summaryrefslogtreecommitdiff
path: root/src/responder
AgeCommit message (Collapse)AuthorFilesLines
2012-10-01Use flat name for master domain as wellSumit Bose2-1/+18
2012-10-01Add new option default_domain_suffixSumit Bose10-24/+65
2012-09-24SYSDB: Remove unnecessary domain parameter from several sysdb callsJakub Hrozek2-6/+2
The domain can be read from the sysdb object. Removing the domain string makes the API more self-contained.
2012-09-24sss_cache tool invalidates records in memory cache.Michal Zidek3-2/+126
2012-09-20SSH: Fix possible infinite loop when updating known_hostsJan Cholasta1-3/+1
2012-09-13SELinux: Always use the default if it exists on the serverJakub Hrozek1-22/+21
https://fedorahosted.org/sssd/ticket/1513 This is a counterpart of the FreeIPA ticket https://fedorahosted.org/freeipa/ticket/3045 During an e-mail discussion, it was decided that * if the default is set in the IPA config object, the SSSD would use that default no matter what * if the default is not set (aka empty or missing), the SSSD would just use the system default and skip creating the login file altogether
2012-09-13NSS: Fix off-by-one error in parse_getservbynameJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1438
2012-09-04SSH: Simplify public key formatting functionJan Cholasta1-4/+2
2012-09-04SSH: Return error code in SSH utility functionsJan Cholasta1-6/+7
2012-09-04Check if the SELinux login directory existsJakub Hrozek1-3/+3
https://fedorahosted.org/sssd/ticket/1492
2012-08-21accept_fd_handler: add missing returnSumit Bose1-0/+1
2012-08-16Only create the SELinux login file if there are mappings on the serverJakub Hrozek1-45/+77
https://fedorahosted.org/sssd/ticket/1455 In case there are no rules on the IPA server, we must simply avoid generating the login file. That would make us fall back to the system-wide default defined in /etc/selinux/targeted/seusers. The IPA default must be only used if there *are* rules on the server, but none matches.
2012-08-16Do not try to remove the temp login file if already renamedJakub Hrozek1-2/+3
write_selinux_string() would try to unlink the temporary file even after it was renamed. Failure to unlink the file would not be fatal, but would produce a confusing error message. Also don't use "0" for the default fd number, that's reserved for stdin. Using -1 is safer.
2012-08-16Build SELinux code in responder conditionallyJakub Hrozek1-0/+7
https://fedorahosted.org/sssd/ticket/1480
2012-08-15Fix LOCAL domain lookupsPavel Březina1-19/+22
https://fedorahosted.org/sssd/ticket/1436 Now subdomains are not evaluated for local domains.
2012-08-07Remove SYSDB_SUDO_CACHE_OC from attribute listsPavel Březina1-1/+0
It is not an attribute.
2012-08-07Rename SYSDB_SUDO_CACHE_AT_OC to SYSDB_SUDO_CACHE_OCPavel Březina1-1/+1
It does not contain name of the object class attribute but the value itself. I renamed it to avoid confusion.
2012-08-01Change subdomain_infoSimo Sorce1-1/+1
Rename the structure to use a standard name prefix so it is properly name-spaced, in preparation for changing the structure itself.
2012-08-01Fix bad checkJakub Hrozek1-1/+1
2012-07-27Write SELinux config files in responder instead of PAM moduleJan Zeleny1-5/+95
2012-07-27Move SELinux processing from session to account PAM stackJan Zeleny1-1/+2
The idea is to rename session provider to selinux provider. Processing of SELinux rules has to be performed in account stack in order to ensure that pam_selinux (which is the first module in PAM session stack) will get the correct input from SSSD. Processing of account PAM stack is bound to access provider. That means we need to have two providers executed when SSS_PAM_ACCT_MGMT message is received from PAM responder. Change in data_provider_be.c ensures just that - after access provider finishes its actions, the control is given to selinux provider and only after this provider finishes is the result returned to PAM responder.
2012-07-20NSS: Add override_shell optionStephen Gallagher3-2/+18
If override_shell is specified in the [nss] section, all users managed by SSSD will have their shell set to this value. If it is specified in the [domain/DOMAINNAME] section, it will apply to only that domain (and override the [nss] value, if any). https://fedorahosted.org/sssd/ticket/1087
2012-07-18PAM: Fix off-by-one-error in the SELinux session codeJakub Hrozek1-1/+1
2012-07-18Fix uninitialized valuesNick Guay3-5/+5
https://fedorahosted.org/sssd/ticket/1379
2012-07-12Add newline to DEBUG messagesJakub Hrozek1-2/+2
2012-07-10Fix segfault when using local providerStephen Gallagher1-6/+5
The name context was not being initialized for local provider domains because it was handled after skipping over the back-end initialization routine. This patch moves the name context init routine to occur earlier. https://fedorahosted.org/sssd/ticket/1412
2012-07-10pac responder: limit access by checking UIDsSumit Bose3-4/+161
A check for allowed UIDs is added in the common responder code directly after accept(). If the platform does not support reading the UID of the peer but allowed UIDs are configured, access is denied. Currently only the PAC responder sets the allowed UIDs for a socket. The default is that only root is allowed to access the socket of the PAC responder. Fixes: https://fedorahosted.org/sssd/ticket/1382
2012-07-09Fix potential NULL-dereferenceStephen Gallagher1-1/+2
Coverity #12800
2012-07-09Fix potential NULL-dereferenceStephen Gallagher1-1/+3
Coverity #12801
2012-07-06Set file descriptor limits in pac responderSumit Bose1-0/+15
2012-06-29sudo responder: schedule OOB full refresh when expired rule is deletedPavel Březina2-4/+40
2012-06-29sudo responder: refresh expired rulesPavel Březina1-31/+106
2012-06-29sudo responder: update dp interfacePavel Březina3-34/+72
2012-06-29sudo responder: allow fetching only expired rules in ↵Pavel Březina1-25/+22
sudosrv_get_sudorules_query_cache()
2012-06-29sudo sysdb: add expiration time to the filterPavel Březina1-1/+1
2012-06-29sudo responder: new request enum typePavel Březina3-13/+19
sss_sudo_type represents query type that comes to the responder sss_dp_sudo_type represents query type to DP that is issued by the responder I'm leaving current values of sss_dp_sudo_type untouched so the compilation is not broken. Hovewer, they will be changed to new DP types once the DP interface is updated.
2012-06-29sudo responder: discard in-memory cachePavel Březina3-375/+0
2012-06-29sudo responder: change protocol version to 1Pavel Březina1-0/+9
2012-06-29sudo api: send uid, username and domainnamePavel Březina4-109/+102
https://fedorahosted.org/sssd/ticket/1239 Test client was changed accordingly. The new usage is: sss_sudo_cli username [uid] If uid is not set, getpwnam(username) is called. It will retrieve both default options and rules.
2012-06-29sudo responder: get rid of dctx where possiblePavel Březina3-93/+102
2012-06-29sudo responder: remove code duplication in commandsPavel Březina4-277/+283
2012-06-25SELinux user maps: pick just one mapJan Zeleny1-12/+11
This patch modifies behavior of SSSD when putting together content of the file for pam_selinux. SSSD will now pick only the first user map in the priority list which matches to the user logging in. Other maps are ignored. https://fedorahosted.org/sssd/ticket/1360
2012-06-21Fix re_expression matching with subdomainsJan Zeleny3-70/+154
This patch fixes an issue which resulted in a need to initialize responder with data from local domain, otherwise it would not correctly detect requests for subdomains. Similar situation can occur if new subdomain is added at runtime. The solution is to ask for a list of subdomains in case there is a candidate domain identified in the process of matching re_expressions with given name.
2012-06-21Add range support to PAC responderSumit Bose3-45/+140
2012-06-21PAC responder: add the core functionalitySumit Bose2-2/+471
This adds support for parsing PAC and storing information contained within. In particular the user and all his memberships are stored. In case it is necessary, getgrgid() requests are sent to provider for group resolution.
2012-06-21PAC responder: add some utility functionsJan Zeleny2-0/+549
2012-06-21PAC responder: add basic infrastructureSumit Bose3-0/+340
This adds only the basic outline of the PAC responder, it won't support any operations, it will just start and initialize itself.
2012-06-20Move some debug lines to new debug log levelsStef Walter2-2/+2
* These are common lines of debug output when starting up sssd https://bugzilla.redhat.com/show_bug.cgi?id=811113
2012-06-18Make the client idle timeout configurableStephen Gallagher2-4/+19
2012-06-18Add support for terminating idle connectionsShantanu Goel2-2/+67
generated by cgit (git 2.34.1) at 2024-11-16 11:39:05 +0000