rpms/realmd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fixes for RHEL SAST Automation

Browse Source 
Resolves: RHEL-44992
This commit is contained in:
Sumit Bose 2025-02-13 16:27:47 +01:00
parent 81f025f9ea
commit 0c63ba5632
3 changed files with 478 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

242
0001-Various-fixes-for-issues-found-by-static-code-scanne.patch Normal file
View File

@ -0,0 +1,242 @@
From 1e6fe345218bc089c385711fbbb9941df6672b66 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Wed, 13 Nov 2024 16:28:21 +0100
Subject: [PATCH 1/2] Various fixes for issues found by static code scanners
---
service/realm-adcli-enroll.c | 10 +++++-----
service/realm-ini-config.c | 1 +
service/realm-kerberos.c | 11 +++++++----
service/realm-ldap.c | 9 +++++++--
service/realm-samba-winbind.c | 1 +
service/realm-samba.c | 5 ++---
tools/realm-client.c | 16 ++++++++++------
7 files changed, 33 insertions(+), 20 deletions(-)
diff --git a/service/realm-adcli-enroll.c b/service/realm-adcli-enroll.c
index c913987..c58175e 100644
--- a/service/realm-adcli-enroll.c
+++ b/service/realm-adcli-enroll.c
@@ -226,10 +226,10 @@ realm_adcli_enroll_join_async (RealmDisco *disco,
if (input)
g_bytes_unref (input);
- free (ccache_arg);
- free (upn_arg);
- free (server_arg);
- free (ou_arg);
+ g_free (ccache_arg);
+ g_free (upn_arg);
+ g_free (server_arg);
+ g_free (ou_arg);
}
gboolean
@@ -319,7 +319,7 @@ realm_adcli_enroll_delete_async (RealmDisco *disco,
if (input)
g_bytes_unref (input);
- free (ccache_arg);
+ g_free (ccache_arg);
g_free (server_arg);
}
diff --git a/service/realm-ini-config.c b/service/realm-ini-config.c
index 2e6813b..7bbea34 100644
--- a/service/realm-ini-config.c
+++ b/service/realm-ini-config.c
@@ -650,6 +650,7 @@ realm_ini_config_read_file (RealmIniConfig *self,
if (err != NULL) {
g_propagate_error (error, err);
+ g_free (contents);
return FALSE;
}
diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c
index 7994e1e..8810f87 100644
--- a/service/realm-kerberos.c
+++ b/service/realm-kerberos.c
@@ -300,7 +300,7 @@ join_or_leave (RealmKerberos *self,
{
RealmKerberosMembershipIface *iface = REALM_KERBEROS_MEMBERSHIP_GET_IFACE (self);
RealmKerberosMembership *membership = REALM_KERBEROS_MEMBERSHIP (self);
- RealmCredential *cred;
+ RealmCredential *cred = NULL;
MethodClosure *method;
GError *error = NULL;
@@ -317,6 +317,7 @@ join_or_leave (RealmKerberos *self,
cred = realm_credential_parse (credential, &error);
if (error != NULL) {
g_dbus_method_invocation_return_gerror (invocation, error);
+ realm_credential_unref (cred);
g_error_free (error);
return;
}
@@ -331,6 +332,8 @@ join_or_leave (RealmKerberos *self,
if (!realm_invocation_lock_daemon (invocation)) {
g_dbus_method_invocation_return_error (invocation, REALM_ERROR, REALM_ERROR_BUSY,
_("Already running another action"));
+ realm_credential_unref (cred);
+ g_error_free (error);
return;
}
@@ -1067,7 +1070,7 @@ flush_keytab_entries (krb5_context ctx,
count = 0;
}
- code = krb5_kt_free_entry (ctx, &entry);
+ code = krb5_free_keytab_entry_contents (ctx, &entry);
return_val_if_krb5_failed (ctx, code, FALSE);
}
@@ -1175,13 +1178,13 @@ realm_kerberos_get_netbios_name_from_keytab (const gchar *realm_name)
&& name_data->data[name_data->length - 1] == '$') {
netbios_name = g_strndup (name_data->data, name_data->length - 1);
if (netbios_name == NULL) {
- code = krb5_kt_free_entry (ctx, &entry);
+ code = krb5_free_keytab_entry_contents (ctx, &entry);
warn_if_krb5_failed (ctx, code);
break;
}
}
}
- code = krb5_kt_free_entry (ctx, &entry);
+ code = krb5_free_keytab_entry_contents (ctx, &entry);
warn_if_krb5_failed (ctx, code);
}
}
diff --git a/service/realm-ldap.c b/service/realm-ldap.c
index f7b6d13..c28e8d1 100644
--- a/service/realm-ldap.c
+++ b/service/realm-ldap.c
@@ -228,6 +228,7 @@ realm_ldap_connect_anonymous (GSocketAddress *address,
/* Not an expected failure */
if (ls->sock < 0) {
g_critical ("couldn't open socket to: %s: %s", addrname, strerror (errno));
+ g_free (addrname);
return NULL;
}
@@ -236,8 +237,10 @@ realm_ldap_connect_anonymous (GSocketAddress *address,
native_len = g_socket_address_get_native_size (address);
native = g_malloc (native_len);
- if (!g_socket_address_to_native (address, native, native_len, NULL))
+ if (!g_socket_address_to_native (address, native, native_len, NULL)) {
+ g_free (addrname);
g_return_val_if_reached (NULL);
+ }
if (connect (ls->sock, native, native_len) < 0 &&
errno != EINPROGRESS) {
@@ -280,6 +283,7 @@ realm_ldap_connect_anonymous (GSocketAddress *address,
g_free (url);
g_free (native);
+ g_free (addrname);
/* Not an expected failure */
if (rc != LDAP_SUCCESS) {
@@ -326,6 +330,7 @@ realm_ldap_connect_anonymous (GSocketAddress *address,
case G_SOCKET_PROTOCOL_UDP:
url = g_strdup_printf ("cldap://%s:%d", addrname, port);
+ g_free (addrname);
/*
* HACK: ldap_init_fd() does not work for UDP, otherwise we
@@ -367,11 +372,11 @@ realm_ldap_connect_anonymous (GSocketAddress *address,
break;
default:
+ g_free (addrname);
g_return_val_if_reached (NULL);
break;
}
- g_free (addrname);
version = LDAP_VERSION3;
if (ldap_set_option (ls->ldap, LDAP_OPT_PROTOCOL_VERSION, &version) != 0)
diff --git a/service/realm-samba-winbind.c b/service/realm-samba-winbind.c
index 61988eb..30f0433 100644
--- a/service/realm-samba-winbind.c
+++ b/service/realm-samba-winbind.c
@@ -154,6 +154,7 @@ realm_samba_winbind_configure_async (RealmIniConfig *config,
realm_ini_config_finish_change (config, &error);
g_free (idmap_config_backend);
g_free (idmap_config_range);
+ g_free (idmap_config_schema_mode);
}
/* Setup pam_winbind.conf with decent defaults matching our expectations */
diff --git a/service/realm-samba.c b/service/realm-samba.c
index 677c848..bc976f1 100644
--- a/service/realm-samba.c
+++ b/service/realm-samba.c
@@ -134,10 +134,9 @@ lookup_login_prefix (RealmSamba *self)
return NULL;
separator = realm_ini_config_get (self->config, REALM_SAMBA_CONFIG_GLOBAL, "winbind separator");
- if (separator == NULL)
- separator = g_strdup ("\\");
- return g_strdup_printf ("%s%s", workgroup, separator);
+ return g_strdup_printf ("%s%s", workgroup,
+ separator != NULL ? separator : "\\");
}
typedef struct {
diff --git a/tools/realm-client.c b/tools/realm-client.c
index 06420ea..a63652d 100644
--- a/tools/realm-client.c
+++ b/tools/realm-client.c
@@ -287,8 +287,8 @@ realm_client_new_installer (gboolean verbose,
socket = g_socket_new_from_fd (pair[0], &error);
if (error != NULL) {
realm_handle_error (error, _("Couldn't create socket"));
- close(pair[0]);
- close(pair[1]);
+ close (pair[0]);
+ close (pair[1]);
return NULL;
}
@@ -296,11 +296,12 @@ realm_client_new_installer (gboolean verbose,
G_SPAWN_LEAVE_DESCRIPTORS_OPEN | G_SPAWN_DO_NOT_REAP_CHILD,
NULL, NULL, &pid, &error);
- close(pair[1]);
+ close (pair[1]);
if (error != NULL) {
realm_handle_error (error, _("Couldn't run realmd"));
- close(pair[0]);
+ close (pair[0]);
+ g_object_unref (socket);
return NULL;
}
@@ -770,11 +771,14 @@ build_ccache_credential (const gchar *user_name,
if (ccache) {
ret = copy_or_kinit_to_ccache (krb5, ccache, user_name, realm_name, error);
krb5_cc_close (krb5, ccache);
- krb5_free_context (krb5);
}
+ krb5_free_context (krb5);
- if (!ret)
+ if (!ret) {
+ g_unlink (filename);
+ g_free (filename);
return NULL;
+ }
result = read_file_into_variant (filename);
--
2.48.1

226
0002-krb5-add-realm_krb5_get_error_message.patch Normal file
View File

@ -0,0 +1,226 @@
From f52ee4b8373f9fa8a96f9f6af656dfabc90b57ee Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Wed, 13 Nov 2024 17:41:54 +0100
Subject: [PATCH 2/2] krb5: add realm_krb5_get_error_message()
The krb5_get_error_message() call returns an error message in an
allocated string which must be freed. This makes it hard to simply use
krb5_get_error_message() in a printf() argument list.
realm_krb5_get_error_message() used a static memory area to make the
usage more easy.
---
service/Makefile.am | 1 +
service/realm-kerberos-helper.c | 33 +++++++++++++++++++++++++++++++++
service/realm-kerberos-helper.h | 28 ++++++++++++++++++++++++++++
service/realm-kerberos.c | 9 +++++----
tools/Makefile.am | 1 +
tools/realm-client.c | 15 ++++++++++-----
6 files changed, 78 insertions(+), 9 deletions(-)
create mode 100644 service/realm-kerberos-helper.c
create mode 100644 service/realm-kerberos-helper.h
diff --git a/service/Makefile.am b/service/Makefile.am
index 1fb4da9..977f4e4 100644
--- a/service/Makefile.am
+++ b/service/Makefile.am
@@ -56,6 +56,7 @@ realmd_SOURCES = \
service/realm-kerberos.h \
service/realm-kerberos-config.c \
service/realm-kerberos-config.h \
+ service/realm-kerberos-helper.c \
service/realm-kerberos-membership.c \
service/realm-kerberos-membership.h \
service/realm-kerberos-provider.c \
diff --git a/service/realm-kerberos-helper.c b/service/realm-kerberos-helper.c
new file mode 100644
index 0000000..a89fb6a
--- /dev/null
+++ b/service/realm-kerberos-helper.c
@@ -0,0 +1,33 @@
+/* realmd -- Realm Kerberos helper functions used by tools as well
+ *
+ * Copyright 2024 Red Hat Inc
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published
+ * by the Free Software Foundation; either version 2 of the licence or (at
+ * your option) any later version.
+ *
+ * See the included COPYING file for more information.
+ *
+ * Author: Sumit Bose <sbose@redhat.com>
+ */
+
+#include "config.h"
+
+#include "realm-kerberos-helper.h"
+
+const char *realm_krb5_get_error_message (krb5_context ctx,
+ krb5_error_code code)
+{
+ static char out[4096];
+ const char *tmp;
+ size_t len;
+
+ tmp = krb5_get_error_message (ctx, code);
+ len = strlen (tmp);
+ memcpy (out, tmp, MIN (sizeof (out), len));
+ out[sizeof(out) - 1] = '\0';
+ krb5_free_error_message (ctx, tmp);
+
+ return out;
+}
diff --git a/service/realm-kerberos-helper.h b/service/realm-kerberos-helper.h
new file mode 100644
index 0000000..4dc1bdb
--- /dev/null
+++ b/service/realm-kerberos-helper.h
@@ -0,0 +1,28 @@
+/* realmd -- Realm Kerberos helper functions used by tools as well
+ *
+ * Copyright 2024 Red Hat Inc
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published
+ * by the Free Software Foundation; either version 2 of the licence or (at
+ * your option) any later version.
+ *
+ * See the included COPYING file for more information.
+ *
+ * Author: Sumit Bose <sbose@redhat.com>
+ */
+
+#include "config.h"
+
+#ifndef __REALM_KERBEROS_HELPER_H__
+#define __REALM_KERBEROS_HELPER_H__
+
+#include <string.h>
+#include <sys/param.h>
+#include <krb5/krb5.h>
+
+
+const char *realm_krb5_get_error_message (krb5_context ctx,
+ krb5_error_code code);
+
+#endif /* __REALM_KERBEROS_HELPER_H__ */
diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c
index 8810f87..51a1b11 100644
--- a/service/realm-kerberos.c
+++ b/service/realm-kerberos.c
@@ -24,6 +24,7 @@
#include "realm-errors.h"
#include "realm-invocation.h"
#include "realm-kerberos.h"
+#include "realm-kerberos-helper.h"
#include "realm-kerberos-membership.h"
#include "realm-login-name.h"
#include "realm-options.h"
@@ -65,21 +66,21 @@ G_DEFINE_TYPE (RealmKerberos, realm_kerberos, G_TYPE_DBUS_OBJECT_SKELETON);
#define return_if_krb5_failed(ctx, code) G_STMT_START \
if G_LIKELY ((code) == 0) { } else { \
g_warn_message (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, \
- krb5_get_error_message ((ctx), (code))); \
+ realm_krb5_get_error_message ((ctx), (code))); \
return; \
} G_STMT_END
#define return_val_if_krb5_failed(ctx, code, val) G_STMT_START \
if G_LIKELY ((code) == 0) { } else { \
g_warn_message (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, \
- krb5_get_error_message ((ctx), (code))); \
+ realm_krb5_get_error_message ((ctx), (code))); \
return (val); \
} G_STMT_END
#define warn_if_krb5_failed(ctx, code) G_STMT_START \
if G_LIKELY ((code) == 0) { } else { \
g_warn_message (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, \
- krb5_get_error_message ((ctx), (code))); \
+ realm_krb5_get_error_message ((ctx), (code))); \
} G_STMT_END
typedef struct {
@@ -802,7 +803,7 @@ set_krb5_error (GError **error,
va_end (va);
g_set_error (error, REALM_KRB5_ERROR, code,
- "%s: %s", string, krb5_get_error_message (context, code));
+ "%s: %s", string, realm_krb5_get_error_message (context, code));
g_free (string);
}
diff --git a/tools/Makefile.am b/tools/Makefile.am
index b94782f..97b67e7 100644
--- a/tools/Makefile.am
+++ b/tools/Makefile.am
@@ -10,6 +10,7 @@ realm_SOURCES = \
tools/realm-join.c \
tools/realm-leave.c \
tools/realm-logins.c \
+ service/realm-kerberos-helper.c \
$(NULL)
realm_CFLAGS = \
diff --git a/tools/realm-client.c b/tools/realm-client.c
index a63652d..46848da 100644
--- a/tools/realm-client.c
+++ b/tools/realm-client.c
@@ -17,6 +17,7 @@
#include "realm.h"
#include "realm-client.h"
#include "realm-dbus-constants.h"
+#include "service/realm-kerberos-helper.h"
#include <glib/gi18n.h>
#include <glib/gstdio.h>
@@ -543,7 +544,7 @@ propagate_krb5_error (GError **dest,
if (code != 0) {
if (format)
g_string_append (message, ": ");
- g_string_append (message, krb5_get_error_message (context, code));
+ g_string_append (message, realm_krb5_get_error_message (context, code));
}
g_set_error_literal (dest, g_quark_from_static_string ("krb5"),
@@ -614,7 +615,8 @@ copy_to_ccache (krb5_context krb5,
code = krb5_cc_default (krb5, &def_ccache);
if (code != 0) {
- g_debug ("krb5_cc_default failed: %s", krb5_get_error_message (krb5, code));
+ g_debug ("krb5_cc_default failed: %s",
+ realm_krb5_get_error_message (krb5, code));
return FALSE;
}
@@ -637,13 +639,15 @@ copy_to_ccache (krb5_context krb5,
g_debug ("no matching principal found in %s", krb5_cc_default_name (krb5));
return FALSE;
} else if (code != 0) {
- g_debug ("krb5_cc_retrieve_cred failed: %s", krb5_get_error_message (krb5, code));
+ g_debug ("krb5_cc_retrieve_cred failed: %s",
+ realm_krb5_get_error_message (krb5, code));
return FALSE;
}
code = krb5_cc_initialize (krb5, ccache, creds.client);
if (code != 0) {
- g_debug ("krb5_cc_initialize failed: %s", krb5_get_error_message (krb5, code));
+ g_debug ("krb5_cc_initialize failed: %s",
+ realm_krb5_get_error_message (krb5, code));
return FALSE;
}
@@ -651,7 +655,8 @@ copy_to_ccache (krb5_context krb5,
krb5_free_cred_contents (krb5, &creds);
if (code != 0) {
- g_debug ("krb5_cc_store_cred failed: %s", krb5_get_error_message (krb5, code));
+ g_debug ("krb5_cc_store_cred failed: %s",
+ realm_krb5_get_error_message (krb5, code));
return FALSE;
}
--
2.48.1

11
realmd.spec
View File

@ -1,6 +1,6 @@
Name: realmd
Version: 0.17.1
Release: 11%{?dist}
Release: 12%{?dist}
Summary: Kerberos realm enrollment service
License: LGPL-2.1-or-later
URL: https://gitlab.freedesktop.org/realmd/realmd
@ -12,6 +12,11 @@ Patch0003: 0003-doc-fix-reference-in-realmd.conf-man-page.patch
Patch0004: 0001-sssd-package-fix.patch
Patch0005: 0001-tools-fix-ccache-handling-for-leave-operation.patch
# fixes for issues found by static analyser
Patch0006: 0001-Various-fixes-for-issues-found-by-static-code-scanne.patch
Patch0007: 0002-krb5-add-realm_krb5_get_error_message.patch
BuildRequires: make
BuildRequires: gcc
BuildRequires: automake
@ -97,6 +102,10 @@ make check
%doc ChangeLog
%changelog
* Thu Feb 13 2025 Sumit Bose <sbose@redhat.com> - 0.17.1-12
- Fixes for RHEL SAST Automation
Resolves: RHEL-44992
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 0.17.1-11
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018