sssd.git/contrib, branch libwbclient-0.13

MAN: sssd-secrets documentation

2016-09-30T07:09:26+00:00

Resolves:
    https://fedorahosted.org/sssd/ticket/3053

Documents the API and the purpose of the sssd-secrets responder.

Reviewed-by: Fabiano Fidêncio 
Reviewed-by: Pavel Březina

SPEC: Rename python packages using macro %python_provide

2016-09-22T19:44:41+00:00

Fedora and epel contains macro %python_provide
for simpler renaming of python packages. It will generate correct
provides and obsoletes.

Reviewed-by: Michal Židek

TESTS: Add simple test for double semicolon

2016-09-21T14:46:19+00:00

Reviewed-by: Pavel Březina

TESTS: Add integration tests for the sssd-secrets

2016-09-20T15:34:39+00:00

Implements a simple HTTP client and uses it to talk to the sssd-secrets
responder. Only the local provider is tested at the moment.

Resolves:
https://fedorahosted.org/sssd/ticket/3054

Reviewed-by: Petr Čech 
Reviewed-by: Lukáš Slebodník

SPEC: Fix typo in Summary

2016-08-26T13:27:15+00:00

Reviewed-by: Jakub Hrozek

BUILD: Allow to read private pipes for root

2016-08-26T12:29:30+00:00

Root can read anything from any directory even with permissions 000.

However SELinux checks discretionary access control (DAC)
and deny access if access is not allowed for root by DAC.
The pam_sss use different unix socket /var/lib/sss/pipes/private/pam
for user with uid 0. Therefore root need to be able read content
of directory with private pipes.

type=AVC msg=audit(08/19/2016 10:58:34.081:3369) : avc:  denied
  { dac_read_search } for  pid=20257 comm=vsftpd capability=dac_read_search
  scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
  tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability

type=AVC msg=audit(08/19/2016 10:58:34.081:3369) : avc:  denied
  { dac_override } for  pid=20257 comm=vsftpd capability=dac_override
  scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
  tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability

Resolves:
https://fedorahosted.org/sssd/ticket/3143

Reviewed-by: Jakub Hrozek

BUILD: Ship systemd service file for sssd-secrets

2016-08-17T14:55:31+00:00

Adds two new files: sssd-secrets.socket and sssd-secrets.service. These
can be used to socket-acticate the secrets responder even without
explicitly starting it in the sssd config file.

The specfile activates the socket after installation which means that
the admin would just be able to use the secrets socket and the
sssd_secrets responder would be started automatically by systemd.

The sssd-secrets responder is started as root, mostly because I didn't
think of an easy way to pass the uid/gid to the responders without
asking about the sssd user identity in the first place. But nonetheless,
the sssd-secrets responder wasn't tested as non-root and at least the
initialization should be performed as root for the time being.

Reviewed-by: Fabiano Fidêncio 
Reviewed-by: Lukáš Slebodník

SPEC: Own the secrets DB path

2016-08-17T14:15:17+00:00

Reviewed-by: Lukáš Slebodník

CI: Use /bin/sh as a CONFIG SHELL

2016-07-22T06:57:05+00:00

There is a bug on debian_testing in bash.
  sh$ valgrind /bin/bash
  ==25145== Memcheck, a memory error detector
  ==25145== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
  ==25145== Using Valgrind-3.12.0.SVN and LibVEX; rerun with -h for copyright info
  ==25145== Command: /bin/bash
  ==25145==
  ==25145== Invalid read of size 1
  ==25145==    at 0x4B90B1: ??? (in /bin/bash)
  ==25145==    by 0x43FE9B: initialize_shell_variables (in /bin/bash)
  ==25145==    by 0x41E4C0: ??? (in /bin/bash)
  ==25145==    by 0x41F722: main (in /bin/bash)
  ==25145==  Address 0x58307f8 is 8 bytes before a block of size 31 alloc'd
  ==25145==    at 0x4C2BBCF: malloc (vg_replace_malloc.c:299)
  ==25145==    by 0x475D1A: xmalloc (in /bin/bash)
  ==25145==    by 0x4B7F4A: tilde_expand (in /bin/bash)
  ==25145==    by 0x42E63D: bash_tilde_expand (in /bin/bash)
  ==25145==    by 0x43FE79: initialize_shell_variables (in /bin/bash)
  ==25145==    by 0x41E4C0: ??? (in /bin/bash)
  ==25145==    by 0x41F722: main (in /bin/bash)
  ==25145==

  malloc: .././variables.c:570: assertion botched
  free: called with unallocated block argument
  last command: (null)
  Aborting...==25145==

And /bin/bash was used as a default SHELL in scripts generated by
configure+libtool. It starting to fail with the latest valgrind
valgrind-3.12.0~svn20160714-1

Workaround is to use /bin/sh which is a symlink to /bin/dash

Reviewed-by: Petr Cech

SPEC: Move nfsidmap plugin to separate package

2016-07-18T12:02:36+00:00

Resolves:
https://fedorahosted.org/sssd/ticket/3024

Reviewed-by: Noam Meltzer