summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* cache_req: add ability to filter domains by enumerationPavel Březina2016-12-1913-5/+55
| | | | | | | | | | | Skip domains without enumeration if a plug-in requires it. This is preparation for enumeration support inside cache_req. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cache_req: add ability to gather result from all domainsPavel Březina2016-12-1913-17/+71
| | | | | | | | | This is preparation for enumeration support inside cache_req. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cache_req: encapsulate output data into structurePavel Březina2016-12-1911-147/+254
| | | | | | | | | | | | | In enumeration calls we want to get objects from all domains, not only from the first matched domain. We move the cache search result into a structure that contains combination of domain and ldb_result. This is preparation for enumeration support inside cache_req. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cache_req: skip first search on bypass cachePavel Březina2016-12-191-10/+22
| | | | | | | | | | If we always want to contact the data provider to fetch data, we don't need to search the cache prior to this call. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* cache_req: fix initgroups by namePavel Březina2016-12-191-1/+3
| | | | | | | | | | | If overriden name was provided we stole already freed value. Name is attached to "user" talloc context which we freed before stealing the value. This caused crash in SSSD. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_output_name: do not require fq namePavel Březina2016-12-191-3/+7
| | | | | | | Now, we return the original name, assuming it is a shortname, instead of returning an error. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_crypto.h: include required headersPavel Březina2016-12-191-0/+3
| | | | | | So we do not depend on #include order. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* setent_notify: remove unused private contextPavel Březina2016-12-194-7/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ifp: remove unused fields from statePavel Březina2016-12-191-2/+0
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* nss: move nss_ctx->global_names to rctxPavel Březina2016-12-196-19/+14
| | | | | | | | | | | | Global names context is used to parse AD well known SIDs and names into its opposite. This patch moves definition of this parameter from nss responder into common responder context so it can be used also by other responders. This change will be use to enable looking up well known SIDs and names directly in cache_req. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Find a host-prefixed krb5-config when cross-compilingDavid Michael2016-12-161-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tests: sssctl user/group-show basic testsMichal Židek2016-12-152-0/+362
| | | | | | | | | | Add basic tests for sssctl user/group-show commands. This includes regression test for ticket #3235. Resolves: https://fedorahosted.org/sssd/ticket/3235 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sssctl: Case insensitive filtersMichal Židek2016-12-151-0/+8
| | | | | | | | | Lowercase the filter in case insensitive domains. Resolves: https://fedorahosted.org/sssd/ticket/3235 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sssctl: Search by aliasMichal Židek2016-12-151-2/+4
| | | | | | | | | Also search by alias when using sssctl to query the cache. Resolves: https://fedorahosted.org/sssd/ticket/3235 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* common: Fix domain case sensitivity initMichal Židek2016-12-151-3/+9
| | | | | | | | | | The domain case sensitivity was wrongly set in the domain context after initialization if the provider was AD. Resolves: https://fedorahosted.org/sssd/ticket/3235 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sudo: do not store usn if no rules are foundPavel Březina2016-12-081-1/+8
| | | | | | | | | | | | When ldap doesn't contain any sudorule during the initial full refresh, usn is set to 1 instead of remaining unset and we are trying to search modifyTimestamp>=1 during smart refresh which doesn't return any result on openldap servers. Resolves: https://fedorahosted.org/sssd/ticket/3257 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* STAP: Only print transaction statistics if the script caught some transactionsJakub Hrozek2016-12-081-2/+4
| | | | | | | If the script measured an 'id' run from the cache, there would be no transactions and dereferencing the aggrefate would throw an error. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Prevent use after free in fd_input_availableCarl Henrik Lunde2016-12-081-6/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When both TEVENT_FD_WRITE and TEVENT_FD_READ are set, and an error/EOF occurs when reading from the socket, we will get a use after free in the second call ares_process_fd. The first call will free the watch structure via a callback. Prevent this by calling ares_process_fd only once. Invalid read of size 4 at fd_input_available (async_resolv.c:147) by epoll_event_loop (tevent_epoll.c:728) by epoll_event_loop_once (tevent_epoll.c:926) by std_event_loop_once (tevent_standard.c:114) by _tevent_loop_once (tevent.c:533) by tevent_common_loop_wait (tevent.c:637) by std_event_loop_wait (tevent_standard.c:140) by server_loop (server.c:702) by main (data_provider_be.c:587) Address ... is 112 bytes inside a block of size 136 free'd at free (vg_replace_malloc.c:530) by _talloc_free_internal (talloc.c:1116) by _talloc_free (talloc.c:1647) by ares__close_sockets (ares__close_sockets.c:50) by handle_error (ares_process.c:679) by read_tcp_data (ares_process.c:391) by processfds (ares_process.c:138) by fd_input_available (async_resolv.c:144) by epoll_event_loop (tevent_epoll.c:728) by epoll_event_loop_once (tevent_epoll.c:926) by std_event_loop_once (tevent_standard.c:114) by _tevent_loop_once (tevent.c:533) by tevent_common_loop_wait (tevent.c:637) by std_event_loop_wait (tevent_standard.c:140) by server_loop (server.c:702) Resolves: https://fedorahosted.org/sssd/ticket/3250 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Remove "ChangeDebugTemporarily" methodFabiano Fidêncio2016-12-086-141/+0
| | | | | | | | | This method has been only used by OpenLMI, which has been deprecated and its support dropped from SSSD on commit 99b2352. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB: Suppress sysdb_delete_ts_entry failed: 0Jakub Hrozek2016-12-081-3/+7
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* RESPONDER: Remove dead assignment to the variable retLukas Slebodnik2016-12-081-2/+0
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* SSH: Use default_domain_suffix for users' authorized keysJakub Hrozek2016-12-061-4/+8
| | | | | | | | | | | | | | | | | In commit eeecc48d22a28bb69da56f6ffd8824163fc9bf00 we disabled default_domain_suffix for the SSH responder, but in a wrong way -- we disabled the functionality completely, also for users, not only for computers. This might have been correct at the time, since SSH keys in ID overrides are a relatively new feature, but it's definitely not correct in general. Instead, this patch restores the use of default_domain_suffix, but only for looking up public keys of users, not of computers. Resolves: https://fedorahosted.org/sssd/ticket/3259 Reviewed-by: Petr Cech <pcech@redhat.com>
* SIFP: Fix warning format-securityLukas Slebodnik2016-12-011-1/+1
| | | | | | | | | | | | | dbus-1.11.8 added attributes for format string check to few functions in public header files. And therefore there is a warning. src/lib/sifp/sss_sifp_utils.c: In function ‘sss_sifp_set_io_error’: src/lib/sifp/sss_sifp_utils.c:44:5: error: format not a string literal and no format arguments [-Werror=format-security] dbus_set_error(ctx->io_error, error->name, error->message); ^~~~~~~~~~~~~~ Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CONFDB: Supress clang false passitive warningsLukas Slebodnik2016-11-291-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The errno is macro expandee into '(*__errno_location ())'. The reason is that errno is private in glibc and and the function __errno_location return address of private errno. sh$ objdump -T /lib64/libc.so.6 | grep errno 00000010 g D .tbss 00000004 GLIBC_PRIVATE errno 000208a0 g DF .text 00000011 GLIBC_2.2.5 __errno_location 001366b0 g DF .text 0000005f GLIBC_2.2.5 clnt_sperrno 00136710 g DF .text 00000074 GLIBC_2.2.5 clnt_perrno 00000064 g D .tbss 00000004 GLIBC_PRIVATE __h_errno 0011aad0 g DF .text 00000011 GLIBC_2.2.5 __h_errno_location It looks like clang static analyzer assume that value can be changed due to function call. errno = 0; val = strtol(values[0], NULL, 0); // Taking true branch => assuming "errno != 0" if (errno) { ret = errno; // errno was stored to ret but clang later assumes // that ret can be 0 goto failed; Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* krb5: add tests for common functionsSumit Bose2016-11-282-0/+315
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5: fix two memory leaksSumit Bose2016-11-281-7/+2
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5: Use command line arguments instead env vars for krb5_childSumit Bose2016-11-287-131/+276
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/697 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Fix compilation of sss_utf8 with libunistringLukas Slebodnik2016-11-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | The internal header file "util/util.h" was removed from sss_utf8.h as part of commit de5fa34860886ad68fba5e739987e16c342e8f14. It was neccessary to ensure libipa_hbac can be build with C90 compatible compiler. This header file includes many system header file and after this change caused missing declaration of the function free() src/util/sss_utf8.c: In function ‘sss_utf8_free’: src/util/sss_utf8.c:40:12: error: implicit declaration of function ‘free’ [-Werror=implicit-function-declaration] return free(ptr); ^~~~ src/util/sss_utf8.c:40:12: warning: incompatible implicit declaration of built-in function ‘free’ src/util/sss_utf8.c:40:12: note: include ‘<stdlib.h>’ or provide a declaration of ‘free’ cc1: some warnings being treated as errors Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* sssctl: Fix missing declarationLukas Slebodnik2016-11-251-0/+1
| | | | | | | | | | | | | | | | | | | | The WEXITSTATUS is defined in stdlib.h on linux. There is a nice comment in stdlib.h: /* Define the macros <sys/wait.h> also would define this way. */ It's better to not rely on this and use more platfom friendly way with including "sys/wait.h". For example the libc on FreeBSD does not provide WEXITSTATUS in stdlib.h. I found this macro mentioned only in the manual page for wait(2) and there is mentioned just the "sys/wait.h" and not "stdlib.h" src/tools/sssctl/sssctl.c: In function 'sssctl_run_command': src/tools/sssctl/sssctl.c:110: error: implicit declaration of function 'WEXITSTATUS' gmake[2]: *** [Makefile:22383: src/tools/sssctl/sssctl-sssctl.o] Error 1 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SYSDB: Remove unused prototype from header fileLukas Slebodnik2016-11-251-5/+0
| | | | | | | The function sysdb_get_sudo_filter was removed as part of ticket #2919 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* UTIL: Fix implicit declaration of function 'htobe32'Lukas Slebodnik2016-11-252-0/+2
| | | | | | | | | | | | | | | | | | | Include internal wrapper header file for endian related functions. The "util/sss_endian.h" include available header file on different platform or it provides compatible macros in the worst case. Breakage noticed when building SSSD on FreeBSD CC src/util/cert/nss/libsss_cert_la-cert.lo src/util/cert/nss/cert.c: In function 'cert_to_ssh_key': src/util/cert/nss/cert.c:358: error: implicit declaration of function 'htobe32' gmake[2]: *** [Makefile:12421: src/util/cert/nss/libsss_cert_la-cert.lo] Error 1 gmake[2]: Leaving directory '/root/sssd_from_git' gmake[1]: *** [Makefile:20050: all-recursive] Error 1 gmake[1]: Leaving directory '/root/sssd_from_git' gmake: *** [Makefile:7116: all] Error 2 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* BUILD: Drop libsss_configFabiano Fidêncio2016-11-2416-1849/+0
| | | | | | | | | | | | libsss_config has been used only by OpenLMI and the project has been deprecated making, then, no sense to keep the support on SSSD. Distros that, for some reason, are still packing and distributing OpenLMI can stick to SSSD 1.14 branch. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_client: Defer thread cancellation until completion of nss/pam operationsHoward Guo2016-11-243-85/+7
| | | | | | | | | | | | | The client code is not cancellation-safe, an application which has cancelled an NSS operation will experience subtle bugs, hence thread cancellation is deferred until completion of client operations. Resolves: https://fedorahosted.org/sssd/ticket/3156 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Florian Weimer <fweimer@redhat.com>
* SECRETS: Add configurable payload size limit of a secretFabiano Fidêncio2016-11-2413-0/+83
| | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/3169 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: Delete all secrets stored during "max_secrets" testFabiano Fidêncio2016-11-241-0/+4
| | | | | | | | | | Otherwise we will have an 507 error in case any secret is added by any of the tests that may be implemented in the future. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Check new line at end of fileLukas Slebodnik2016-11-234-3/+16
| | | | Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* SYSDB: Fixing of sudorule without a sudoUserPetr Čech2016-11-231-0/+5
| | | | | | | | | | | | | | This patch solved a regression caused by the recent patches to lowercase sudoUser -- in case sudoUser is missing completely, we abort the processing of this rule and all others. With this patch, we return ERR_MALFORMED_ENTRY and gracefully skip the malformed rule instead. Resolves: https://fedorahosted.org/sssd/ticket/3241 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KRB5: Remove spurious warning in logsLukas Slebodnik2016-11-221-1/+1
| | | | | | | | | | The option krb5_map_user is empty by default. Therefore we should not confuse users wih warning (Fri Nov 15 09:58:49 2016) [sssd[be[example.com]]] [parse_krb5_map_user] (0x0200): Warning: krb5_map_user is empty! Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* BUILD: Fix a typo in inotify.m4Jakub Hrozek2016-11-221-2/+2
| | | | | | | | This typo prevented HAVE_INOTIFY from ever being set and as an effect, prevented /etc/resolv.conf inotify detection from working Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* tests: Add a test for group resolution with ldap_group_nesting_level=0Jakub Hrozek2016-11-161-0/+29
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Qualify ghost user attribute in case ldap_group_nesting_level is set to 0Jakub Hrozek2016-11-161-4/+11
| | | | | | | | | | | When the sssd is set to not resolve nested groups with RFC2307bis, then the LDAP provider takes a different path. We didn't qualify the ghost users in this case. Resolves: https://fedorahosted.org/sssd/ticket/3236 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Document different defaults for IPA providerJustin Stephenson2016-11-153-75/+144
| | | | | | | | | | | Update man pages for any IPA provider config options that differ from ldap/krb5 provider back-end defaults Resolves: https://fedorahosted.org/sssd/ticket/3214 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Document different defaults for AD providerJustin Stephenson2016-11-153-24/+78
| | | | | | | | | | | Update man pages for any AD provider config options that differ from ldap/krb5 provider back-end defaults Resolves: https://fedorahosted.org/sssd/ticket/3214 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* ipa: Nested netgroups do not workMichal Židek2016-11-141-12/+3
| | | | | | | | | | | | | | | We lowercase the keys to the hash table used to store netgroups but do not lowercase it when reading the table. This results in nested netgroups not being found when they should and the processing fails. The lowercasing does not seem to be necessary anymore (not sure if it ever was) so we can skip it. Resolves: https://fedorahosted.org/sssd/ticket/3159 Reviewed-by: Petr Cech <pcech@redhat.com>
* UTIL: Removing of never read valuePetr Čech2016-11-141-1/+0
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RESPONDER: Adding of return value checkingPetr Čech2016-11-141-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SECRETS: Add allowed_sec_users_optionsFabiano Fidêncio2016-11-101-5/+10
| | | | | | | | | | | There are options (the proxying related ones) that only apply to the secrets' subsections. In order to make config API able to catch those, let's create a new section called allowed_sec_users_options) and move there these proxying options. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SECRETS: Fix secrets rule in the allowed sectionsFabiano Fidêncio2016-11-101-2/+2
| | | | | | | | | | | | | | We have been matching an invalid subsection of the secrets' section, like: [secrets/users/] Let's ensure that we only match the following cases: [secrets] [secrets/users/[0-9]+] Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA/AD: check auth ctx before using itSumit Bose2016-11-102-5/+28
| | | | | | | | | | | | | In e6b6b9fa79c67d7d2698bc7e33d2e2f6bb53d483 a feature was introduced to set the 'canonicalize' option in the system-wide Kerberos configuration according to the settings in SSSD if the AD or IPA provider were used. Unfortunately the patch implied that the auth provider is the same as the id provider which might not always be the case. A different auth provider caused a crash in the backend which is fixed by this patch. Resolves https://fedorahosted.org/sssd/ticket/3234 Reviewed-by: Petr Cech <pcech@redhat.com>
* MONITOR: Remove unused shutDown sbus methodJakub Hrozek2016-11-0911-21/+0
| | | | | | | The shutDown method has not been used or set for a long time. Trim the internal interface by removing all references to this internal method. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2025-10-01 11:56:15 +0000