sssd.git/src/responder, branch sudo

PAM: Avoid overwriting pam_status in _lookup_by_cert_done()

2017-10-09T08:03:15+00:00

In case add_pam_cert_response() failed pam_status has to be set to
PAM_AUTHINFO_UNAVAIL. Although it's done properly in the code,
pam_status was overwritten just after the if block with PAM_SUCCESS.

The original faulty code was added as part of 32474fa2f0.

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Sumit Bose

KCM: Add some forgotten NULL checks

2017-10-04T07:05:55+00:00

Several memory allocations across the KCM codebase did not check their
result for NULL. This patch fixes that.

Reviewed-by: Fabiano Fidêncio

KCM: Use the right memory context

2017-10-04T07:05:55+00:00

Inside the tevent request, we should use 'state' as the intermediate
memory context and steal the result up to 'mem_ctx' on success.
'mem_ctx' itself should only be used to create the tevent_req as the
first thing during the request creation.

However, this bug is not very severe as the mem_ctx was always the KCM
operation memory context, so the memory was freed when the operation
terminated.

Reviewed-by: Fabiano Fidêncio

KCM: Do not leak newly created ccache in case the name is malformed

2017-10-04T07:05:55+00:00

This is not a big deal as the mem_ctx parameter of the operation is
typically just a short-lived operation context. Nonetheless, it is best
practice to not rely on how the memory context is set up in utility
functions.

Reviewed-by: Fabiano Fidêncio

IFP: parse ping arguments in codegen

2017-09-25T19:41:39+00:00

Reviewed-by: Lukáš Slebodník

Fix warning declaration of 'index' shadows a global declaration

2017-09-25T19:35:39+00:00

src/responder/common/cache_req/cache_req.c: In function 'cache_req_add_result':
src/responder/common/cache_req/cache_req.c:587: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here

src/responder/nss/nss_cmd.c:387: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here
src/responder/nss/nss_cmd.c: In function 'nss_getent_get_result':
src/responder/nss/nss_cmd.c:433: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here
src/responder/nss/nss_cmd.c: In function 'nss_endent':
src/responder/nss/nss_cmd.c:671: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here

src/responder/nss/nss_protocol_netgr.c: In function 'nss_protocol_fill_netgrent':
src/responder/nss/nss_protocol_netgr.c:113: error: declaration of 'index' shadows a global declaration
/usr/include/string.h:489: error: shadowed declaration is here

Reviewed-by: Fabiano Fidêncio

RESPONDER: Fix "-Wold-style-definition" caught by GCC

2017-09-25T19:35:22+00:00

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Lukáš Slebodník

NSS: Fix "-Wold-style-definition" caught by GCC

2017-09-25T19:34:34+00:00

Signed-off-by: Fabiano Fidêncio 
Reviewed-by: Lukáš Slebodník

Print a warning when enumeration is requested but disabled

2017-09-25T12:33:06+00:00

Add an explanatory message to be logged once, at the start-up,
mentioning that in case enumeration is not enabled, getent passwd won't
return all users by design.
The debug level chosen to show the message is SSS_LOG_NOTICE.

Resolves:
https://pagure.io/SSSD/sssd/issue/2301

Reviewed-by: Jakub Hrozek 
Reviewed-by: Fabiano Fidêncio 
Reviewed-by: Lukáš Slebodník

SUDO: Use initgr_with_views when looking up a sudo user

2017-09-08T15:02:49+00:00

The sudo responder code didn't take views into account when looking for
rules, which resulted in sudo rules being ignored if the user's name was
overriden.

Please see the ticket for a detailed info on how to reproduce the bug.

Resolves:
https://pagure.io/SSSD/sssd/issue/3488

Reviewed-by: Pavel Březina