summaryrefslogtreecommitdiff
path: root/src/responder
AgeCommit message (Collapse)AuthorFilesLines
2012-11-08sss_dp_get_domains_send(): handle subreq error correctlyPavel Březina1-1/+2
If force is true, ret may stay uninitialized and if ret == 0 after the subrequest is send, we will go to immediate label. Data provider request is sent, but the answer is never processed. This prohibited subdomain from working correctly.
2012-11-06sss_cache: Remove fastcache even if sssd is not running.Michal Zidek1-3/+23
https://fedorahosted.org/sssd/ticket/1584
2012-11-02PAM: Do not leak fd after SELinux context file is writtenJakub Hrozek1-0/+1
https://fedorahosted.org/sssd/ticket/1619 We don't close the fd when we write the selinux login file in the pam responder. This results in a fd leak.
2012-10-30sudo: do not hardcode protocol versionPavel Březina1-1/+2
2012-10-29Include talloc log in our debug facilityMichal Zidek6-6/+6
https://fedorahosted.org/sssd/ticket/1495
2012-10-29Free the internal DP requestJakub Hrozek1-0/+8
2012-10-26pac responder: add user principal and name alias to cached user objectSumit Bose3-4/+46
The principal name for the user is generated with the user name and the domain from the PAC. It is stored in the cache so that if e.g. can be used by password authentication. Additionally the name alias is stored to allow case-insensitive searches.
2012-10-26pac responder: use only lower case user nameSumit Bose2-5/+15
Since winbind can only return lower-cased user name the pac responder must do the same to avoid inconsistent behaviour.
2012-10-26pac responder: fix copy-and-paste errorSumit Bose1-7/+0
This error prevent proper id-mapping in the PAC responder.
2012-10-23Fix two errors in the nss responderSumit Bose1-1/+3
One is a copy-and-paste error which was introduce by 1774ee9a61b9d691dadd1a0538f32bcdcc84f72f. The second fixes a missing explicit setting of the return value. In the case where we want fully qualified names ret contains the number of characters from the last snprintf() which is almost ever not 0.
2012-10-18Allow setting the default_shell option per-domain as wellJakub Hrozek1-1/+3
https://fedorahosted.org/sssd/ticket/1583
2012-10-12Check for subdomains if getpwuid or getgrgid are the first requestsSumit Bose1-0/+72
Fixes https://fedorahosted.org/sssd/ticket/1561
2012-10-12Save time of last get_domains requestSumit Bose1-0/+16
2012-10-11Fix memory hierarchy in subdomains discoveryJakub Hrozek1-116/+160
https://fedorahosted.org/sssd/ticket/1571 The patch changes the subdomains discovery to use the tevent_req style. Previously, the code violated several rules which made the code very unreadable and led to memory hierarchy issues and use-after-free errors.
2012-10-11nss_cmd_retpwent(): do not go into infinite loop if n < 0Pavel Březina1-0/+8
https://fedorahosted.org/sssd/ticket/1551
2012-10-11do not call dp callbacks when responder is shutting downPavel Březina3-0/+25
https://fedorahosted.org/sssd/ticket/1514 We were experiencing crash duting responder shut down. This happened when there were some unresolved dp request during the shut down. The memory hierarchy is main_ctx->specific_ctx->rctx, where specific_ctx may be one of the pam, nss, sudo, etc. contexts. If we try to call dp request callback as a result of responder termination, the specific context is already semi freed, which may cause crash.
2012-10-09Fix typosYuri Chornoivan2-2/+2
2012-10-09Fix uninitialized pointer read in ssh_host_pubkeys_update_known_hostsJakub Hrozek1-1/+2
2012-10-05SSH: Expire hosts in known_hostsJan Cholasta3-1/+21
2012-10-05SSH: Refactor sysdb and related codeJan Cholasta2-73/+52
2012-10-02Fix few coding style issuesPavel Březina1-1/+1
2012-10-01Use flat name for master domain as wellSumit Bose2-1/+18
2012-10-01Add new option default_domain_suffixSumit Bose10-24/+65
2012-09-24SYSDB: Remove unnecessary domain parameter from several sysdb callsJakub Hrozek2-6/+2
The domain can be read from the sysdb object. Removing the domain string makes the API more self-contained.
2012-09-24sss_cache tool invalidates records in memory cache.Michal Zidek3-2/+126
2012-09-20SSH: Fix possible infinite loop when updating known_hostsJan Cholasta1-3/+1
2012-09-13SELinux: Always use the default if it exists on the serverJakub Hrozek1-22/+21
https://fedorahosted.org/sssd/ticket/1513 This is a counterpart of the FreeIPA ticket https://fedorahosted.org/freeipa/ticket/3045 During an e-mail discussion, it was decided that * if the default is set in the IPA config object, the SSSD would use that default no matter what * if the default is not set (aka empty or missing), the SSSD would just use the system default and skip creating the login file altogether
2012-09-13NSS: Fix off-by-one error in parse_getservbynameJakub Hrozek1-1/+1
https://fedorahosted.org/sssd/ticket/1438
2012-09-04SSH: Simplify public key formatting functionJan Cholasta1-4/+2
2012-09-04SSH: Return error code in SSH utility functionsJan Cholasta1-6/+7
2012-09-04Check if the SELinux login directory existsJakub Hrozek1-3/+3
https://fedorahosted.org/sssd/ticket/1492
2012-08-21accept_fd_handler: add missing returnSumit Bose1-0/+1
2012-08-16Only create the SELinux login file if there are mappings on the serverJakub Hrozek1-45/+77
https://fedorahosted.org/sssd/ticket/1455 In case there are no rules on the IPA server, we must simply avoid generating the login file. That would make us fall back to the system-wide default defined in /etc/selinux/targeted/seusers. The IPA default must be only used if there *are* rules on the server, but none matches.
2012-08-16Do not try to remove the temp login file if already renamedJakub Hrozek1-2/+3
write_selinux_string() would try to unlink the temporary file even after it was renamed. Failure to unlink the file would not be fatal, but would produce a confusing error message. Also don't use "0" for the default fd number, that's reserved for stdin. Using -1 is safer.
2012-08-16Build SELinux code in responder conditionallyJakub Hrozek1-0/+7
https://fedorahosted.org/sssd/ticket/1480
2012-08-15Fix LOCAL domain lookupsPavel Březina1-19/+22
https://fedorahosted.org/sssd/ticket/1436 Now subdomains are not evaluated for local domains.
2012-08-07Remove SYSDB_SUDO_CACHE_OC from attribute listsPavel Březina1-1/+0
It is not an attribute.
2012-08-07Rename SYSDB_SUDO_CACHE_AT_OC to SYSDB_SUDO_CACHE_OCPavel Březina1-1/+1
It does not contain name of the object class attribute but the value itself. I renamed it to avoid confusion.
2012-08-01Change subdomain_infoSimo Sorce1-1/+1
Rename the structure to use a standard name prefix so it is properly name-spaced, in preparation for changing the structure itself.
2012-08-01Fix bad checkJakub Hrozek1-1/+1
2012-07-27Write SELinux config files in responder instead of PAM moduleJan Zeleny1-5/+95
2012-07-27Move SELinux processing from session to account PAM stackJan Zeleny1-1/+2
The idea is to rename session provider to selinux provider. Processing of SELinux rules has to be performed in account stack in order to ensure that pam_selinux (which is the first module in PAM session stack) will get the correct input from SSSD. Processing of account PAM stack is bound to access provider. That means we need to have two providers executed when SSS_PAM_ACCT_MGMT message is received from PAM responder. Change in data_provider_be.c ensures just that - after access provider finishes its actions, the control is given to selinux provider and only after this provider finishes is the result returned to PAM responder.
2012-07-20NSS: Add override_shell optionStephen Gallagher3-2/+18
If override_shell is specified in the [nss] section, all users managed by SSSD will have their shell set to this value. If it is specified in the [domain/DOMAINNAME] section, it will apply to only that domain (and override the [nss] value, if any). https://fedorahosted.org/sssd/ticket/1087
2012-07-18PAM: Fix off-by-one-error in the SELinux session codeJakub Hrozek1-1/+1
2012-07-18Fix uninitialized valuesNick Guay3-5/+5
https://fedorahosted.org/sssd/ticket/1379
2012-07-12Add newline to DEBUG messagesJakub Hrozek1-2/+2
2012-07-10Fix segfault when using local providerStephen Gallagher1-6/+5
The name context was not being initialized for local provider domains because it was handled after skipping over the back-end initialization routine. This patch moves the name context init routine to occur earlier. https://fedorahosted.org/sssd/ticket/1412
2012-07-10pac responder: limit access by checking UIDsSumit Bose3-4/+161
A check for allowed UIDs is added in the common responder code directly after accept(). If the platform does not support reading the UID of the peer but allowed UIDs are configured, access is denied. Currently only the PAC responder sets the allowed UIDs for a socket. The default is that only root is allowed to access the socket of the PAC responder. Fixes: https://fedorahosted.org/sssd/ticket/1382
2012-07-09Fix potential NULL-dereferenceStephen Gallagher1-1/+2
Coverity #12800
2012-07-09Fix potential NULL-dereferenceStephen Gallagher1-1/+3
Coverity #12801
generated by cgit (git 2.34.1) at 2024-11-19 18:08:39 +0000