summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* IPA: Check RDN in ipa_add_ad_memberships_get_nextLukas Slebodnik2016-04-121-1/+7
| | | | | | | | | | | | | | | | | LDB functions ldb_dn_get_component_val and ldb_dn_get_rdn_val validate dn before returning component value. It should be valid DN according to RFC4514. IPA/389ds might return problematic DN due to replication conflicts. e.g. "cn=System: Read Service Delegations+nsuniqueid=b0736336-d06e11e5-8e8acabe-ce8d458d,cn=permissions,dc=example,dc=com" It's better to check return value of these LDb function rather than crash because of dereference of NULL pointer. Resolves: https://fedorahosted.org/sssd/ticket/2980 Reviewed-by: Sumit Bose <sbose@redhat.com>
* GPO: Process GPOS in offline mode if ldap search failedLukas Slebodnik2016-04-121-0/+20
| | | | | | | | | | | | | | | | | Initgroup requests use global catalog for LDAP queries. Only port for global catalog is marked as offline if request fails due to problems with connection. However, GPO code uses standard LDAP port for retrieving of target DNs and other information. Previously, GPOs were processed in offline mode only if there were issues with connection to AD server. But connection can be cached and ldap search can still fail. Resolves: https://fedorahosted.org/sssd/ticket/2964 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: global_talloc_context push/pop removePetr Cech2016-04-125-12/+0
| | | | | | | | Push/pop global_talloc_context into check_leaks is redudant. It is done in leak_check_setup() and leak_check_teardown() functions in src/tests/check_leaks. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* GPO_CHILD: Create directories in gpo_cache with right permissionsLukas Slebodnik2016-04-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The parent directory has to have execute bit if we want to create subdirectories or read files there. sh-4.3$ mkdir dir sh-4.3$ echo "test" > dir/test_file sh-4.3$ chmod 644 dir/ sh-4.3$ ls dir/ test_file sh-4.3$ cat dir/test_file cat: dir/test_file: Permission denied It was not probelm for sssd in root mode because root has by default capbilities DAC_OVERRIDE and DAC_READ_SEARCH which bypass file read, write, and execute permission checks and directory read and execute permission checks Resolves: https://fedorahosted.org/sssd/ticket/2962 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* GPO: Soften umask in gpo_childLukas Slebodnik2016-04-071-4/+12
| | | | | | | | | | | | | | | | | | The default umask(0177) inherited from sssd_be is to strict for gpo_child in non-root mode. mkdir creates directories with only "rw" permission for owner. The man 1 chmod says: "execute (or search for directories) (x)" In another words, execute bit is required for directories. sh-4.3$ mkdir dir sh-4.3$ chmod 600 dir/ sh-4.3$ mkdir dir/subdir mkdir: cannot create directory ‘dir/subdir’: Permission denied Resolves: https://fedorahosted.org/sssd/ticket/2962 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: Recognize Windows Server 2016Jakub Hrozek2016-04-072-3/+6
| | | | | | | | | | Even though at this time the MSDN documentation at: https://msdn.microsoft.com/en-us/library/cc223272.aspx still claims that "7" is a value of DS_BEHAVIOR_WINTHRESHOLD, testing with Windows Server 2016 Preview already shows that server reporting a new value of Domain Controller Functionality. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* test_ipa_subdom_server: Workaround for slow krb5 + SELinuxLukas Slebodnik2016-04-071-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is an overhead caused by SELinux after fixing memory leak in krb5. https://bugzilla.redhat.com/show_bug.cgi?id=1311287. The overhead is mainly visible with valgrind and moreover it causes failures due to timeouts. sh$ time libtool --mode=execute ./test_ipa_subdom_server enabled/permissive SELinux real 0m7.976s user 0m6.680s sys 0m0.189s disabled SELinux real 0m2.111s user 0m0.071s sys 0m0.043s valgrind + enabled/permissive SELinux real 2m7.310s user 2m17.080s sys 0m0.786s valgrind + disabled SELinux real 0m5.510s user 0m3.396s sys 0m0.309s Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Netlink: Ignore RTM_NEWADDR signals from link-localStephen Gallagher2016-04-061-0/+50
| | | | | | | | We only need to go online if we receive a netlink signal that might indicate that the external connection might have become available. This will never be true for link-local addresses. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* MAN: Remove duplicate description of the pam_account_locked_message optionJakub Hrozek2016-04-061-21/+0
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SDAP: Remove unused parameter talloc contextLukas Slebodnik2016-04-051-4/+2
| | | | | | Parameter memctx was unused in sdap_nested_group_add_ext_members. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* IPA: Remove unused parameter from ipa_ext_group_member_checkLukas Slebodnik2016-04-051-2/+1
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* GPO: log specific ini parse error messagesMichal Židek2016-03-232-2/+40
| | | | | | | | We should log error messages generated by libini if there are problems with parsing gpo files. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Allow to append new line in sss_vdebug_fnLukas Slebodnik2016-03-234-4/+12
| | | | | | | | libldb is not consistent with appending line feed in debug messages. AS a result of this two messages can be on the same line in sssd log files. Which makes analyzing log files more difficult. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Move debug part from util.h -> new debug.hLukas Slebodnik2016-03-232-118/+141
| | | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SUDO: be able to parse modifyTimestamp correctlyPavel Březina2016-03-174-29/+62
| | | | | | | | | | | | | We were unable to parse modifyTimestamp where a non-numeric part (timezone) was involved. The format is YYYYMMDDHHmmssZ. It may also contain fraction or different timezone, everytime separated from the datetime by character. This patch gets the numberic part and then appends the string part again to get value usable in filter. Resolves: https://fedorahosted.org/sssd/ticket/2970 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Responders: Fix client destructorSimo Sorce2016-03-171-4/+7
| | | | | | | | | | | | | | | | To close a socket associated to an fd event we must set the close function of the event and not associate a destructor to a parent context. Otherwise the destructor will close() the socket before the fd event is freed, and this may cause invalid calls on a closed file descriptor to poll/epoll/etc. Discovered by looking at strace output. Resolves: https://fedorahosted.org/sssd/ticket/2973 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IPA SUDO: support old ipasudocmd rdnPavel Březina2016-03-141-22/+103
| | | | | | | | | FreeIPA versions older than 3.1 have rdn sudoCmd instead of ipaUniqueID. Resolves: https://fedorahosted.org/sssd/ticket/2969 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA SUDO: fix typoPavel Březina2016-03-141-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: remove old commentPavel Březina2016-03-141-5/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: rename cache_req_input to cache_reqPavel Březina2016-03-141-209/+203
| | | | | | The input part has no longer meaning. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: hide input and pass parameters in structPavel Březina2016-03-143-244/+308
| | | | | | This way it makes it a lot easier to add new parameters. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req test: add lookup by sidPavel Březina2016-03-141-5/+404
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: add SID lookupsPavel Březina2016-03-143-15/+111
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2848 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* utils: return const char ** from dup_string_listPavel Březina2016-03-142-4/+4
| | | | | | | This function is not used anywhere and const char ** suits better in my use case (next patch) so I just changed the function. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: improve user and group creationPavel Březina2016-03-141-142/+118
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: use leak check in test fixturesPavel Březina2016-03-141-17/+47
| | | | | | | | | To ensure no memory is leak on long living context such as rctx. Resolves: https://fedorahosted.org/sssd/ticket/2869 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* mock domain: reset ldb errorsPavel Březina2016-03-141-0/+4
| | | | | | | | | | | | | | | | | | After ldb connect ldb context contains the following error: "NULL Base DN invalid for a base search" This comes from internal ldb function ldb_set_default_dns() which runs base search on NULL dn to discover records similar to what rootDSE provides. However, tdb backend considers this an error and sets the message above. This may break memory leak checks in tests when we do push/pop on test_ctx which is a indirect parent of ldb_context. The error message is allocated when push is called but it is freed by other ldb queries and therefore not preset during the push phase and thus the leak check fails. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req tests: remove unused users and groupsPavel Březina2016-03-141-11/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: improve debuggingPavel Březina2016-03-144-50/+149
| | | | | | | | | Each debug message is matched to a specific request, this way it will be easier to follow the request flow especially when paralel request are running. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* cache_req: rename debug_fqn to debugobjPavel Březina2016-03-141-20/+22
| | | | | | It is not always a name. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: break cache_req_input_create into more functionsPavel Březina2016-03-141-23/+46
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: fix typo in debug messagePavel Březina2016-03-141-1/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: bring together search parametersPavel Březina2016-03-141-59/+59
| | | | | | | This way it is more clear that the string parameters should not be misued when adding a new one. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pam_sss: reorder pam_message arraySumit Bose2016-03-141-22/+14
| | | | | | | | | | | There are different expectations about how the pam_message array is organized, details can be found in the pam_conv man page. E.g. sudo was not able to handle the Linux-PAM style but expected the Solaris PAM style. With this patch both styles should work as expected. Resolves https://fedorahosted.org/sssd/ticket/2971 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Do not call stderr with negative numberLukas Slebodnik2016-03-141-3/+5
| | | | | | | | The function connect return -1 in case of error and we could call strerror with -1 instead of errno. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* libipa_hbac: Ensure we always build with C90Lukas Slebodnik2016-03-123-2/+9
| | | | | | | | | | | libipa_hbac is also used by external projects such as pam_hbac: https://github.com/jhrozek/pam_hbac In order to make sure we don't use C99 features in the libipa_hbac code in the future, this patch adds an explicit -std=c89 flag to CFLAGS. Signed-off-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* libipa_hbac: Move the library to src/lib/ipa_hbacJakub Hrozek2016-03-1210-10/+7
| | | | | | | | | | | Moving the library to the lib directory will force maintainers to think twice about changes, because it would be obvious this is a library. Also don't use includes from sssd source tree paths, but add the util path to Makefile's CFLAGS so that other projects can copy the hbac_evaluator.c file verbatim. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libipa_hbac: Fix typo in constant nameJakub Hrozek2016-03-121-1/+1
| | | | | | | On platforms without the format attribute, libhbac could not be compiled. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libipa_hbac: Add more debug messagesJakub Hrozek2016-03-121-3/+19
| | | | | | | Adding more debug messages proved to be useful during pam_hbac development. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libipa_hbac: Do not use C99Jakub Hrozek2016-03-121-4/+10
| | | | | | | | libipa_hbac can be used by external consumers like pam_hbac who run on old platforms that do not support C99. Refrain from using C99 features in that codebase. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CLIENT: Retry request after EPIPELukas Slebodnik2016-03-111-0/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We have a function sss_cli_check_socket which checks socket in client code. The socket is reopened in case of some issues e.g. responder terminated connections ... We use syscall poll for checking status of socket. It's not 100% reliable method because there is still chance that responder will terminate socket after this check. Here is a schema of sss_*_make_request functions: sss_cli_check_socket sss_cli_make_request_nochecks { sss_cli_send_req { poll send } sss_cli_recv_rep { poll read } } The syscall pool does not return EPIPE directly but we convert special revents from poll to EPIPE. As it was mentioned earlier, checking of socket in the sss_cli_check_socket is not 100% reliable. It can happen very rarely due to TOCTOU issue (Time of check to time of use) We can return EPIPE from the sss_cli_make_request_nochecks function in case of failure in poll in sss_cli_send_req. The send function in sss_cli_send_req can also return EPIPE is responder close socket in the same time. The send function can succeed in sss_cli_send_req but it does not mean that responder read the message. It can happen that timer for closing socket can be handled before reading a message. Therefore there is a still a chance that we might return EPIPE in case of failure in poll in sss_cli_recv_rep. Therefore we need to reconnect to responder(sss_cli_check_socket) in case of EPIPE returned from sss_cli_make_request_nochecks and try to do the same request one more time. Resolves: https://fedorahosted.org/sssd/ticket/2626 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* CLIENT: Reduce code duplicationLukas Slebodnik2016-03-111-31/+27
| | | | | | Patch for #2626 will be simpler with this small refactoring Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tests: Add a unit test for the external groups resolutionJakub Hrozek2016-03-112-4/+532
| | | | | | | | | Adds a test that tests a complex nested group hierarchy. Also defines the talloc chunk for group members to 1 to make sure the realloc branch is always tested. Unit test for: https://fedorahosted.org/sssd/ticket/2522 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Fix warning misleading-indentationLukas Slebodnik2016-03-103-11/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Warnings are emited from macro generated code in dlinklist.h e.g. src/ldb_modules/memberof.c:4209:13: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] DLIST_DEMOTE(ctx->group_list, grp, struct mbof_member *); ^~~~~~~~~~~~ src/ldb_modules/memberof.c:4209:13: note: ...this ‘if’ clause, but it is not src/ldb_modules/memberof.c: In function ‘mbof_member_update’: src/ldb_modules/memberof.c:4305:9: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] DLIST_PROMOTE(ctx->group_list, mem); ^~~~~~~~~~~~~ src/ldb_modules/memberof.c:4305:9: note: ...this ‘if’ clause, but it is not src/ldb_modules/memberof.c: In function ‘mbof_rcmp_update’: src/ldb_modules/memberof.c:4408:9: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] DLIST_REMOVE(ctx->user_list, x); ^~~~~~~~~~~~ src/util/crypto/nss/nss_obfuscate.c: In function ‘sss_password_decrypt’: src/util/crypto/nss/nss_obfuscate.c:419:5: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] SAFEALIGN_COPY_UINT16_CHECK(&meth, obfbuf+p, obflen, &p); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ src/python/pyhbac.c: In function ‘PyInit_pyhbac’: src/python/pyhbac.c:1987:5: error: statement is indented as if it were guarded by... [-Werror=misleading-indentation] TYPE_READY(m, pyhbac_hbacrule_type, "HbacRule"); ^~~~~~~~~~ src/python/pyhbac.c:1987:5: note: ...this ‘if’ clause, but it is not Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* UTIL: Fix indentation in dlinklist.hLukas Slebodnik2016-03-101-65/+65
| | | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* BUILD: Simplify build of cwrap testsLukas Slebodnik2016-03-101-48/+7
| | | | | | It will compilation of 40 files. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Util Sockets: Tidy up connect() handlingSimo Sorce2016-03-091-12/+6
| | | | | | | | | | | The connect() man page says waiting on a non-blocking connect should be done by checking for writability, so drop checking for readability. Also check for EALREADY as an acceptable error to retry on. Related: https://fedorahosted.org/sssd/ticket/2968 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Util: Set socket options and flags separatelySimo Sorce2016-03-091-37/+41
| | | | | | | | | | | Reorganize functions to set options and flags, all flags can be set at once, and there is no need to keep old falgs around as nothing ever used that for anything useful. Related: https://fedorahosted.org/sssd/ticket/2968 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Util: Move socket setup in a common utility fileSimo Sorce2016-03-093-244/+407
| | | | | | | | | | | | | Other components may need to connect sockets, the code here is generic enough that with minimal modifications can be used for non-ldap connections too. So create a sss_sockets.c/h utility file with all the non-ldap specific socket setup functions and make them available for other uses. Resolves: https://fedorahosted.org/sssd/ticket/2968 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA SUDO: download externalUser attributePavel Březina2016-03-095-0/+5
| | | | | | | | | | This allows configuration with id_provider = proxy and sudo_provider = ipa when someone needs to fetch rules for local users. https://fedorahosted.org/sssd/ticket/2972 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-30 13:02:42 +0000