From 0c63ba5632764055c2b04107bdd88b07579c4d28 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Thu, 13 Feb 2025 16:27:47 +0100 Subject: [PATCH] Fixes for RHEL SAST Automation Resolves: RHEL-44992 --- ...r-issues-found-by-static-code-scanne.patch | 242 ++++++++++++++++++ ...rb5-add-realm_krb5_get_error_message.patch | 226 ++++++++++++++++ realmd.spec | 11 +- 3 files changed, 478 insertions(+), 1 deletion(-) create mode 100644 0001-Various-fixes-for-issues-found-by-static-code-scanne.patch create mode 100644 0002-krb5-add-realm_krb5_get_error_message.patch diff --git a/0001-Various-fixes-for-issues-found-by-static-code-scanne.patch b/0001-Various-fixes-for-issues-found-by-static-code-scanne.patch new file mode 100644 index 0000000..3244b9a --- /dev/null +++ b/0001-Various-fixes-for-issues-found-by-static-code-scanne.patch @@ -0,0 +1,242 @@ +From 1e6fe345218bc089c385711fbbb9941df6672b66 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Wed, 13 Nov 2024 16:28:21 +0100 +Subject: [PATCH 1/2] Various fixes for issues found by static code scanners + +--- + service/realm-adcli-enroll.c | 10 +++++----- + service/realm-ini-config.c | 1 + + service/realm-kerberos.c | 11 +++++++---- + service/realm-ldap.c | 9 +++++++-- + service/realm-samba-winbind.c | 1 + + service/realm-samba.c | 5 ++--- + tools/realm-client.c | 16 ++++++++++------ + 7 files changed, 33 insertions(+), 20 deletions(-) + +diff --git a/service/realm-adcli-enroll.c b/service/realm-adcli-enroll.c +index c913987..c58175e 100644 +--- a/service/realm-adcli-enroll.c ++++ b/service/realm-adcli-enroll.c +@@ -226,10 +226,10 @@ realm_adcli_enroll_join_async (RealmDisco *disco, + + if (input) + g_bytes_unref (input); +- free (ccache_arg); +- free (upn_arg); +- free (server_arg); +- free (ou_arg); ++ g_free (ccache_arg); ++ g_free (upn_arg); ++ g_free (server_arg); ++ g_free (ou_arg); + } + + gboolean +@@ -319,7 +319,7 @@ realm_adcli_enroll_delete_async (RealmDisco *disco, + if (input) + g_bytes_unref (input); + +- free (ccache_arg); ++ g_free (ccache_arg); + g_free (server_arg); + } + +diff --git a/service/realm-ini-config.c b/service/realm-ini-config.c +index 2e6813b..7bbea34 100644 +--- a/service/realm-ini-config.c ++++ b/service/realm-ini-config.c +@@ -650,6 +650,7 @@ realm_ini_config_read_file (RealmIniConfig *self, + + if (err != NULL) { + g_propagate_error (error, err); ++ g_free (contents); + return FALSE; + } + +diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c +index 7994e1e..8810f87 100644 +--- a/service/realm-kerberos.c ++++ b/service/realm-kerberos.c +@@ -300,7 +300,7 @@ join_or_leave (RealmKerberos *self, + { + RealmKerberosMembershipIface *iface = REALM_KERBEROS_MEMBERSHIP_GET_IFACE (self); + RealmKerberosMembership *membership = REALM_KERBEROS_MEMBERSHIP (self); +- RealmCredential *cred; ++ RealmCredential *cred = NULL; + MethodClosure *method; + GError *error = NULL; + +@@ -317,6 +317,7 @@ join_or_leave (RealmKerberos *self, + cred = realm_credential_parse (credential, &error); + if (error != NULL) { + g_dbus_method_invocation_return_gerror (invocation, error); ++ realm_credential_unref (cred); + g_error_free (error); + return; + } +@@ -331,6 +332,8 @@ join_or_leave (RealmKerberos *self, + if (!realm_invocation_lock_daemon (invocation)) { + g_dbus_method_invocation_return_error (invocation, REALM_ERROR, REALM_ERROR_BUSY, + _("Already running another action")); ++ realm_credential_unref (cred); ++ g_error_free (error); + return; + } + +@@ -1067,7 +1070,7 @@ flush_keytab_entries (krb5_context ctx, + count = 0; + } + +- code = krb5_kt_free_entry (ctx, &entry); ++ code = krb5_free_keytab_entry_contents (ctx, &entry); + return_val_if_krb5_failed (ctx, code, FALSE); + } + +@@ -1175,13 +1178,13 @@ realm_kerberos_get_netbios_name_from_keytab (const gchar *realm_name) + && name_data->data[name_data->length - 1] == '$') { + netbios_name = g_strndup (name_data->data, name_data->length - 1); + if (netbios_name == NULL) { +- code = krb5_kt_free_entry (ctx, &entry); ++ code = krb5_free_keytab_entry_contents (ctx, &entry); + warn_if_krb5_failed (ctx, code); + break; + } + } + } +- code = krb5_kt_free_entry (ctx, &entry); ++ code = krb5_free_keytab_entry_contents (ctx, &entry); + warn_if_krb5_failed (ctx, code); + } + } +diff --git a/service/realm-ldap.c b/service/realm-ldap.c +index f7b6d13..c28e8d1 100644 +--- a/service/realm-ldap.c ++++ b/service/realm-ldap.c +@@ -228,6 +228,7 @@ realm_ldap_connect_anonymous (GSocketAddress *address, + /* Not an expected failure */ + if (ls->sock < 0) { + g_critical ("couldn't open socket to: %s: %s", addrname, strerror (errno)); ++ g_free (addrname); + return NULL; + } + +@@ -236,8 +237,10 @@ realm_ldap_connect_anonymous (GSocketAddress *address, + + native_len = g_socket_address_get_native_size (address); + native = g_malloc (native_len); +- if (!g_socket_address_to_native (address, native, native_len, NULL)) ++ if (!g_socket_address_to_native (address, native, native_len, NULL)) { ++ g_free (addrname); + g_return_val_if_reached (NULL); ++ } + + if (connect (ls->sock, native, native_len) < 0 && + errno != EINPROGRESS) { +@@ -280,6 +283,7 @@ realm_ldap_connect_anonymous (GSocketAddress *address, + g_free (url); + + g_free (native); ++ g_free (addrname); + + /* Not an expected failure */ + if (rc != LDAP_SUCCESS) { +@@ -326,6 +330,7 @@ realm_ldap_connect_anonymous (GSocketAddress *address, + + case G_SOCKET_PROTOCOL_UDP: + url = g_strdup_printf ("cldap://%s:%d", addrname, port); ++ g_free (addrname); + + /* + * HACK: ldap_init_fd() does not work for UDP, otherwise we +@@ -367,11 +372,11 @@ realm_ldap_connect_anonymous (GSocketAddress *address, + break; + + default: ++ g_free (addrname); + g_return_val_if_reached (NULL); + break; + } + +- g_free (addrname); + + version = LDAP_VERSION3; + if (ldap_set_option (ls->ldap, LDAP_OPT_PROTOCOL_VERSION, &version) != 0) +diff --git a/service/realm-samba-winbind.c b/service/realm-samba-winbind.c +index 61988eb..30f0433 100644 +--- a/service/realm-samba-winbind.c ++++ b/service/realm-samba-winbind.c +@@ -154,6 +154,7 @@ realm_samba_winbind_configure_async (RealmIniConfig *config, + realm_ini_config_finish_change (config, &error); + g_free (idmap_config_backend); + g_free (idmap_config_range); ++ g_free (idmap_config_schema_mode); + } + + /* Setup pam_winbind.conf with decent defaults matching our expectations */ +diff --git a/service/realm-samba.c b/service/realm-samba.c +index 677c848..bc976f1 100644 +--- a/service/realm-samba.c ++++ b/service/realm-samba.c +@@ -134,10 +134,9 @@ lookup_login_prefix (RealmSamba *self) + return NULL; + + separator = realm_ini_config_get (self->config, REALM_SAMBA_CONFIG_GLOBAL, "winbind separator"); +- if (separator == NULL) +- separator = g_strdup ("\\"); + +- return g_strdup_printf ("%s%s", workgroup, separator); ++ return g_strdup_printf ("%s%s", workgroup, ++ separator != NULL ? separator : "\\"); + } + + typedef struct { +diff --git a/tools/realm-client.c b/tools/realm-client.c +index 06420ea..a63652d 100644 +--- a/tools/realm-client.c ++++ b/tools/realm-client.c +@@ -287,8 +287,8 @@ realm_client_new_installer (gboolean verbose, + socket = g_socket_new_from_fd (pair[0], &error); + if (error != NULL) { + realm_handle_error (error, _("Couldn't create socket")); +- close(pair[0]); +- close(pair[1]); ++ close (pair[0]); ++ close (pair[1]); + return NULL; + } + +@@ -296,11 +296,12 @@ realm_client_new_installer (gboolean verbose, + G_SPAWN_LEAVE_DESCRIPTORS_OPEN | G_SPAWN_DO_NOT_REAP_CHILD, + NULL, NULL, &pid, &error); + +- close(pair[1]); ++ close (pair[1]); + + if (error != NULL) { + realm_handle_error (error, _("Couldn't run realmd")); +- close(pair[0]); ++ close (pair[0]); ++ g_object_unref (socket); + return NULL; + } + +@@ -770,11 +771,14 @@ build_ccache_credential (const gchar *user_name, + if (ccache) { + ret = copy_or_kinit_to_ccache (krb5, ccache, user_name, realm_name, error); + krb5_cc_close (krb5, ccache); +- krb5_free_context (krb5); + } ++ krb5_free_context (krb5); + +- if (!ret) ++ if (!ret) { ++ g_unlink (filename); ++ g_free (filename); + return NULL; ++ } + + result = read_file_into_variant (filename); + +-- +2.48.1 + diff --git a/0002-krb5-add-realm_krb5_get_error_message.patch b/0002-krb5-add-realm_krb5_get_error_message.patch new file mode 100644 index 0000000..780ca79 --- /dev/null +++ b/0002-krb5-add-realm_krb5_get_error_message.patch @@ -0,0 +1,226 @@ +From f52ee4b8373f9fa8a96f9f6af656dfabc90b57ee Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Wed, 13 Nov 2024 17:41:54 +0100 +Subject: [PATCH 2/2] krb5: add realm_krb5_get_error_message() + +The krb5_get_error_message() call returns an error message in an +allocated string which must be freed. This makes it hard to simply use +krb5_get_error_message() in a printf() argument list. +realm_krb5_get_error_message() used a static memory area to make the +usage more easy. +--- + service/Makefile.am | 1 + + service/realm-kerberos-helper.c | 33 +++++++++++++++++++++++++++++++++ + service/realm-kerberos-helper.h | 28 ++++++++++++++++++++++++++++ + service/realm-kerberos.c | 9 +++++---- + tools/Makefile.am | 1 + + tools/realm-client.c | 15 ++++++++++----- + 6 files changed, 78 insertions(+), 9 deletions(-) + create mode 100644 service/realm-kerberos-helper.c + create mode 100644 service/realm-kerberos-helper.h + +diff --git a/service/Makefile.am b/service/Makefile.am +index 1fb4da9..977f4e4 100644 +--- a/service/Makefile.am ++++ b/service/Makefile.am +@@ -56,6 +56,7 @@ realmd_SOURCES = \ + service/realm-kerberos.h \ + service/realm-kerberos-config.c \ + service/realm-kerberos-config.h \ ++ service/realm-kerberos-helper.c \ + service/realm-kerberos-membership.c \ + service/realm-kerberos-membership.h \ + service/realm-kerberos-provider.c \ +diff --git a/service/realm-kerberos-helper.c b/service/realm-kerberos-helper.c +new file mode 100644 +index 0000000..a89fb6a +--- /dev/null ++++ b/service/realm-kerberos-helper.c +@@ -0,0 +1,33 @@ ++/* realmd -- Realm Kerberos helper functions used by tools as well ++ * ++ * Copyright 2024 Red Hat Inc ++ * ++ * This program is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU Lesser General Public License as published ++ * by the Free Software Foundation; either version 2 of the licence or (at ++ * your option) any later version. ++ * ++ * See the included COPYING file for more information. ++ * ++ * Author: Sumit Bose ++ */ ++ ++#include "config.h" ++ ++#include "realm-kerberos-helper.h" ++ ++const char *realm_krb5_get_error_message (krb5_context ctx, ++ krb5_error_code code) ++{ ++ static char out[4096]; ++ const char *tmp; ++ size_t len; ++ ++ tmp = krb5_get_error_message (ctx, code); ++ len = strlen (tmp); ++ memcpy (out, tmp, MIN (sizeof (out), len)); ++ out[sizeof(out) - 1] = '\0'; ++ krb5_free_error_message (ctx, tmp); ++ ++ return out; ++} +diff --git a/service/realm-kerberos-helper.h b/service/realm-kerberos-helper.h +new file mode 100644 +index 0000000..4dc1bdb +--- /dev/null ++++ b/service/realm-kerberos-helper.h +@@ -0,0 +1,28 @@ ++/* realmd -- Realm Kerberos helper functions used by tools as well ++ * ++ * Copyright 2024 Red Hat Inc ++ * ++ * This program is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU Lesser General Public License as published ++ * by the Free Software Foundation; either version 2 of the licence or (at ++ * your option) any later version. ++ * ++ * See the included COPYING file for more information. ++ * ++ * Author: Sumit Bose ++ */ ++ ++#include "config.h" ++ ++#ifndef __REALM_KERBEROS_HELPER_H__ ++#define __REALM_KERBEROS_HELPER_H__ ++ ++#include ++#include ++#include ++ ++ ++const char *realm_krb5_get_error_message (krb5_context ctx, ++ krb5_error_code code); ++ ++#endif /* __REALM_KERBEROS_HELPER_H__ */ +diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c +index 8810f87..51a1b11 100644 +--- a/service/realm-kerberos.c ++++ b/service/realm-kerberos.c +@@ -24,6 +24,7 @@ + #include "realm-errors.h" + #include "realm-invocation.h" + #include "realm-kerberos.h" ++#include "realm-kerberos-helper.h" + #include "realm-kerberos-membership.h" + #include "realm-login-name.h" + #include "realm-options.h" +@@ -65,21 +66,21 @@ G_DEFINE_TYPE (RealmKerberos, realm_kerberos, G_TYPE_DBUS_OBJECT_SKELETON); + #define return_if_krb5_failed(ctx, code) G_STMT_START \ + if G_LIKELY ((code) == 0) { } else { \ + g_warn_message (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, \ +- krb5_get_error_message ((ctx), (code))); \ ++ realm_krb5_get_error_message ((ctx), (code))); \ + return; \ + } G_STMT_END + + #define return_val_if_krb5_failed(ctx, code, val) G_STMT_START \ + if G_LIKELY ((code) == 0) { } else { \ + g_warn_message (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, \ +- krb5_get_error_message ((ctx), (code))); \ ++ realm_krb5_get_error_message ((ctx), (code))); \ + return (val); \ + } G_STMT_END + + #define warn_if_krb5_failed(ctx, code) G_STMT_START \ + if G_LIKELY ((code) == 0) { } else { \ + g_warn_message (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, \ +- krb5_get_error_message ((ctx), (code))); \ ++ realm_krb5_get_error_message ((ctx), (code))); \ + } G_STMT_END + + typedef struct { +@@ -802,7 +803,7 @@ set_krb5_error (GError **error, + va_end (va); + + g_set_error (error, REALM_KRB5_ERROR, code, +- "%s: %s", string, krb5_get_error_message (context, code)); ++ "%s: %s", string, realm_krb5_get_error_message (context, code)); + g_free (string); + } + +diff --git a/tools/Makefile.am b/tools/Makefile.am +index b94782f..97b67e7 100644 +--- a/tools/Makefile.am ++++ b/tools/Makefile.am +@@ -10,6 +10,7 @@ realm_SOURCES = \ + tools/realm-join.c \ + tools/realm-leave.c \ + tools/realm-logins.c \ ++ service/realm-kerberos-helper.c \ + $(NULL) + + realm_CFLAGS = \ +diff --git a/tools/realm-client.c b/tools/realm-client.c +index a63652d..46848da 100644 +--- a/tools/realm-client.c ++++ b/tools/realm-client.c +@@ -17,6 +17,7 @@ + #include "realm.h" + #include "realm-client.h" + #include "realm-dbus-constants.h" ++#include "service/realm-kerberos-helper.h" + + #include + #include +@@ -543,7 +544,7 @@ propagate_krb5_error (GError **dest, + if (code != 0) { + if (format) + g_string_append (message, ": "); +- g_string_append (message, krb5_get_error_message (context, code)); ++ g_string_append (message, realm_krb5_get_error_message (context, code)); + } + + g_set_error_literal (dest, g_quark_from_static_string ("krb5"), +@@ -614,7 +615,8 @@ copy_to_ccache (krb5_context krb5, + + code = krb5_cc_default (krb5, &def_ccache); + if (code != 0) { +- g_debug ("krb5_cc_default failed: %s", krb5_get_error_message (krb5, code)); ++ g_debug ("krb5_cc_default failed: %s", ++ realm_krb5_get_error_message (krb5, code)); + return FALSE; + } + +@@ -637,13 +639,15 @@ copy_to_ccache (krb5_context krb5, + g_debug ("no matching principal found in %s", krb5_cc_default_name (krb5)); + return FALSE; + } else if (code != 0) { +- g_debug ("krb5_cc_retrieve_cred failed: %s", krb5_get_error_message (krb5, code)); ++ g_debug ("krb5_cc_retrieve_cred failed: %s", ++ realm_krb5_get_error_message (krb5, code)); + return FALSE; + } + + code = krb5_cc_initialize (krb5, ccache, creds.client); + if (code != 0) { +- g_debug ("krb5_cc_initialize failed: %s", krb5_get_error_message (krb5, code)); ++ g_debug ("krb5_cc_initialize failed: %s", ++ realm_krb5_get_error_message (krb5, code)); + return FALSE; + } + +@@ -651,7 +655,8 @@ copy_to_ccache (krb5_context krb5, + krb5_free_cred_contents (krb5, &creds); + + if (code != 0) { +- g_debug ("krb5_cc_store_cred failed: %s", krb5_get_error_message (krb5, code)); ++ g_debug ("krb5_cc_store_cred failed: %s", ++ realm_krb5_get_error_message (krb5, code)); + return FALSE; + } + +-- +2.48.1 + diff --git a/realmd.spec b/realmd.spec index 2abbd5c..28ba2fc 100644 --- a/realmd.spec +++ b/realmd.spec @@ -1,6 +1,6 @@ Name: realmd Version: 0.17.1 -Release: 11%{?dist} +Release: 12%{?dist} Summary: Kerberos realm enrollment service License: LGPL-2.1-or-later URL: https://gitlab.freedesktop.org/realmd/realmd @@ -12,6 +12,11 @@ Patch0003: 0003-doc-fix-reference-in-realmd.conf-man-page.patch Patch0004: 0001-sssd-package-fix.patch Patch0005: 0001-tools-fix-ccache-handling-for-leave-operation.patch +# fixes for issues found by static analyser +Patch0006: 0001-Various-fixes-for-issues-found-by-static-code-scanne.patch +Patch0007: 0002-krb5-add-realm_krb5_get_error_message.patch + + BuildRequires: make BuildRequires: gcc BuildRequires: automake @@ -97,6 +102,10 @@ make check %doc ChangeLog %changelog +* Thu Feb 13 2025 Sumit Bose - 0.17.1-12 +- Fixes for RHEL SAST Automation + Resolves: RHEL-44992 + * Tue Oct 29 2024 Troy Dawson - 0.17.1-11 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018