summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* krb5: Remove unused helper functionsHEADmasterSimo Sorce2013-09-092-88/+0
| | | | | | | these functions are not needed anymore. Related: https://fedorahosted.org/sssd/ticket/2061
* krb5_child: Simplify ccache creationSimo Sorce2013-09-091-387/+87
| | | | | | | | | | | | The containing ccache directory is precreated by the parent code, so there is no special need to do so here for any type. Also the special handling for the FILE ccache temporary file is not really useful, because libkrb5 internally unlinks and then recreate the file, so mkstemp cannot really prevent subtle races, it can only make sure the file is unique at creation time. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Add file/dir path precheckSimo Sorce2013-09-092-0/+35
| | | | | | | | | | | | | | | | | | | | | | | Add a precheck on the actual existence at all of the file/dir ccname targeted (for FILE/DIR types), and bail early if nothing is available. While testing I found out that without this check, the krb5_cc_resolve() function we call as user to check old paths would try to create the directory if it didn't exist. With a ccname of DIR:/tmp/ccdir_1000 saved in the user entry this would cause two undesirable side effects: First it would actually create a directory with the old name, when it should not. Second, because for some reason the umask is set to 0127 in sssd_be, it would create the directory with permission 600 (missing the 'x' traverse bit on the directory. If the new ccache has the same name it would cause the krb5_child process to fal to store the credential cache in it. Related: https://fedorahosted.org/sssd/ticket/2061
* krb5: Remove unused functionSimo Sorce2013-09-092-32/+0
| | | | | Related: https://fedorahosted.org/sssd/ticket/2061
* krb5: Remove unused ccache backend infrastructureSimo Sorce2013-09-097-167/+14
| | | | | | | | Remove struct sss_krb5_cc_be and the remaining functions that reference it as they are all unused now. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Unify function to create ccache filesSimo Sorce2013-09-095-94/+43
| | | | | | | | | | | Only 2 types (FILE and DIR) need to precreate files or directories on the file system, and the 2 functions were basically identical. Consolidate all in one common function and use that function directly where needed instead of using indirection. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Use new function to validate ccachesSimo Sorce2013-09-093-371/+88
| | | | | | | | | | This function replaces and combines check_for_valid_tgt() and type specific functions that checked for ccache existence by using generic krb5 cache function and executing them as the target user (implicitly validate the target use rcan properly access the ccache). Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Make check_for_valid_tgt() staticSimo Sorce2013-09-093-76/+74
| | | | | | | check_for_valid_tgt() is used exclusively in krb5_uitls.c so move it there. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: move template check to initializzationSimo Sorce2013-09-094-24/+22
| | | | | | | | | | | | The randomized template check realy only makes sense for the FILE ccache which is the only one that normally needs to use randomizing chars. Also it is better to warn the admin early rather than to warn 'when it is too late'. So move the check at initialization time when we determine what the template actually is. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Move determination of user being activeSimo Sorce2013-09-093-43/+17
| | | | | | | | The way a user is checked for being active does not depend on the ccache type so move that check out of the ccache specific functions. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Replace type-specific ccache/principal checkSimo Sorce2013-09-093-148/+89
| | | | | | | | | Instead of having duplicate functions that are type custom use a signle common function that also performs access to the cache as the user owner, implicitly validating correctness of ownership. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Use krb5_cc_destroy to remove old ccachesSimo Sorce2013-09-095-119/+21
| | | | | | | | | This completely replaces the per-ccache-type custom code to remove old cacches and instead uses libkrb5 base doperations (krb5_cc_destroy) and operating as the user owner. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Add helper to destroy ccache as userSimo Sorce2013-09-092-0/+111
| | | | | | | | | | | This function safely destroy a ccache given a cache name and user crdentials. It becomes the user so no possible races can compromise the system, then uses libkrb5 functions to properly destroy a ccache, independently of the cache type. Finally restores the original credentials after closing the ccache handlers. Resolves: https://fedorahosted.org/sssd/ticket/2061
* krb5: Add calls to change and restore credentialsSimo Sorce2013-09-092-0/+131
| | | | | | | | In some cases we want to temporarily assume user credentials but allow the process to regain back the original credentials (normally regaining uid 0). Related: https://fedorahosted.org/sssd/ticket/2061
* tests: Add dlopen test to make sure modules worksSimo Sorce2013-09-094-1/+193
| | | | | This tests dlopens and resolves all symbols to make sure there are no missing symbols in our provider modules.
* AUTOTOOLS: More robust detection of inotify.Lukas Slebodnik2013-09-094-5/+39
| | | | | | | | | We checked only header file "sys/inotify" for detection whether inotify works. Some platforms do not have built in inotify, but contain library, which provides inotify-compatible interface. This patch adds more robust detection of inotify in configuration time and appends linker flags to Makefile if inotify is provided by library.
* AUTOTOOLS: Use pkg-config to detect libraries.Lukas Slebodnik2013-09-096-27/+70
| | | | | | | | We used pkg-config only as a fallback if header files was not found, but detection of library failed in case of available header file and linking problem (missing -Ldir). This patch prefers pkg-config.
* AUTOTOOLS: add check for type intptr_tLukas Slebodnik2013-09-091-3/+6
| | | | | We check whether HAVE_INTPTR_T is defined in definition of macro discard_const_p, but autootols macro AC_CHECK_TYPE did not generate it.
* AUTOTOOLS: Refactor unicode library detectionLukas Slebodnik2013-09-093-15/+45
| | | | | | | | | If $libdir is not in default library path libunistring cannot be found. (pkg-config can not be used in this case). This patch helps to search libunistring in "$libdir" directory. In refactoring part, indentation was updated to be more readable and some duplicated parts were removed.
* AUTOTOOLS: Add directories for searching ldap headers and libsLukas Slebodnik2013-09-091-2/+2
|
* AUTOMAKE: Use portable way to link with gettextLukas Slebodnik2013-09-091-1/+4
| | | | | | | | | | | | Function gettext needn't be included in libc, it can be part of another library. Autotools macro AM_GNU_GETTEXT generate makefile variables (LIBINTL, LTLIBINTL), which contain necessary linker flags. checking for GNU gettext in libc... no checking for iconv... yes checking for GNU gettext in libintl... yes checking whether to use NLS... yes checking where the gettext function comes from... external libintl
* AUTOMAKE: Use portable way to link with dlopenLukas Slebodnik2013-09-092-2/+3
|
* AUTOTOOLS: Add missing AC_MSG_RESULTLukas Slebodnik2013-09-094-5/+10
| | | | | AC_MSG_RESULT was not used everywhere after AC_MSG_CHECKING. Therefore two lines from configure output was mixed in some cases.
* AUTOTOOLS: Add -LLIBDIR to PYTHON_LIBSLukas Slebodnik2013-09-091-1/+2
| | | | | Detect directory with python libraries and add this directory to the list of directories to be searched for linker.
* mmap_cache: Do not remove record from chain twiceLukas Slebodnik2013-09-091-0/+6
| | | | | | | | | | | It is not very likely, that record will have the same hash1 and hash2, but it is possible. In this situation, it does not make sense to remove record twice. Function sss_mc_rm_rec_from_chain was not robust and sssd_nss could crash in this situation. It was only possible if record was alone in chain. Resolves: https://fedorahosted.org/sssd/ticket/2049
* krb5: Ingnore unknown expansion sequencesSimo Sorce2013-09-092-30/+45
| | | | | | | | | | | | | | | | Recently support was added to use also libkrb5 style expansions that uses a %{varname} type of template. There are a number of templates we do not care/can't expand in sssd. The current code misses tests and failed to properly preserve some of the templates we do not want to handle. Addiotionally in order to be future proof this patch treats unknown templates as pass-through templates and defer any error checking to libkrb5, so that sssd is consistent with how kinit would behave. Resolves: https://fedorahosted.org/sssd/ticket/2076
* Makefile: Fix sssd_be targetsSimo Sorce2013-09-091-2/+2
| | | | The $(PAM_LIBS) variable should be added to LDADD not LDFLAGS
* RPM: Add new subpackage for PAC responderStephen Gallagher2013-09-051-8/+31
| | | | | | | | | It was discovered that duplicating files in two subpackages is not permitted by Fedora packaging guidelines[1]. This patch moves the PAC responder to a new sssd-common-pac subpackage that both the sssd-ipa and sssd-ad subpackages will require. [1] https://fedoraproject.org/wiki/Packaging:Guidelines?rd=Packaging/Guidelines#DuplicateFiles
* dyndns: do not modify global family_orderSumit Bose2013-09-051-3/+3
| | | | | Resolves: https://fedorahosted.org/sssd/ticket/2063
* AD: Rename parametrized #defineJakub Hrozek2013-09-051-3/+3
|
* Fix reference to sssd-krb5 man pageNikolai Kondrashov2013-09-051-1/+1
| | | | | Replace incorrect reference to "sssd-krb5.conf" manpage with the correct "sssd-krb5" in sssd_krb5_locator_plugin man page source.
* ad srv: prefer servers that are in the same domain as clientPavel Březina2013-09-051-0/+89
| | | | https://fedorahosted.org/sssd/ticket/2001
* utils: add is_host_in_domain()Pavel Březina2013-09-053-0/+45
|
* fo srv: add priority to fo_server_infoPavel Březina2013-09-052-0/+2
| | | | | This will give SRV plugins all information needed for additional sorting.
* resolv_sort_srv_reply: remove unnecessary mem_ctxPavel Březina2013-09-054-11/+15
|
* Rename SAFEALIGN macrosMichal Zidek2013-09-051-30/+40
| | | | | The new SAFEALIGN macros name turned to be inappropriate because they do not reflect what the macros really do.
* krb5_utils tests: fix some typosPavel Březina2013-09-051-8/+8
|
* MAN: Document that sss_cache should be run after changing the cache timeoutJakub Hrozek2013-09-051-0/+13
|
* Fix warning missing argumentsLukas Slebodnik2013-09-051-1/+1
|
* KRB5: Fix warning declaration shadows global declarationLukas Slebodnik2013-09-031-8/+8
| | | | | | src/providers/krb5/krb5_utils.c:193: warning: declaration of 'rewind' shadows a global declaration /usr/include/stdio.h:754: warning: shadowed declaration is here
* UTIL: Use standard maximum value of type size_tLukas Slebodnik2013-09-032-9/+8
| | | | | | | It is better to use standard constant for maximum value of type size_t, instead of reinventing wheel with own defined constant SIZE_T_MAX This patch replace string "SIZE_T_MAX" -> "SIZE_MAX"
* Include sys/types.h for types id_t and uid_tLukas Slebodnik2013-09-032-0/+2
|
* PROXY: Handle empty GECOSJakub Hrozek2013-09-031-1/+8
| | | | | If the user's GECOS as returned by the proxied module is an empty string (as opposed to NULL), the ldb transaction would error out.
* AUTOMAKE: Add missing escaped newlineLukas Slebodnik2013-09-021-1/+1
|
* Fix czech specific character in my namePavel Březina2013-09-029-9/+9
|
* Updating the version for 1.11.1 releaseJakub Hrozek2013-08-281-1/+1
|
* Updating the version for the 1.11.0 releaseJakub Hrozek2013-08-281-1/+1
|
* Updating translations for the 1.11.0 releaseJakub Hrozek2013-08-2837-9076/+10213
|
* CONFIGURE: Get rid of bashismLukas Slebodnik2013-08-281-1/+1
|
* IPA_HBAC: Explicitelly include header file time.hLukas Slebodnik2013-08-281-0/+1
| | | | | | | | struct hbac_eval_req is defined in header file and it has attribute request_time with type time_t, but header file "time.h" was not included. It was not problem, because time.h was indirectly included by stdlib.h (stdlib.h -> sys/types.h -> time.h) in implementation files, but other platforms can have other dependencies among header files.
generated by cgit (git 2.34.1) at 2024-04-25 08:28:35 +0000