sssd - System Security Services Daemon

Age	Commit message (Collapse)	Author	Files	Lines
2013-02-10	Change the way domains are linked.	Simo Sorce	13	-414/+225
	- Use a double-linked list for domains and subdomains. - Never remove a subdomain, simply mark it as disabled if it becomes unused. - Rework the way subdomains are refreshed. Now sysdb_update_subdomains() actually updates the current subdomains and marks as disabled the ones not found in the sysdb or add new ones found. It never removes them. Removal of missing domains from sysdb is deferred to the providers, which will perform it at refresh time, for the ipa provider that is done by ipa_subdomains_write_mappings() now. sysdb_update_subdomains() is then used to update the memory hierarchy of the subdomains. - Removes sysdb_get_subdomains() - Removes copy_subdomain() - Add sysdb_subdomain_delete()
2013-02-10	Add ability to disable domains	Simo Sorce	2	-8/+14

2013-02-10	Add function get_next_domain()	Simo Sorce	18	-112/+119
	Use this function instead of explicitly calling domain->next This function allows to get the next primary domain or to descend into the subdomains and replaces also get_next_dom_or_subdom()
2013-02-10	Remove sysdb_subdom completely	Simo Sorce	4	-127/+131
	struct sss_domain_info is always used to represent domains now. Adjust tests accordingly.
2013-02-10	Add sysdb_subdomain_store() function	Simo Sorce	2	-37/+103
	Replaces sysdb_add_subdomain_attributes and is a public sysdb interface.
2013-02-10	Refactor sysdb_master_domain_add_info()	Simo Sorce	3	-51/+28

2013-02-10	Update main domain info in place	Simo Sorce	4	-62/+38

2013-02-10	Avoid sysdb_subdom in sysdb_get_subdomains()	Simo Sorce	6	-102/+60

2013-02-10	Add realm info to sss_domain_info	Simo Sorce	10	-10/+25

2013-02-10	NSS: Add original homedir to home directory template options	Stephen Gallagher	6	-8/+29
	https://fedorahosted.org/sssd/ticket/1805
2013-02-01	Correct sss_ssh_knowhostsproxy typo in man pages	John Hodrien	1	-1/+1

2013-02-01	dp: check whether hostid backend is configured before filing be request	Pavel Březina	1	-0/+8

2013-01-30	Fix minor grammar error in log	Stephen Gallagher	1	-1/+1

2013-01-30	krb: recreate ccache if it was deleted	Pavel Březina	1	-1/+8
	https://fedorahosted.org/sssd/ticket/1512 If directory where a ccache file was stored was missing and user was still logged in, we erroneously considered the ccache file still active. Thus the ccache file was not recreated and user was unable to login.
2013-01-29	TESTS: include error message on fail	Ondrej Kos	1	-8/+8

2013-01-29	TESTS: Fix coverity issues 13126, 13127	Ondrej Kos	1	-2/+6
	https://fedorahosted.org/sssd/ticket/1763
2013-01-29	Unchecked return value in files.c	Michal Zidek	1	-1/+9
	Found by coverity. https://fedorahosted.org/sssd/ticket/1791
2013-01-28	nested groups: fix group lookup hangs if member dn is incorrect	Pavel Březina	1	-0/+24
	https://fedorahosted.org/sssd/ticket/1783 When dn in member attribute is invalid (e.g. rdn instead of dn) or it is outside of configured search bases, we might hit a situation when tevent_req is marked as done before any callback could be attached on it.
2013-01-28	TOOLS: Compile on old platforms such as RHEL5	Jakub Hrozek	1	-37/+140
	Provides compatible declarations for modern file management functions such as futimens or opening with the O_CLOEXEC flag
2013-01-28	MAN: Clarify that saving users after enumerating large domain might be CPU ↵	Jakub Hrozek	1	-1/+9
	intensive https://fedorahosted.org/sssd/ticket/1732
2013-01-25	Possible null derefence in ipa_subdomains.c.	Michal Zidek	1	-0/+4
	Found by coverity. https://fedorahosted.org/sssd/ticket/1790
2013-01-23	SYSDB: Expire group if adding ghost users fails with EEXIST	Jakub Hrozek	1	-2/+36

2013-01-23	SYSDB: make the sss_ldb_modify_permissive function public	Jakub Hrozek	2	-2/+11

2013-01-23	TOOLS: Use file descriptor to avoid races when creating a home directory	Jakub Hrozek	4	-354/+364
	When creating a home directory, the destination tree can be modified in various ways while it is being constructed because directory permissions are set before populating the directory. This can lead to file creation and permission changes outside the target directory tree, using hard links. This security problem was assigned CVE-2013-0219 https://fedorahosted.org/sssd/ticket/1782
2013-01-23	TOOLS: Use openat/unlinkat when removing the homedir	Jakub Hrozek	1	-42/+41
	The removal of a home directory is sensitive to concurrent modification of the directory tree being removed and can unlink files outside the directory tree. This security issue was assigned CVE-2013-0219 https://fedorahosted.org/sssd/ticket/1782
2013-01-23	Check that strings do not go beyond the end of the packet body in autofs and ↵	Jan Cholasta	2	-7/+7
	SSH requests. This fixes CVE-2013-0220. https://fedorahosted.org/sssd/ticket/1781
2013-01-22	sudo responder: change num_rules type from size_t to uint32_t	Pavel Březina	7	-25/+25
	https://fedorahosted.org/sssd/ticket/1779 2^32 should be enough to store sudo rules. size_t type was causing troubles on big endian architectures, because it wasn't used correctly in combination with D-Bus.
2013-01-22	Convert the value of pwd_exp_warning to seconds	Jakub Hrozek	1	-5/+6
	When read from the domain section, the pwd_expiration_warning was properly converted to seconds from days, but not the pam_pwd_expiration_warning set in the [pam] section. https://fedorahosted.org/sssd/ticket/1773
2013-01-22	fix backend callbacks: remove callback properly from dlist	Pavel Březina	1	-6/+18
	https://fedorahosted.org/sssd/ticket/1776 Although cb->list got updated when the callback is removed, this change did not propagate to be_ctx->*_cb_list which caused dlist having invalid records.
2013-01-22	Fix code style	Jakub Hrozek	1	-1/+2

2013-01-21	Make struct be_req opaque	Simo Sorce	2	-18/+18

2013-01-21	Add be_req_get_data() helper funciton.	Simo Sorce	17	-32/+45
	In preparation for making struct be_req opaque.
2013-01-21	Add be_req_get_be_ctx() helper.	Simo Sorce	22	-133/+155
	In preparation for making be_req opaque
2013-01-21	Add be_req_create() helper	Simo Sorce	3	-40/+38

2013-01-21	Introduce be_req_terminate() helper	Simo Sorce	18	-129/+84
	Call it everywhere instead of directly dereferencing be_req->fn This is in preparation of making be_req opaque.
2013-01-21	Remove domain from be_req structure	Simo Sorce	7	-64/+46

2013-01-21	Pass domain not be_req to access check functions	Simo Sorce	5	-22/+33

2013-01-21	Split simple_access_check function out	Simo Sorce	3	-206/+225
	Need to split out the function or new additions to the handler funtion will not allow simple access tests to compile anymore.
2013-01-21	Do not pass NULL to ipa_subdomain_retrieve()	Simo Sorce	1	-18/+20

2013-01-21	Move hbac_ctx_is_offline()	Simo Sorce	2	-7/+6

2013-01-21	Remove hbac_ctx_sdap_id_[ctx\|op]()	Simo Sorce	2	-18/+6

2013-01-21	Remove hbac_ctx_ev()	Simo Sorce	2	-10/+3

2013-01-21	Remove hbac_ctx_be()	Simo Sorce	3	-12/+4

2013-01-21	Remove hbac_ctx_sysdb()	Simo Sorce	2	-12/+4

2013-01-21	Remove sysdb argument from hbac_get_cached_rules()	Simo Sorce	3	-9/+6

2013-01-21	Remove sysdb arg from [ipa_]hbac_sysdb_save()	Simo Sorce	3	-36/+25
	Also make ipa_hbac_save_list() static
2013-01-21	Remove sysdb arg from ipa_hbac_service_info_send()	Simo Sorce	3	-5/+0

2013-01-21	Remove sysdb arg from hbac_*host_attrs_to_rule()	Simo Sorce	3	-11/+4

2013-01-21	Remove sysdb arg from hbac_service_attrs_to_rule()	Simo Sorce	3	-5/+2

2013-01-21	Remove sysdb argument from hbac_user_attrs_to_rule()	Simo Sorce	3	-6/+4