[SSSD] [sssd PR#5316][comment] SSSCTL: fix logs-remove when log directory is empty

2020-09-15 Thread sumit-bose
  URL: https://github.com/SSSD/sssd/pull/5316
Title: #5316: SSSCTL: fix logs-remove when log directory is empty

sumit-bose commented:
"""
Hi,

good catch and thank you for the patch. I'm fine with the change, @pbrezina, do 
you agree as well?

bye,
Sumit
"""

See the full comment at 
https://github.com/SSSD/sssd/pull/5316#issuecomment-693173613
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5306][comment] sss_cache: sss_cache exits immediately if SSSD is not running.

2020-09-15 Thread tomofumi-yoshida
  URL: https://github.com/SSSD/sssd/pull/5306
Title: #5306: sss_cache: sss_cache exits immediately if SSSD is not running.

tomofumi-yoshida commented:
"""
Thank you for your comment.
And I'm so sorry for my late response.


The issue we saw was as follows.

This issue was occurred in our customer's environment when the construction 
phase for his systems.
He runs useradd and groupadd command in a shell script to construct his systems.
sss_cache is called by useradd and groupadd command forcibly evenif he does't 
use sssd at all.
There are a large number of nodes in his environment.
If sss_cache command took a long time to complete,
the amount of time to complete shell script become longer and it postpones the 
schedule of construction phase.

Therefore, I advanced a patch not to run sss_cache at least sssd isn't running.

Please tell me if you have any other good solution.

Best Regards,
Tomofumi
"""

See the full comment at 
https://github.com/SSSD/sssd/pull/5306#issuecomment-693172252
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5315][comment] ldap: add ldap_sasl_realm to cfg_rules.ini

2020-09-15 Thread sumit-bose
  URL: https://github.com/SSSD/sssd/pull/5315
Title: #5315: ldap: add ldap_sasl_realm to cfg_rules.ini

sumit-bose commented:
"""
Hi,

thank you for the patch. ACK.

bye,
Sumit
"""

See the full comment at 
https://github.com/SSSD/sssd/pull/5315#issuecomment-693170537
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5315][+Accepted] ldap: add ldap_sasl_realm to cfg_rules.ini

2020-09-15 Thread sumit-bose
  URL: https://github.com/SSSD/sssd/pull/5315
Title: #5315: ldap: add ldap_sasl_realm to cfg_rules.ini

Label: +Accepted
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5316][opened] SSSCTL: fix logs-remove when log directory is empty

2020-09-15 Thread luizluca
   URL: https://github.com/SSSD/sssd/pull/5316
Author: luizluca
 Title: #5316: SSSCTL: fix logs-remove when log directory is empty
Action: opened

PR body:
"""
"sssctl logs-remove" calls "truncate --size 0 *.log" and "*.log"
will expand to literal '*.log' when directory is empty. The result
is a new empty '*.log' file.

Add '--no-create' to truncate call.

Signed-off-by: Luiz Angelo Daros de Luca 
"""

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5316/head:pr5316
git checkout pr5316
From f212af04293722f468226c619b4bbabadf81befb Mon Sep 17 00:00:00 2001
From: Luiz Angelo Daros de Luca 
Date: Tue, 15 Sep 2020 14:22:14 -0300
Subject: [PATCH] SSSCTL: fix logs-remove when log directory is empty

"sssctl logs-remove" calls "truncate --size 0 *.log" and "*.log"
will expand to literal '*.log' when directory is empty. The result
is a new empty '*.log' file.

Add '--no-create' to truncate call.

Signed-off-by: Luiz Angelo Daros de Luca 
---
 src/tools/sssctl/sssctl_logs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/tools/sssctl/sssctl_logs.c b/src/tools/sssctl/sssctl_logs.c
index 04a32bad85..9ff2be05b6 100644
--- a/src/tools/sssctl/sssctl_logs.c
+++ b/src/tools/sssctl/sssctl_logs.c
@@ -254,7 +254,7 @@ errno_t sssctl_logs_remove(struct sss_cmdline *cmdline,
 sss_signal(SIGHUP);
 } else {
 PRINT("Truncating log files...\n");
-ret = sssctl_run_command("truncate --size 0 " LOG_FILES);
+ret = sssctl_run_command("truncate --no-create --size 0 " LOG_FILES);
 if (ret != EOK) {
 ERROR("Unable to truncate log files\n");
 return ret;
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5315][opened] ldap: add ldap_sasl_realm to cfg_rules.ini

2020-09-15 Thread luizluca
   URL: https://github.com/SSSD/sssd/pull/5315
Author: luizluca
 Title: #5315: ldap: add ldap_sasl_realm to cfg_rules.ini
Action: opened

PR body:
"""
Fixes #5314

Signed-off-by: Luiz Angelo Daros de Luca 
"""

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5315/head:pr5315
git checkout pr5315
From 9b1602a4c6793384ad067f884aebeb1a50215ce7 Mon Sep 17 00:00:00 2001
From: Luiz Angelo Daros de Luca 
Date: Tue, 15 Sep 2020 13:36:24 -0300
Subject: [PATCH] ldap: add ldap_sasl_realm to cfg_rules.ini

Fixes #5314

Signed-off-by: Luiz Angelo Daros de Luca 
---
 src/config/cfg_rules.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini
index 34d31bceab..d1042d1828 100644
--- a/src/config/cfg_rules.ini
+++ b/src/config/cfg_rules.ini
@@ -712,6 +712,7 @@ option = ldap_sasl_canonicalize
 option = ldap_sasl_mech
 option = ldap_sasl_minssf
 option = ldap_sasl_maxssf
+option = ldap_sasl_realm
 option = ldap_schema
 option = ldap_pwmodify_mode
 option = ldap_search_base
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5299][+Accepted] dp: fix potential race condition in provider's sbus server

2020-09-15 Thread alexey-tikhonov
  URL: https://github.com/SSSD/sssd/pull/5299
Title: #5299: dp: fix potential race condition in provider's sbus server

Label: +Accepted
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5299][-Waiting for review] dp: fix potential race condition in provider's sbus server

2020-09-15 Thread alexey-tikhonov
  URL: https://github.com/SSSD/sssd/pull/5299
Title: #5299: dp: fix potential race condition in provider's sbus server

Label: -Waiting for review
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5299][comment] dp: fix potential race condition in provider's sbus server

2020-09-15 Thread alexey-tikhonov
  URL: https://github.com/SSSD/sssd/pull/5299
Title: #5299: dp: fix potential race condition in provider's sbus server

alexey-tikhonov commented:
"""
Thank you. ACK.
"""

See the full comment at 
https://github.com/SSSD/sssd/pull/5299#issuecomment-692835508
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5299][comment] dp: fix potential race condition in provider's sbus server

2020-09-15 Thread alexey-tikhonov
  URL: https://github.com/SSSD/sssd/pull/5299
Title: #5299: dp: fix potential race condition in provider's sbus server

alexey-tikhonov commented:
"""
> We can hit a segfault if provider start is somehow delayed.
> 
> * dp_init_send
>   
>   * sbus_server_create_and_connect_send
> 
> * sbus_server_create (*)
> 
> * dp_init_done (callback for sbus_server_create_and_connect_send)
>   
>   * sbus_server_create_and_connect_recv
>   * sbus_server_set_on_connection (sets clients data and creates dp_cli)
> 
> 
> At (*) sbus server is already created and accepts new connections once
> we get into tevent loop. So it is possible that the client connects to
> server before sbus_server_set_on_connection is called and thus the client
> is not properly initialized. However it should not happen in normal start
> because providers are started before responders and it can happen only if
> data provider startup is somehow delay.
> 
> You can use this diff to reproduce the crash:
> 
> ```diff
> --- a/src/providers/data_provider_be.c
> +++ b/src/providers/data_provider_be.c
> @@ -702,6 +702,8 @@ int main(int argc, const char *argv[])
>  uid_t uid;
>  gid_t gid;
> 
> +sleep(5);
> +
>  struct poptOption long_options[] = {
>  POPT_AUTOHELP
>  SSSD_MAIN_OPTS
> ```
> 

Does it really help to reproduce the crash?

At this point `sbus_server_create()` wasn't executed yet (nothing was executed 
yet actually)


Funny thing is, crash indeed happen in my testing... but only couple of times 
per tens of attempts.
"""

See the full comment at 
https://github.com/SSSD/sssd/pull/5299#issuecomment-692810749
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5299][comment] dp: fix potential race condition in provider's sbus server

2020-09-15 Thread alexey-tikhonov
  URL: https://github.com/SSSD/sssd/pull/5299
Title: #5299: dp: fix potential race condition in provider's sbus server

alexey-tikhonov commented:
"""
> We can hit a segfault if provider start is somehow delayed.
> 
> * dp_init_send
>   
>   * sbus_server_create_and_connect_send
> 
> * sbus_server_create (*)
> 
> * dp_init_done (callback for sbus_server_create_and_connect_send)
>   
>   * sbus_server_create_and_connect_recv
>   * sbus_server_set_on_connection (sets clients data and creates dp_cli)
> 
> 
> At (*) sbus server is already created and accepts new connections once
> we get into tevent loop. So it is possible that the client connects to
> server before sbus_server_set_on_connection is called and thus the client
> is not properly initialized. However it should not happen in normal start
> because providers are started before responders and it can happen only if
> data provider startup is somehow delay.
> 
> You can use this diff to reproduce the crash:
> 
> ```diff
> --- a/src/providers/data_provider_be.c
> +++ b/src/providers/data_provider_be.c
> @@ -702,6 +702,8 @@ int main(int argc, const char *argv[])
>  uid_t uid;
>  gid_t gid;
> 
> +sleep(5);
> +
>  struct poptOption long_options[] = {
>  POPT_AUTOHELP
>  SSSD_MAIN_OPTS
> ```
> 

Does it really help to reproduce the crash?

At this point `sbus_server_create()` wasn't executed yet (nothing was executed 
yet actually)


Funny thing is, crash indeed happen in my testing... but only couple of times 
per tens of attempts.
"""

See the full comment at 
https://github.com/SSSD/sssd/pull/5299#issuecomment-692810749
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5262][+Waiting for review] DN with white spaces

2020-09-15 Thread thalman
  URL: https://github.com/SSSD/sssd/pull/5262
Title: #5262: DN with white spaces

Label: +Waiting for review
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5262][-Changes requested] DN with white spaces

2020-09-15 Thread thalman
  URL: https://github.com/SSSD/sssd/pull/5262
Title: #5262: DN with white spaces

Label: -Changes requested
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5262][comment] DN with white spaces

2020-09-15 Thread thalman
  URL: https://github.com/SSSD/sssd/pull/5262
Title: #5262: DN with white spaces

thalman commented:
"""
Cherry-picked latest test version
"""

See the full comment at 
https://github.com/SSSD/sssd/pull/5262#issuecomment-692778107
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5262][synchronized] DN with white spaces

2020-09-15 Thread thalman
   URL: https://github.com/SSSD/sssd/pull/5262
Author: elkoniu
 Title: #5262: DN with white spaces
Action: synchronized

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5262/head:pr5262
git checkout pr5262
From 882307cdc1b596ba0cc346a0001f4fc014818d82 Mon Sep 17 00:00:00 2001
From: Tomas Halman 
Date: Fri, 31 Jul 2020 11:12:02 +0200
Subject: [PATCH 1/5] UTIL: DN sanitization

Some of the ldap servers returns DN in attributes such as isMemberOf
with spaces like dc=example, dc=com. That should be fine and we
should ignore them (cut them out) instead of escaping.

Resolves:
https://github.com/SSSD/sssd/issues/5261
---
 src/tests/cmocka/test_utils.c |  70 +++
 src/util/util.h   |  20 ++
 src/util/util_ext.c   | 126 ++
 3 files changed, 216 insertions(+)

diff --git a/src/tests/cmocka/test_utils.c b/src/tests/cmocka/test_utils.c
index c5eda4dd26..92ca783d9f 100644
--- a/src/tests/cmocka/test_utils.c
+++ b/src/tests/cmocka/test_utils.c
@@ -1955,6 +1955,73 @@ static void test_sss_get_domain_mappings_content(void **state)
  * capaths might not be as expected. */
 }
 
+
+static void test_sss_filter_sanitize_dn(void **state)
+{
+TALLOC_CTX *tmp_ctx;
+char *trimmed;
+int ret;
+const char *DN = "cn=user,ou=people,dc=example,dc=com";
+
+tmp_ctx = talloc_new(NULL);
+assert_non_null(tmp_ctx);
+
+/* test that we remove spaces around '=' and ','*/
+ret = sss_filter_sanitize_dn(tmp_ctx, DN, );
+assert_int_equal(ret, EOK);
+assert_string_equal(DN, trimmed);
+talloc_free(trimmed);
+
+ret = sss_filter_sanitize_dn(tmp_ctx, "cn=user,ou=people,dc=example,dc=com", );
+assert_int_equal(ret, EOK);
+assert_string_equal(DN, trimmed);
+talloc_free(trimmed);
+
+ret = sss_filter_sanitize_dn(tmp_ctx, "cn= user,ou =people,dc = example,dc  =  com", );
+assert_int_equal(ret, EOK);
+assert_string_equal(DN, trimmed);
+talloc_free(trimmed);
+
+ret = sss_filter_sanitize_dn(tmp_ctx, "cn=user, ou=people ,dc=example , dc=com", );
+assert_int_equal(ret, EOK);
+assert_string_equal(DN, trimmed);
+talloc_free(trimmed);
+
+ret = sss_filter_sanitize_dn(tmp_ctx, "cn=user,  ou=people  ,dc=example  ,   dc=com", );
+assert_int_equal(ret, EOK);
+assert_string_equal(DN, trimmed);
+talloc_free(trimmed);
+
+ret = sss_filter_sanitize_dn(tmp_ctx, "cn= user, ou =people ,dc = example  ,  dc  = com", );
+assert_int_equal(ret, EOK);
+assert_string_equal(DN, trimmed);
+talloc_free(trimmed);
+
+ret = sss_filter_sanitize_dn(tmp_ctx, " cn=user,ou=people,dc=example,dc=com ", );
+assert_int_equal(ret, EOK);
+assert_string_equal(DN, trimmed);
+talloc_free(trimmed);
+
+ret = sss_filter_sanitize_dn(tmp_ctx, "  cn=user, ou=people, dc=example, dc=com  ", );
+assert_int_equal(ret, EOK);
+assert_string_equal(DN, trimmed);
+talloc_free(trimmed);
+
+/* test that we keep spaces inside a value */
+ret = sss_filter_sanitize_dn(tmp_ctx, "cn = user one, ou=people  branch, dc=example, dc=com", );
+assert_int_equal(ret, EOK);
+assert_string_equal("cn=user\\20one,ou=people\\20\\20branch,dc=example,dc=com", trimmed);
+talloc_free(trimmed);
+
+/* test that we keep escape special chars like () */
+ret = sss_filter_sanitize_dn(tmp_ctx, "cn = user one, ou=p(e)ople, dc=example, dc=com", );
+assert_int_equal(ret, EOK);
+assert_string_equal("cn=user\\20one,ou=p\\28e\\29ople,dc=example,dc=com", trimmed);
+talloc_free(trimmed);
+
+talloc_free(tmp_ctx);
+}
+
 int main(int argc, const char *argv[])
 {
 poptContext pc;
@@ -2064,6 +2131,9 @@ int main(int argc, const char *argv[])
 cmocka_unit_test_setup_teardown(test_sss_ptr_hash_without_cb,
 setup_leak_tests,
 teardown_leak_tests),
+cmocka_unit_test_setup_teardown(test_sss_filter_sanitize_dn,
+setup_leak_tests,
+teardown_leak_tests),
 };
 
 /* Set debug level to invalid value so we can decide if -d 0 was used. */
diff --git a/src/util/util.h b/src/util/util.h
index d538e0674d..aa9bf97d4c 100644
--- a/src/util/util.h
+++ b/src/util/util.h
@@ -478,6 +478,26 @@ errno_t sss_filter_sanitize_for_dom(TALLOC_CTX *mem_ctx,
 char **sanitized,
 char **lc_sanitized);
 
+/* Sanitize an input string (e.g. a DN) for use in
+ * an LDAP/LDB filter
+ *
+ * It is basically the same as sss_filter_sanitize(_ex),
+ * just extra spaces inside DN around '=' and ',' are removed
+ * before sanitizing other characters . According the documentation
+ * spaces in DN are allowed and some ldap servers can return them
+ * in isMemberOf or member attributes.
+ *
+ * (dc = my example, dc = com => 

[SSSD] [sssd PR#5283][comment] Add dyndns_auth_ptr support

2020-09-15 Thread joakim-tjernlund
  URL: https://github.com/SSSD/sssd/pull/5283
Title: #5283: Add dyndns_auth_ptr support

joakim-tjernlund commented:
"""
@sumit-bose , mind setting this PR in Reviewed status?
"""

See the full comment at 
https://github.com/SSSD/sssd/pull/5283#issuecomment-692733807
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] SELinux attributes in Samba domain

2020-09-15 Thread Mikhail Novosyolov
Hello everyone!

I am thinking about storing SELinux attributes of domain users in Samba AD 
domain.

The problem is that Samba AD copies Windows domain, but there is no SELinux in 
Windows.

Currently FreeIPA can store this as a server in LDAP and sssd can get and apply 
SELinux attributes from FreeIPA's LDAP:

$ grep -inHr ipaSELinux
src/providers/ipa/ipa_config.h:34:#define IPA_CONFIG_SELINUX_DEFAULT_USER_CTX 
"ipaSELinuxUserMapDefault"
src/providers/ipa/ipa_config.h:35:#define IPA_CONFIG_SELINUX_MAP_ORDER 
"ipaSELinuxUserMapOrder"
src/providers/ipa/ipa_opts.c:271:    { "ipa_selinux_usermap_object_class", 
"ipaselinuxusermap", SYSDB_SELINUX_USERMAP_CLASS, NULL},
src/providers/ipa/ipa_opts.c:276:    { "ipa_selinux_usermap_selinux_user", 
"ipaSELinuxUser", SYSDB_SELINUX_USER, NULL},

In general it just gets a string and processes it, this email is about storing 
that string inside the domain per user.

My question is: how can SELinux attributes be stored inside Samba?
I understand that it will not a standartized name (but maybe we can come up to 
upstreamizing something into sssd...?), but I am ready to keep with something 
not upstream for now and to try to make SSSD to the same for selinux in Samba 
as it does in FreeIPA.

I think I should extend Samba's scheme with custom attributes like in the guide 
http://david-latham.blogspot.com/2012/12/extending-ad-schema-on-samba4.html
And then try to make sssd read those values.
Does it sound like a not very bad approach?

Thanks!
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5299][+Waiting for review] dp: fix potential race condition in provider's sbus server

2020-09-15 Thread alexey-tikhonov
  URL: https://github.com/SSSD/sssd/pull/5299
Title: #5299: dp: fix potential race condition in provider's sbus server

Label: +Waiting for review
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org


[SSSD] [sssd PR#5299][-Changes requested] dp: fix potential race condition in provider's sbus server

2020-09-15 Thread alexey-tikhonov
  URL: https://github.com/SSSD/sssd/pull/5299
Title: #5299: dp: fix potential race condition in provider's sbus server

Label: -Changes requested
___
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org