sssd.git/src/responder/common, branch sudo

Fix warning declaration of 'index' shadows a global declaration

2017-09-25T19:35:39+00:00

src/responder/common/cache_req/cache_req.c: In function 'cache_req_add_result':
src/responder/common/cache_req/cache_req.c:587: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here

src/responder/nss/nss_cmd.c:387: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here
src/responder/nss/nss_cmd.c: In function 'nss_getent_get_result':
src/responder/nss/nss_cmd.c:433: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here
src/responder/nss/nss_cmd.c: In function 'nss_endent':
src/responder/nss/nss_cmd.c:671: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here

src/responder/nss/nss_protocol_netgr.c: In function 'nss_protocol_fill_netgrent':
src/responder/nss/nss_protocol_netgr.c:113: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here

Reviewed-by: Fabiano Fidêncio

RESPONDER: Fix "-Wold-style-definition" caught by GCC

2017-09-25T19:35:22+00:00

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Lukáš Slebodník

Print a warning when enumeration is requested but disabled

2017-09-25T12:33:06+00:00

Add an explanatory message to be logged once, at the start-up,
mentioning that in case enumeration is not enabled, getent passwd won't
return all users by design.
The debug level chosen to show the message is SSS_LOG_NOTICE.

Resolves:
https://pagure.io/SSSD/sssd/issue/2301

Reviewed-by: Jakub Hrozek 
Reviewed-by: Fabiano Fidêncio 
Reviewed-by: Lukáš Slebodník

cache_req: Look for name attribute also in nss_cmd_getsidbyid

2017-09-06T11:16:03+00:00

We always check negcache after getting data from backend since commit
4c09cd008967c5c0ec358dc658ffc6fc1cef2697 because we usually do have a name
in begging of requests "* by ID".

We were not interested in name in request sid by id before. However, function
cache_req_search_ncache_filter always expect name otherwise it returns
ERR_INTERNAL.

[sssd[nss]] [cache_req_set_plugin] (0x2000): CR #8: Setting "Object by ID" plugin
[sssd[nss]] [cache_req_send] (0x0400): CR #8: New request 'Object by ID'
[sssd[nss]] [cache_req_select_domains] (0x0400): CR #8: Performing a multi-domain search
[sssd[nss]] [cache_req_search_domains] (0x0400): CR #8: Search will check the cache and check the data provider
[sssd[nss]] [cache_req_validate_domain_type] (0x2000): Request type POSIX-only for domain sssdad2012r2.com type POSIX is valid
[sssd[nss]] [cache_req_set_domain] (0x0400): CR #8: Using domain [sssdad2012r2.com]
[sssd[nss]] [cache_req_search_send] (0x0400): CR #8: Looking up ID:233600513@sssdad2012r2.com
[sssd[nss]] [cache_req_search_ncache] (0x0400): CR #8: Checking negative cache for [ID:233600513@sssdad2012r2.com]
[sssd[nss]] [sss_ncache_check_str] (0x2000): Checking negative cache for [NCE/UID/sssdad2012r2.com/233600513]
[sssd[nss]] [cache_req_search_ncache] (0x0400): CR #8: [ID:233600513@sssdad2012r2.com] is not present in negative cache
[sssd[nss]] [cache_req_search_cache] (0x0400): CR #8: Looking up [ID:233600513@sssdad2012r2.com] in cache
[sssd[nss]] [cache_req_search_send] (0x0400): CR #8: Returning [ID:233600513@sssdad2012r2.com] from cache
[sssd[nss]] [cache_req_search_ncache_filter] (0x0400): CR #8: Filtering out results by negative cache
[sssd[nss]] [cache_req_search_ncache_filter] (0x0020): CR #8: sss_get_name_from_msg() returned NULL, which should never happen in this scenario!
[sssd[nss]] [cache_req_process_result] (0x0400): CR #8: Finished: Error 1432158209: Internal Error
[sssd[nss]] [nss_protocol_done] (0x4000): Sending reply: error [1432158209]: Internal Error
[sssd[nss]] [client_recv] (0x0200): Client disconnected!

Resolves:
https://pagure.io/SSSD/sssd/issue/3485

Reviewed-by: Pavel Březina

NEGCACHE: Add root's uid/gid to ncache

2017-08-28T18:55:22+00:00

As "root" is not handled by SSSD, let's add its uid and gid to the
negative cache as well. The reason it's added without specifying a
domain is to follow how the negative cache is used by cache req's code
when searching something by id.

As the negative cache check for uid/gid, in the cache req code, is done
after resolving the name, we can save one LDAP call to the data
provider.

Related: https://pagure.io/SSSD/sssd/issue/3460

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek

CACHE_REQ: Don't error out when searching by id = 0

2017-08-28T18:55:07+00:00

This code path can be easily triggered by calling `id 0` and SSSD should
not error out in this case.

Previous patches in this series already add uid and gid 0 to the
negative cache and we can properly handle this situation.

Related: https://pagure.io/SSSD/sssd/issue/3460

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek

NEGCACHE: Descend to all subdomains when adding user/groups

2017-08-28T18:55:01+00:00

When a user or group is added to the negative cache, we should descend
to all subdomains as well.

Related: https://pagure.io/SSSD/sssd/issue/3460

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek

NEGCACHE: Always add "root" to the negative cache

2017-08-28T18:54:47+00:00

The current code only adds "root" to the negative cache in case there's
any other user or group set up in to be added.

As SSSD doesn't handle "root", it should *always* be added to the
negative cache.

Related: https://pagure.io/SSSD/sssd/issue/3460

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek

NEGCACHE: Add some comments about each step of sss_ncache_prepopulate()

2017-08-28T18:54:29+00:00

The comments help to understand which part of the code is dealing with
users or groups of specific or non-specific domain filters.

Related: https://pagure.io/SSSD/sssd/issue/3460

Signed-off-by: Fabiano Fidêncio 

Reviewed-by: Jakub Hrozek

CACHE_REQ: Fix warning may be used uninitialized

2017-07-31T10:17:06+00:00

Setting ret as EOK in case everything goes well.

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Nikolai Kondrashov