent cache without removing the timestamp cache, let's throw away the timestamp cache in this case. Resolves: https://fedorahosted.org/sssd/ticket/3128 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SYSDB: Rework sysdb_cache_connect()Fabiano Fidêncio2016-08-261-19/+34
| | | | | | | | | | | | | | | | | | | As sysdb_cache_connect() has two very specific use cases (connect to the cache and connect to the timestamp cache) and each of those calls have a predetermined/fixed sets of values for a few parameters, let's try to make the code a bit simpler to follow by having explicit functions for connecting to the cache and connecting to the timestamp cache. Macros could be used as well, but I have a slightly preference for having two new functions instead of macros accessing internal parameters of the macro's parameter. Related: https://fedorahosted.org/sssd/ticket/3128 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Allow to read private pipes for rootLukas Slebodnik2016-08-262-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | Root can read anything from any directory even with permissions 000. However SELinux checks discretionary access control (DAC) and deny access if access is not allowed for root by DAC. The pam_sss use different unix socket /var/lib/sss/pipes/private/pam for user with uid 0. Therefore root need to be able read content of directory with private pipes. type=AVC msg=audit(08/19/2016 10:58:34.081:3369) : avc: denied { dac_read_search } for pid=20257 comm=vsftpd capability=dac_read_search scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability type=AVC msg=audit(08/19/2016 10:58:34.081:3369) : avc: denied { dac_override } for pid=20257 comm=vsftpd capability=dac_override scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability Resolves: https://fedorahosted.org/sssd/ticket/3143 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* watchdog: cope with time shiftPavel Březina2016-08-251-0/+41
| | | | | | | | | | | | | | | | When a time is changed into the past during sssd runtime (e.g. on boot during time correction), it is possible that we never hit watchdog tevent timer since it is based on system time. This patch adds a past-time shift detection mechanism. If a time shift is detected we restart watchdog. Resolves: https://fedorahosted.org/sssd/ticket/3154 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* INTG: Tests for ldap nested netgroupsPetr Cech2016-08-242-0/+460
| | | | | | | | | This patch adds tests on reproducer of t2841. Resolves: https://fedorahosted.org/sssd/ticket/2841 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* INTG: Adding support for netgroups to ldap_entPetr Cech2016-08-241-0/+19
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2841 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: Fixing of removing netgroup from cachePetr Cech2016-08-241-0/+16
| | | | | | | | | | There were problem with local key which wasn't properly removed. This patch fixes it. Resolves: https://fedorahosted.org/sssd/ticket/2841 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sssd_netgroup.py: Resolve nested netgroupsLukas Slebodnik2016-08-241-60/+164
| | | | Reviewed-by: Petr Čech <pcech@redhat.com>
* PROXY: Use the fqname when converting to lowercaseFabiano Fidêncio2016-08-241-1/+1
| | | | | | | | | | | | | | When saving the user there is a comparison between the "cased alias" and the "lowercase password name". However, the first doesn't use fully qualified name while the second does, resulting in a not expected override of the "nameAlias" attribute of a stored user when trying to authenticate more than once using an alias. Resolves: https://fedorahosted.org/sssd/ticket/3134 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CONFIG: session_provider does not exist anymoreJakub Hrozek2016-08-234-5/+0
| | | | | | | | | The session_provider used to exist a long time ago when we used to set the SELinux context from it, but the provider had been removed for a long time. We just forgot to remove the value from the config API and the validator. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CONFIG: selinux_provider is a valid provider typeJakub Hrozek2016-08-234-0/+5
| | | | | | | We should not warn about it in the validator and should allow selinux_provider from the config API. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Updating the version for the 1.14.2 releaseJakub Hrozek2016-08-191-1/+1
|
* Updating the translations for the 1.14.1 releaseJakub Hrozek2016-08-1940-16278/+18120
|
* intg: Test extra attributes duplicateLukas Slebodnik2016-08-191-0/+50
| | | | | | | | | Regresion test for ticket #3120 Resolves: https://fedorahosted.org/sssd/ticket/3120 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sdap: Skip exact duplicates when extending mapsMichal Židek2016-08-191-10/+32
| | | | | | | | | | | | | | | | | | When extending map with entry that already exists in the map in the exacty same form, then there is no need to fail. We should only fail if we try to change purpose of already used sysdb attribute. Resolves: https://fedorahosted.org/sssd/ticket/3120 Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* test_ldap: test resolving of names with special charactersLukas Slebodnik2016-08-181-0/+22
| | | | | | Integration test for #3121 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* test_ldap: test nested membership with rfc2307bisLukas Slebodnik2016-08-181-0/+27
| | | | | | Integration test for #3093 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* intg: Fix pep8 warningsLukas Slebodnik2016-08-183-14/+26
| | | | | | | | E302 expected 2 blank lines, found 1 E303 too many blank lines (2) E501 line too long (84 > 79 characters) Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sssd_id.py: Primary group should be returned for initgroupsLukas Slebodnik2016-08-182-3/+23
| | | | | | | | | Side effect of this change was that some primary groups could not be resolved and therefore get_user_groups failed in override tests. We should do the same as "id user". return decimal representation GID if it cannot be mapped to name. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* intg: create ldap test without enumerationLukas Slebodnik2016-08-182-0/+698
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* test_enumeration: Remove test without enumerationLukas Slebodnik2016-08-181-115/+11
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* intg: rename test with enumerationLukas Slebodnik2016-08-182-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* test_local_domain: Restore correct env variableLukas Slebodnik2016-08-181-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ds.py: Do not call teardown in destructorLukas Slebodnik2016-08-181-4/+0
| | | | | | | | | We use finalizers in pytest for cleaning up of openldap server. But sometimes destructor was called in case of failure which causes many issues in tests. Running teardown in destructor is not reliable due to pyhton nature. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SSSCTL: More helpful error message when InfoPipe is disabledJustin Stephenson2016-08-181-1/+3
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3130 Reviewed-by: Petr Čech <pcech@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Monitor: Add support for disabling netlinkJustin Stephenson2016-08-172-9/+26
| | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2860 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* DP: Add log message for get account infoLukas Slebodnik2016-08-171-0/+5
| | | | Reviewed-by: Petr Čech <pcech@redhat.com>
* LDAP: Log autofs rfc2307 config changes only with enabled responderLukas Slebodnik2016-08-171-1/+22
| | | | | | | | | | | grep -nE "0x0040" /var/log/sssd/sssd_example.com.log 361:(Tue Aug 16 13:04:04 2016) [sssd[be[example.com]]] [ldap_get_autofs_options] (0x0040): Your configuration uses the autofs provider with schema set to rfc2307 and default attribute mappings. The default map has changed in this release, please make sure the configuration matches the server attributes. Reviewed-by: Petr Čech <pcech@redhat.com>
* BUILD: Ship systemd service file for sssd-secretsJakub Hrozek2016-08-174-2/+41
| | | | | | | | | | | | | | | | | | | Adds two new files: sssd-secrets.socket and sssd-secrets.service. These can be used to socket-acticate the secrets responder even without explicitly starting it in the sssd config file. The specfile activates the socket after installation which means that the admin would just be able to use the secrets socket and the sssd_secrets responder would be started automatically by systemd. The sssd-secrets responder is started as root, mostly because I didn't think of an easy way to pass the uid/gid to the responders without asking about the sssd user identity in the first place. But nonetheless, the sssd-secrets responder wasn't tested as non-root and at least the initialization should be performed as root for the time being. Reviewed-by: Fabiano Fidêncio <fabiano@fidencio.org> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: Use sss_atomic_read/write for better readabilityJakub Hrozek2016-08-171-3/+3
| | | | | | | | | sss_atomic_read_s and sss_atomic_write_s are macro-wrappers around sss_atomic_io_s but it's easier to follow the code with the read/write vairants used directly. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fabiano@fidencio.org>
* UTIL: Use sss_atomic_read_s in generate_csprng_bufferJakub Hrozek2016-08-172-24/+7
| | | | | | | | | | There was a bug in generate_csprng_buffer() where if we read the exact amount of bytes from /dev/urandom, we would always return EIO. Instead, let's reuse the existing code from sss_atomic_read_s() which fixes this bug and reduces code duplication. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fabiano@fidencio.org>
* LDAP: Adding SIGCHLD callbackPetr Cech2016-08-171-6/+26
| | | | | | | | | | | | This patch adds SIGCHLD callback for ldap_child. So if timeout is reached and ldap_child is terminated by handler we have debug message about it. Resolves: https://fedorahosted.org/sssd/ticket/3106 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Adding SIGTERM signal before SIGKILLPetr Cech2016-08-172-4/+37
| | | | | | | | | | | | | We add better termination of ldap_child. If ldap_child reaches the timeout for termination parent sents SIGTERM signal. Child has 2 seconds for removing temporary file and exit. If it is not sufficient there is SIGKILL send to the child. Resolves: https://fedorahosted.org/sssd/ticket/3106 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Adding support for SIGTERM signalPetr Cech2016-08-172-0/+31
| | | | | | | | | | | We add support for handling SIGTERM signal. If ldap_child receives SIGTERM signal it removes temporary file. Resolves: https://fedorahosted.org/sssd/ticket/3106 Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SPEC: Own the secrets DB pathJakub Hrozek2016-08-171-0/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Adding tests for ad_enabled_domains optionPetr Cech2016-08-172-0/+348
| | | | | | | | | | | | There is special logic around ad_enabled_domains option: * option is disabled by default * master domain is always added to enabled domains Resolves: https://fedorahosted.org/sssd/ticket/2828 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD_PROVIDER: ad_enabled_domains - other then masterPetr Cech2016-08-171-3/+37
| | | | | | | | | | | We can skip looking up other domains if option ad_enabled_domains doesn't contain them. Resolves: https://fedorahosted.org/sssd/ticket/2828 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD_PROVIDER: ad_enabled_domains - only masterPetr Cech2016-08-171-0/+16
| | | | | | | | | | | We can skip looking up other domains if option ad_enabled_domains contains only master domain. Resolves: https://fedorahosted.org/sssd/ticket/2828 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* AD_PROVIDER: Initializing of ad_enabled_domainsPetr Cech2016-08-171-0/+82
| | | | | | | | | | We add ad_enabled_domains into ad_subdomains_ctx. Resolves: https://fedorahosted.org/sssd/ticket/2828 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-09 15:07:19 +0000