sssd.git/src/p11_child, branch certificate_mapping

Rename dp_backend.h to backend.h

2016-06-20T12:48:46+00:00

Reviewed-by: Sumit Bose 
Reviewed-by: Jakub Hrozek 
Reviewed-by: Lukáš Slebodník

p11: add OCSP default responder options

2016-06-09T09:58:17+00:00

Reviewed-by: Jakub Hrozek

p11: add no_verification option

2016-06-09T09:58:12+00:00

Reviewed-by: Jakub Hrozek

DEBUG: Add missing new lines

2015-12-14T09:10:16+00:00

Reviewed-by: Petr Cech

p11: enable ocsp checks

2015-11-26T15:39:49+00:00

This patch enables the Online Certificate Status Protocol in NSS and
adds an option to disable it if needed. To make further tuning of
certificate verification more easy it is not an option on its own but an
option to the new certificate_verification configuration option.

Resolves https://fedorahosted.org/sssd/ticket/2812

Reviewed-by: Jakub Hrozek

p11: check if cert is valid before selecting it

2015-11-26T15:34:32+00:00

Currently the first certificate was selected and if it was not valid
p11_child just returned an error. With this patch the validity is
checked first and the first valid certificate is selected.

Resolves https://fedorahosted.org/sssd/ticket/2801

Reviewed-by: Jakub Hrozek

p11: allow p11_child to run completely unprivileged

2015-11-20T13:56:34+00:00

To only operation of p11_child which requires special privileges is the
communication to pcscd which handles the Smartcard access. pcscd uses
policy-kit for access control so access can easily be configured by
dropping config snippets into the right directory.

If SSSD is configured to run as un-privileged user this patch creates
the needed config snippet for policy-kit and installs it in a suitable
directory. As a result p11_child does not have to be installed with
SETUID or SETGID bits set.

Resolves https://fedorahosted.org/sssd/ticket/2755 by making it obsolete

Reviewed-by: Jakub Hrozek

P11_CHILD_NSS: More restrictive permissions

2015-10-14T11:27:18+00:00

p11_child_nss runs as root and we must be carefull about security. This
patch adds more restrictive permissions on it. There is no reason for
0077, so we use 0177 umask.

Resolves:
https://fedorahosted.org/sssd/ticket/2424

Reviewed-by: Jakub Hrozek

REFACTOR: umask(077) --> umask(SSS_DFL_X_UMASK)

2015-10-14T11:27:13+00:00

There are many calls of umask function with 077 argument. This patch
add new constant SSS_DFL_X_UMASK which stands fot 077. So all
occurences of umask(077) are replaced by constant SSS_DFL_X_UMASK.

Resolves:
https://fedorahosted.org/sssd/ticket/2424

Reviewed-by: Jakub Hrozek

p11child: set restrictive umask and clear environment

2015-08-17T12:02:59+00:00

https://fedorahosted.org/sssd/ticket/2754

Before doing any calls, set a very restrictive umask and clear
environment variables to harden p11child execution.

Reviewed-by: Lukáš Slebodník