summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* pyhbac: Fix warning Wsign-compareLukas Slebodnik2016-01-291-7/+11
| | | | | | | | | | | | | | | | | | | | src/python/pyhbac.c: In function ‘HbacRuleElement_repr’: src/python/pyhbac.c:506:59: error: comparison between signed and unsigned integer expressions [-Werror=sign-compare] if (strnames == NULL || strgroups == NULL || category == -1) { ^ src/python/pyhbac.c: In function ‘HbacRuleElement_to_native’: src/python/pyhbac.c:614:51: error: comparison between signed and unsigned integer expressions [-Werror=sign-compare] if (!el->names || !el->groups || el->category == -1) { ^ The static function native_category had type of terurn value uint32_t But it also could return -1 which indicated an error. It's better to don't mix return code with returned value. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* pysss_murmur: Fix warning Wsign-compareLukas Slebodnik2016-01-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | src/python/pysss_murmur.c: In function ‘py_murmurhash3’: src/python/pysss_murmur.c:47:17: error: comparison between signed and unsigned integer expressions [-Werror=sign-compare] key_len > strlen(key)) { ^ uint32_t murmurhash3(const char *key, int len, uint32_t seed) The second argument of the function murmurhash3 has type int. But the code expects to be unsigned integer. There is code in python wrapper py_murmurhash3 which check boundaries of that argument. It should be an unsigned "key_len > INT_MAX || key_len < 0". An exception should be thrown for negative number. Moreover, the length should be shorter then a length of input string. The strlen returns size_t which is unsigned and key_len is signed long. We already checked that value is unsigned so we can safely cast key_len to size_t Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TOOLS: Fix warning Wsign-compareLukas Slebodnik2016-01-291-1/+1
| | | | | | | | | | src/tools/tools_util.c: In function ‘parse_groups’: src/tools/tools_util.c:116:19: error: comparison between signed and unsigned integer expressions [-Werror=sign-compare] for (i = 0; i < tokens; i++) { ^ Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IDMAP: Fix minor memory leakPavel Reichl2016-01-281-3/+11
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* cache_req: do not lookup views if possiblePavel Březina2016-01-281-6/+84
| | | | | | | | | | This is needed for LOCAL view but also creates a shortcut for server side overrides. Resolves: https://fedorahosted.org/sssd/ticket/2849 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: simplify cache_req_cache_check()Pavel Březina2016-01-281-31/+48
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* FAILOVER: Improve reporting of errorsLukas Slebodnik2016-01-281-7/+13
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam-srv-tests: Reuse test directory for IO testsLukas Slebodnik2016-01-281-1/+1
| | | | | | | | | | This patch is related to commit 50c9d542e8bf641412debaa82a4dcf67ddb72258 "tests: Use unique name for TEST_PATH" It's better to do IO operation in common test directory to prevent conflict with other test (copy & paste errors) Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* Util: Improve code to get connection credentialsSimo Sorce2016-01-285-34/+137
| | | | | | | | | | Adds support to get SELINUX context and make code more abstract so that struct ucred (if availale) can be used w/o redefining uid,gid,pid to int32. Also gives a layer of indirection that may come handy if we want to improve the code further in the future. Signed-off-by: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-by: Michal Židek <mzidek@redhat.com>
* NSS: do not skip cache check for netgoupsMichal Židek2016-01-211-24/+23
| | | | | | | | | | | | | | | | | When refresh_expired_interval was not zero, the NSS responder only refreshed netgroup cache using background periodic task and ignored SYSDB_CACHE_EXPIRE attribute. With this behaviour it was impossible to get new netgroup from remote server even after sss_cache tool was used to expire existing entry in the cache. Resolves: https://fedorahosted.org/sssd/ticket/2912 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IDMAP: Add support for automatic adding of rangesPavel Reichl2016-01-2016-62/+1006
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2188 Reviewed-by: Sumit Bose <sbose@redhat.com>
* IDMAP: New structure for domain range paramsPavel Reichl2016-01-201-57/+60
| | | | | | | | | | | Create new internal structure idmap_range_params by merging ID mapping range relevant fields from idmap_domain_info and remove corrsponding fields. Resolves: https://fedorahosted.org/sssd/ticket/2188 Reviewed-by: Sumit Bose <sbose@redhat.com>
* IDMAP: Fix computing max id for slice rangePavel Reichl2016-01-201-3/+3
| | | | | | | | | Max value of id mapping range was 1 unit too high. Resolves: https://fedorahosted.org/sssd/ticket/2922 Reviewed-by: Sumit Bose <sbose@redhat.com>
* p11: add gnome-screensaver to list of allowed servicesSumit Bose2016-01-201-1/+1
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/2925 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Make it possible to silence errors from dereferenceJakub Hrozek2016-01-193-10/+28
| | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2791 When a modern IPA client is connected to an old (3.x) IPA server, the attribute dereferenced during the ID views lookup does not exist, which triggers an error during the dereference processing and also a confusing syslog message. This patch suppresses the syslog message. Reviewed-by: Michal Židek <mzidek@redhat.com>
* sdap_connect_send: fail if uri or sockaddr is NULLPavel Březina2016-01-191-0/+6
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2904 Reviewed-by: Michal Židek <mzidek@redhat.com>
* AD: try to use current server in the renewal taskSumit Bose2016-01-191-3/+23
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* FO: add be_fo_get_active_server_name()Sumit Bose2016-01-192-0/+20
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* FO: add fo_get_active_server()Sumit Bose2016-01-193-0/+18
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD: add task to renew the machine account password if neededSumit Bose2016-01-199-0/+425
| | | | | | | | | | | | | | | | | | AD expects its clients to renew the machine account password on a regular basis, be default every 30 days. Even if a client does not renew the password it might not cause issues because AD does not enforce the renewal. But the password age might be used to identify unused machine accounts in large environments which might get disabled or deleted automatically. With this patch SSSD calls an external program to check the age of the machine account password and renew it if needed. Currently 'adcli' is used as external program which is able to renew the password since version 0.8.0. Resolves https://fedorahosted.org/sssd/ticket/1041 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* DP_TASK: add be_ptask_get_timeout()Sumit Bose2016-01-193-0/+28
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* UTIL: allow to skip default options for child processesSumit Bose2016-01-196-38/+47
| | | | | | | | | | | | | Currently the SSSD default options like e.g. --debug-level are added unconditionally to the command line options of a child process when started with the child helper functions. If a binary from a different source should be started as a child by SSSD those options might not be known or used differently. This patch adds an option to exec_child_ex() which allows to skip the default options and only add specific options. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA SUDO: Add support for ipaSudoRunAsExt* attributesPavel Březina2016-01-195-0/+23
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: simplify usn filterPavel Březina2016-01-192-11/+5
| | | | | | usn >= current && usn != currect is equivalent to usn >= current + 1 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: remember usn as number instead of stringPavel Březina2016-01-194-28/+31
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: allow disabling full refreshPavel Březina2016-01-191-1/+1
| | | | | | | | This condition always disabled smart refresh when full refresh interval was set to zero and thus disabling periodic refresh functionality completelely. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: assume zero if usn is unknownPavel Březina2016-01-194-30/+13
| | | | | | | | When we switched to be_ptaks full_refresh_done has become obsolete since timing is handled in a better way. In case of unknown USN we assume zero which allows us to disable full refresh completely in configuration. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: remove full_refresh_in_progressPavel Březina2016-01-194-10/+0
| | | | | | When we switched to be_ptask this variable has become obsolete. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: sdap_sudo_set_usn() do not steal usnPavel Březina2016-01-192-3/+10
| | | | | | This is less error prone. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Implement smart refreshPavel Březina2016-01-193-7/+438
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: Add sdap_or_filtersPavel Březina2016-01-192-7/+27
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Remember USNPavel Březina2016-01-191-2/+48
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Implement rules refreshPavel Březina2016-01-195-5/+186
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Implement full refreshPavel Březina2016-01-195-1/+2281
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Implement sudo handlerPavel Březina2016-01-192-0/+120
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/XXXX Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Add ipasudocmd mappingPavel Březina2016-01-195-0/+26
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Add ipasudocmdgrp mappingPavel Březina2016-01-195-0/+28
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: Add ipasudorule mappingPavel Březina2016-01-196-0/+92
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA SUDO: choose between IPA and LDAP schemaPavel Březina2016-01-192-58/+88
| | | | | | | | | | | This patch implement logic to choose between IPA and LDAP schema. From this point the sudo support in IPA is removed if sudo search base is not set specifically, it will be brought back in furter patches. Resolves: https://fedorahosted.org/sssd/ticket/1108 Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: use ipa_get_rdn() in nested groupsPavel Březina2016-01-191-71/+9
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: add ipa_get_rdn and ipa_check_rdnPavel Březina2016-01-193-0/+416
| | | | | | To exploit knowledge of IPA LDAP hierarchy. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: fail on failed request that cannot be retryPavel Březina2016-01-191-0/+3
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: allow to disable ptaskPavel Březina2016-01-191-16/+20
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: move code shared between ldap and ipa to separate modulePavel Březina2016-01-194-110/+197
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: make sudo sysdb interface more reusablePavel Březina2016-01-198-396/+354
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SUDO: use sdap_search_bases instead custom sb iteratorPavel Březina2016-01-191-104/+23
| | | | | | Removes code duplication. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: support empty filters in sdap_combine_filters()Pavel Březina2016-01-191-1/+4
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: rename sdap_get_id_specific_filterPavel Březina2016-01-1917-57/+35
| | | | | | | | More generic name is used now since it is not used only for id filters. Probably all references will be deleted when the code uses sdap_search_in_bases istead of custom search base iterators. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: Add request that iterates over all search basesPavel Březina2016-01-195-7/+286
| | | | | | | | We often need to iterate over many search bases but we always use mostly copy&paste iterator. This will reduce code duplication and simplify code flow. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: do not fail if refs are found but not processedPavel Březina2016-01-151-10/+1
| | | | | | | | | | It is possible to end up with not-processed referrals when using AD provider and ldap_referrals=true. Resolves: https://fedorahosted.org/sssd/ticket/2906 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
generated by cgit (git 2.34.1) at 2025-06-23 16:22:58 +0000