summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* TEST_NEGCACHE: Test that "root" is always added to ncacheFabiano Fidêncio2017-08-281-0/+6
| | | | | | | | | | | | | Simply modify test_sss_ncache_prepopulate() in order to ensure that "root" user and group are always added to the negative cache, no matter whether they're set as part of the filter_users or filter_groups options. Related: https://pagure.io/SSSD/sssd/issue/3460 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NEGCACHE: Always add "root" to the negative cacheFabiano Fidêncio2017-08-281-34/+54
| | | | | | | | | | | | | | The current code only adds "root" to the negative cache in case there's any other user or group set up in to be added. As SSSD doesn't handle "root", it should *always* be added to the negative cache. Related: https://pagure.io/SSSD/sssd/issue/3460 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* NEGCACHE: Add some comments about each step of sss_ncache_prepopulate()Fabiano Fidêncio2017-08-281-1/+4
| | | | | | | | | | | The comments help to understand which part of the code is dealing with users or groups of specific or non-specific domain filters. Related: https://pagure.io/SSSD/sssd/issue/3460 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DESKPROFILE: Add ipa_deskprofile_request_intervalFabiano Fidêncio2017-08-288-1/+53
| | | | | | | | | | | | | | | | This option has been added to avoid contacting the Data Provider when no rules were found in the previous request. By adding this configurable option we avoid contacting the Data Provider too often in the case described above and also when the server doesn't support Desktop Profile's integration. Resolves: https://pagure.io/SSSD/sssd/issue/3482 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Not having rules should not be logged as errorFabiano Fidêncio2017-08-281-1/+1
| | | | | | | | | Let's tone down the debug level to TRACE_FUNC instead of MINOR_FAILURE. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Add a debug message in case ipa_hbac_rule_info_next() failsFabiano Fidêncio2017-08-281-0/+1
| | | | | | | Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Enforce coding style ipa_hbac_rule_info_recv()Fabiano Fidêncio2017-08-282-6/+6
| | | | | | | | | By convention, the output variables are prefixed with a underscore. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Enforce coding style on ipa_hbac_rule_info_send()Fabiano Fidêncio2017-08-281-1/+1
| | | | | | | | | | Use if-else if-else statements instead of using severel different if statements. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Improve readability of ipa_hbac_rule_info_send()Fabiano Fidêncio2017-08-281-12/+11
| | | | | | | | | | | Move an if condition inside another if condition in order to make the readability a little bit more clear that those checks are about the same return code. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Remove a cosmetic extra space from an if clauseFabiano Fidêncio2017-08-281-1/+1
| | | | | | | Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Document ipa_hbac_rule_info_next()'s behaviourFabiano Fidêncio2017-08-281-0/+8
| | | | | | | | | | | Let's add a comment on ipa_hbac_rule_info_send() in order to have cleaner why ret is set to EINVAL when ipa_hbac_rule_info_next() returns EOK. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* HBAC: Fix tevent hierarchy in ipa_hbac_rule_info_send()Fabiano Fidêncio2017-08-281-24/+15
| | | | | | | | | | | | | | | The first thing a _send() function should o is call `tevent_req_create()` in order to create both the state and the request and then use the state as context for temporary data. Also, `tevent_req_create()` should be only function returning NULL from the _send function, while all the other calls should goto immediate and return the proper error, as they have a valid request. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DESKPROFILE: Introduce the new IPA session providerFabiano Fidêncio2017-08-2826-2/+2695
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In order to provide FleetCommander[0] integration, a session provider has been introduced for IPA. The design of this feature and more technical details can be found at [1] and [2], which are the design pages of both freeIPA and SSSD parts. As there's no way to test freeIPA integration with our upstream tests, no test has been provided yet. Is also worth to mention that the name "deskprofile" has been chosen instead of "fleetcmd" in order to match with the freeIPA plugin. It means that, for consistence, all source files, directories created, options added, functions prefixes and so on are following the choice accordingly. [0]: https://wiki.gnome.org/Projects/FleetCommander [1]: https://github.com/abbra/freeipa-desktop-profile/blob/master/plugin/Feature.mediawiki [2]: https://docs.pagure.org/SSSD.sssd/design_pages/fleet_commander_integration.html Resolves: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: Add sss_create_dir()Fabiano Fidêncio2017-08-283-0/+119
| | | | | | | | | | | | | | | | | The newly added function helps us to create a new dir avoiding a possible TUCTOU issue. It's going to be used by the new session provider code. A simple test for this new function has also been provided. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: move {files,selinux}.c under util directoryFabiano Fidêncio2017-08-288-42/+40
| | | | | | | | | | | | | | | | | | | | | | | | | files.c has at least one function that will be re-used for the new session provider that's about to be added. Also, a few other functions may be added and files.c seems the right place for those. selinux.c has been moved together with files.c as the latter takes advantage of some functions from the former and we do not want to always link agains the tools code. The public functions from files.c got a "sss_" prefix and it has been changed whenever they're used. Last but not least, all the places that included "tools/tools_util.h" due to the functions on files.c had this include removed (as they were already including "util/util.h". Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA_COMMON: Introduce ipa_get_host_attrs()Fabiano Fidêncio2017-08-283-29/+55
| | | | | | | | | | | | | By adding this method it can reused in the future for new backend modules. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA_ACCESS: Make use of struct ipa_common_entriesFabiano Fidêncio2017-08-281-82/+41
| | | | | | | | | | | | Just by doing so ipa_save_hbac() can be completely removed. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA_RULES_COMMON: Introduce ipa_common_get_hostgroupname()Fabiano Fidêncio2017-08-285-117/+118
| | | | | | | | | | | | | | | | | By moving the get_ipa_hostgroupname() method from ipa_hbac_hosts.[ch] to ipa_rules_common.[ch] it can be used by both HBAC and, in the future, for new backend modules. The method got renamed to ipa_common_get_hostgroupname() and some coding style changes have been made in order to match with what SSSD follows. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA_RULES_COMMON: Introduce ipa_common_save_rules()Fabiano Fidêncio2017-08-283-60/+149
| | | | | | | | | | | | | | | | | | | | | This method is kind of a replacement for ipa_save_hbac() one. While ipa_save_hbac() wasn't removed, its porpuse has been totally changed. Now it just prepare the ground and calls ipa_common_save_rules() which is a more generic function that can be reused for new backend modules. In order to make the code cleaner a new structure has also been introduced: struct ipa_common_entries; which contains the values that will be used to save the entry and the entrygroup to sysdb. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA_ACCESS: Make ipa_purge_hbac() more genericFabiano Fidêncio2017-08-283-33/+38
| | | | | | | | | | | | | | | | This mothod can also be reused in the future for new backend modules. In order to make it more generic, let's just move it to ipa_rules_common.[ch], rename it to ipa_common_purge_rules() and make the subtreename to be purged a new paramether of this method. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA_ACCESS: Make hbac_get_cache_rules() more genericFabiano Fidêncio2017-08-287-77/+141
| | | | | | | | | | | | | | | | | | | | | This method can also be reused in the future for new backend modules. In order to make it more generic, let's just move it to ipa_rules_common.[ch], rename it to ipa_common_get_cached_rules() and make the rule, subtree name and the attributes to be searched new parameters of this method. In order to not be declaring the enourmous list of attributes HBAC uses when calling this method, a new hbac_get_attrs_to_get_cached_rules() method has been introduced. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Leave only HBAC specific defines in ipa_hbac_private.hFabiano Fidêncio2017-08-288-11/+18
| | | | | | | | | | | | | The defines that were moved can and will be used by another backend module that will be introduced in the near future. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA: Make ipa_hbac_sysdb_save() more genericFabiano Fidêncio2017-08-285-153/+228
| | | | | | | | | | | | | | | | | | | Although there's no change in the ipa_hbac_sysdb_save() itself, its name has been changed to ipa_common_entries_and_groups_sysdb_save() and its been split out from HBAC related files and moved to the newly created ipa_rules_common.[ch] files, which will also be used in the future for new backend modules. ipa_rules_common.[ch] is not exactly the best name for those files, IMO, but I really cannot come up with something better. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA_ACCESS: Remove not used attributeFabiano Fidêncio2017-08-282-3/+0
| | | | | | | | | | | | | struct time_rules_ctx * is not used anywhere in in the access handler, thus there's no need to store it. Related: https://pagure.io/SSSD/sssd/issue/2995 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Don't pre-allocate the amount of entries requestedFabiano Fidêncio2017-08-251-7/+9
| | | | | | | | | | | | | | | | | | | | | | By allocating the number of entries when actually copying the list we can avoid situations where users request an enourmous amount of results but the number of results got from the backend are just a few. With this new approach we end up allocating the whole list more frequently but we avoid not returning valid results because the requested number of enties is too big (note that if the amount of results is too big as well, there's nothing much we can do). A simple reproducer for this issue can be the really extreme call: $ dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe \ /org/freedesktop/sssd/infopipe/Users \ org.freedesktop.sssd.infopipe.Users.ListByName string:"*" uint32:"-1" The example pasted above would try to allocate an array of MAX_UINT32 size, which would fail directly. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Change ifp_list_ctx_remaining_capacity() return typeFabiano Fidêncio2017-08-254-15/+47
| | | | | | | | | | | | Now ifp_list_ctx_remaining_capacity() returns an errno_t and receives the count as an output parameter. It allows better handling and error reporting in case something goes wrong internally in this function. Related: https://pagure.io/SSSD/sssd/issue/3306 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Fix of limit = 0 (unlimited result)Petr Čech2017-08-251-0/+9
| | | | | | | | | | | | | If we set limit to 0 it means that result is unlimited. Internally we restrict number of result by allocation of result array. In unlimited case there was a bug and zero array was allocated. This fix allocates neccessary array when we know real result size. Resolves: https://pagure.io/SSSD/sssd/issue/3306 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: Filter with * in infopipe group methodsPetr Čech2017-08-251-11/+15
| | | | | | | | | | | This patch fixes asterisk in filter of the ListByName Groups' method, which ends up calling ifp_groups_list_copy() with a NULL pointer. Resolves: https://pagure.io/SSSD/sssd/issue/3305 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: fix typo in option name in man pagesPavel Březina2017-08-252-2/+2
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* ldap_child: Removing duplicate log messageAmitKumar2017-08-251-13/+5
| | | | | | | | | | | Duplicate log messages were getting logged if trust relationship breaks for some reason from AD. That causes lot spam in syslog. This PR removes duplicate log entry and keeps extended log entry. Resolves: https://pagure.io/SSSD/sssd/issue/3450 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libwbclient: Fix warning statement with no effectLukas Slebodnik2017-08-221-1/+1
| | | | | | | | | | | | | | | src/sss_client/libwbclient/wbc_pam_sssd.c: In function ‘wbcAuthenticateUserEx’: src/sss_client/libwbclient/wbc_pam_sssd.c:52:5: error: statement with no effect [-Werror=unused-value] WBC_ERR_WINBIND_NOT_AVAILABLE; ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/sss_client/libwbclient/wbc_pam_sssd.c:53:1: error: control reaches end of non-void function [-Werror=return-type] } ^ Related to: https://pagure.io/SSSD/sssd/issue/3461 Reviewed-by: Sumit Bose <sbose@redhat.com>
* libwbclient: Change return code for wbcAuthenticateUserExLukas Slebodnik2017-08-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Samba-4.6 change behaviour of few functions New version of code make sure session info for user is stored in cache. It is a performance optimisation to prevent contacting KDC for each session. More details in samba bug https://bugzilla.samba.org/show_bug.cgi?id=11259 Old return code WBC_SSSD_NOT_IMPLEMENTED was translated to NT_STATUS_LOGON_FAILURE which caused many failures. [2017/08/21 11:34:15.044321, 5, pid=27742, effective(0, 0), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2017/08/21 11:34:15.044330, 5, pid=27742, effective(0, 0), real(0, 0)] ../source3/auth/token_util.c:640(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2017/08/21 11:34:15.044349, 4, pid=27742, effective(0, 0), real(0, 0)] ../source3/smbd/sec_ctx.c:439(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2017/08/21 11:34:15.044360, 1, pid=27742, effective(0, 0), real(0, 0)] ../source3/smbd/sesssetup.c:290(reply_sesssetup_and_X_spnego) Failed to generate session_info (user and group token) for session setup: NT_STATUS_LOGON_FAILURE Resolves: https://pagure.io/SSSD/sssd/issue/3461 Reviewed-by: Sumit Bose <sbose@redhat.com>
* sudo: add a threshold option to reduce size of rules refresh filterPavel Březina2017-08-188-5/+56
| | | | | | | | | | | | | If a large number of rules is expired at one time the ldap filter may become too large to be processed by server. This commits adds a new option "sudo_threshold" to sudo responder. If the threshold is exceeded a full refreshed is done instead of rules refresh. Resolves: https://pagure.io/SSSD/sssd/issue/3478 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* intg: Increase startup timeouts for kcm and secretsLukas Slebodnik2017-08-182-2/+2
| | | | | | | | | | | | | | | | | | | | | | | In cwrap environment, we start sssd_kcm and sssd_secrets ourself and not by systemd socket activation. Our approach is to wait a second in a loop till socket is available. However sometimes 1 second is not enough. Patch increases wait timeout from 1 second to 10 and it seems to be enough even when processes were executed with valgrind. Traceback (most recent call last): File "src/tests/intg/test_secrets.py", line 419, in setup_for_cli_timeout_test return create_sssd_secrets_fixture(request) File "src/tests/intg/test_secrets.py", line 82, in create_sssd_secrets_fixture assert os.path.exists(sock_path) AssertionError: assert False + where False = <function exists at 0x7f6c1cf520c8>('/tmp/sssd-intg.cdv0namx/var/run/secrets.socket') + where <function exists at 0x7f6c1cf520c8> = <module 'posixpath' from '/usr/lib64/python2.7/posixpath.pyc'>.exists + where <module 'posixpath' from '/usr/lib64/python2.7/posixpath.pyc'> = os.path Resolves: https://pagure.io/SSSD/sssd/issue/3481 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Fix minor typos in docsYuri Chornoivan2017-08-165-19/+19
| | | | | | Merges: https://pagure.io/SSSD/sssd/pull-request/3456 Reviewed-by: Michal Židek <mzidek@redhat.com>
* Fix minor typosYuri Chornoivan2017-08-162-3/+3
| | | | | | Merges: https://pagure.io/SSSD/sssd/pull-request/3456 Reviewed-by: Michal Židek <mzidek@redhat.com>
* UTIL: Set udp_preference_limit=0 in krb5 snippetPetr Čech2017-08-145-22/+51
| | | | | | | | | | | | | We add udp_preference_limit = 0 to krb5 snippet if ad provider is used. This option enable TCP connection before UDP, when sending a message to the KDC. Resolves: https://pagure.io/SSSD/sssd/issue/3254 Signed-off-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Robbie Harwood <rharwood@redhat.com>
* intg: Disable add_remove testsLukas Slebodnik2017-08-141-5/+5
| | | | | | | | | | | | | add_remove fails quite often in enumeration test. The reason of failures is not obvious and will take some time to investigate it. Failures blocks testing of other patches therefore its better to disable tests. (pytest run functions/methods which start with "test") Temporary workaround for: https://pagure.io/SSSD/sssd/issue/3463 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* SHARED: Return warning back about minimal header filesLukas Slebodnik2017-08-033-9/+24
| | | | | | | | | | The warning still make a sense and should be there. Patch also fixes header guards due t changed location. Related to: https://pagure.io/SSSD/sssd/issue/1898 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IFP: Do not fail when a GHOST group is not foundPetr Čech2017-08-031-6/+1
| | | | | | | | | | | Usually is okay that there are no ghost attributes for a group as it basically just means that the group either has no members or all members have been previously fully resolved. Resolves: https://pagure.io/SSSD/sssd/issue/3315 Reviewed-by: Michal Židek <mzidek@redhat.com>
* libwbclient-sssd: update interface to version 0.14Sumit Bose2017-08-033-4/+12
| | | | | | The main change is a new member of the wbcAuthErrorInfo struct. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* Moving headers used by both server and client to special folderAmitKumar2017-08-0317-33/+18
| | | | | | | | | | | | | | | | | | | These are the header files which are used by both client and server: src/util/io.h src/util/murmurhash3.h src/util/util_safealign.h This patch is about moving these header files to special folder (src/shared). It will be easier to identify these headers when looking for them in the src tree. util_safalign.h is renamed as safalign.h because util_ namespace is appropriate when this file belonged to the util's folder which is no longer the case. Resolves: https://pagure.io/SSSD/sssd/issue/1898 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* CACHE_REQ: Fix warning may be used uninitializedFabiano Fidêncio2017-07-311-0/+2
| | | | | | | Setting ret as EOK in case everything goes well. Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
* MAN: Don't tell the user to autostart sssd-kcm.service; it's socket-enabledJakub Hrozek2017-07-271-2/+0
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* MAN: Describe session recording configurationNikolai Kondrashov2017-07-275-1/+267
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* INTG: Add session recording testsNikolai Kondrashov2017-07-273-14/+978
| | | | | | | Add basic tests for all base combinations of session recording configuration options. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* PAM: Export original shell to tlog-rec-sessionNikolai Kondrashov2017-07-271-0/+96
| | | | | | | | | Add exporting of original user shell (as returned by NSS) as an environment variable for use by tlog-rec-session, when session recording is enabled for the user. This lets tlog-rec-session start the actual user shell, after tlog-rec-session is started in its place. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS: Substitute session recording shellNikolai Kondrashov2017-07-271-1/+47
| | | | | | | | | Substitute the configured session recording shell when unconditional session recording is enabled (scope = all), or when selective session recording is enabled (scope = some), and the user has the sessionRecording attribute set to true. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Pull sessionRecording attrs from initgrNikolai Kondrashov2017-07-274-6/+382
| | | | | | | | | | | | After entires are retrieved by cache_req for user info requests (except initgr), overlay them with sessionRecording attribute retrieved from an initgr request made additionally for each entry. Do not do additional initgr requests with selective session recording enabled, if we don't have any group names to match against in session recording configuration. Only do user name matches instead. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* DP: Overlay sessionRecording attribute on initgrNikolai Kondrashov2017-07-271-34/+231
| | | | | | | | Add sessionRecording attribute to user entries on initgr request in data provider, specifying if the user name or groups match the ones with session recording enabled. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 16:05:16 +0000