rpms/realmd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

RHEL 9.0.0 Alpha bootstrap

Browse Source 
The content of this branch was automatically imported from Fedora ELN
with the following as its source:
https://src.fedoraproject.org/rpms/realmd#f49ad6f2c2c5649949d7501c0a0654cc02533cf8
This commit is contained in:
Troy Dawson 2020-10-14 21:29:42 -07:00
parent b6e3de1938
commit 2d296e7a59
40 changed files with 5533 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
.gitignore vendored
View File

@ -0,0 +1,8 @@
/realmd-?.*/
/.build-*.log
/*.rpm
/x86_64
/realmd-0.16.0.tar.gz
/realmd-0.16.1.tar.gz
/realmd-0.16.2.tar.gz
/realmd-0.16.3.tar.gz

27
0001-Add-missing-xsl-file-to-Makefile.am.patch Normal file
View File

@ -0,0 +1,27 @@
From 81b5e3478269ea47d66ddb98f7cbebd06fe950e6 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 2 Aug 2019 13:18:37 +0200
Subject: [PATCH 1/7] Add missing xsl file to Makefile.am
In commit 4f3c02dc14300c0b8e51a55d627c57f73c108f64 it was forgotten to
add the new file devhelp2.xsl to the Makefile to make sure it is
include in the tar ball.
---
doc/manual/Makefile.am | 1 +
1 file changed, 1 insertion(+)
diff --git a/doc/manual/Makefile.am b/doc/manual/Makefile.am
index 39e1581..8b33fdd 100644
--- a/doc/manual/Makefile.am
+++ b/doc/manual/Makefile.am
@@ -37,6 +37,7 @@ MANUAL_XSLT = \
doc/manual/gdbus-fix-bugs.xsl \
doc/manual/gtk-doc.xsl \
doc/manual/version-greater-or-equal.xsl \
+ doc/manual/devhelp2.xsl \
$(NULL)
EXTRA_DIST += \
--
2.25.1

168
0001-Find-NetBIOS-name-in-keytab-while-leaving.patch Normal file
View File

@ -0,0 +1,168 @@
From b11d891a50c2f70e3c02b880e0199583b8df186c Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Thu, 31 May 2018 16:16:08 +0200
Subject: [PATCH] Find NetBIOS name in keytab while leaving
If realmd is used with Samba as membership software, i.e. Samba's net
utility, the NetBIOS name must be known when leaving a domain. The most
reliable way to find it is by searching the keytab for NAME$@REALM type
entries and use the NAME as the NetBIOS name.
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1370457
---
service/realm-kerberos.c | 64 ++++++++++++++++++++++++++++++++++++
service/realm-kerberos.h | 2 ++
service/realm-samba-enroll.c | 17 ++++++++--
3 files changed, 80 insertions(+), 3 deletions(-)
diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c
index 54d1ed7..d6d109f 100644
--- a/service/realm-kerberos.c
+++ b/service/realm-kerberos.c
@@ -1130,3 +1130,67 @@ realm_kerberos_flush_keytab (const gchar *realm_name,
return ret;
}
+
+gchar *
+realm_kerberos_get_netbios_name_from_keytab (const gchar *realm_name)
+{
+ krb5_error_code code;
+ krb5_keytab keytab = NULL;
+ krb5_context ctx;
+ krb5_kt_cursor cursor = NULL;
+ krb5_keytab_entry entry;
+ krb5_principal realm_princ = NULL;
+ gchar *princ_name = NULL;
+ gchar *netbios_name = NULL;
+ krb5_data *name_data;
+
+ code = krb5_init_context (&ctx);
+ if (code != 0) {
+ return NULL;
+ }
+
+ princ_name = g_strdup_printf ("user@%s", realm_name);
+ code = krb5_parse_name (ctx, princ_name, &realm_princ);
+ g_free (princ_name);
+
+ if (code == 0) {
+ code = krb5_kt_default (ctx, &keytab);
+ }
+
+ if (code == 0) {
+ code = krb5_kt_start_seq_get (ctx, keytab, &cursor);
+ }
+
+ if (code == 0) {
+ while (!krb5_kt_next_entry (ctx, keytab, &entry, &cursor) && netbios_name == NULL) {
+ if (krb5_realm_compare (ctx, realm_princ, entry.principal)) {
+ name_data = krb5_princ_component (ctx, entry.principal, 0);
+ if (name_data != NULL
+ && name_data->length > 0
+ && name_data->data[name_data->length - 1] == '$') {
+ netbios_name = g_strndup (name_data->data, name_data->length - 1);
+ if (netbios_name == NULL) {
+ code = krb5_kt_free_entry (ctx, &entry);
+ warn_if_krb5_failed (ctx, code);
+ break;
+ }
+ }
+ }
+ code = krb5_kt_free_entry (ctx, &entry);
+ warn_if_krb5_failed (ctx, code);
+ }
+ }
+
+ code = krb5_kt_end_seq_get (ctx, keytab, &cursor);
+ warn_if_krb5_failed (ctx, code);
+
+ code = krb5_kt_close (ctx, keytab);
+ warn_if_krb5_failed (ctx, code);
+
+ krb5_free_principal (ctx, realm_princ);
+
+ krb5_free_context (ctx);
+
+ return netbios_name;
+
+}
diff --git a/service/realm-kerberos.h b/service/realm-kerberos.h
index 0447e4d..58cfe07 100644
--- a/service/realm-kerberos.h
+++ b/service/realm-kerberos.h
@@ -88,6 +88,8 @@ gchar * realm_kerberos_format_login (RealmKerberos *self,
gboolean realm_kerberos_flush_keytab (const gchar *realm_name,
GError **error);
+gchar * realm_kerberos_get_netbios_name_from_keytab (const gchar *realm_name);
+
const gchar * realm_kerberos_get_name (RealmKerberos *self);
const gchar * realm_kerberos_get_realm_name (RealmKerberos *self);
diff --git a/service/realm-samba-enroll.c b/service/realm-samba-enroll.c
index 76e7b79..f5edca3 100644
--- a/service/realm-samba-enroll.c
+++ b/service/realm-samba-enroll.c
@@ -85,7 +85,8 @@ static JoinClosure *
join_closure_init (GTask *task,
RealmDisco *disco,
GVariant *options,
- GDBusMethodInvocation *invocation)
+ GDBusMethodInvocation *invocation,
+ gboolean do_join)
{
JoinClosure *join;
gchar *workgroup;
@@ -93,6 +94,7 @@ join_closure_init (GTask *task,
int temp_fd;
const gchar *explicit_computer_name = NULL;
const gchar *authid = NULL;
+ gchar *name_from_keytab = NULL;
join = g_new0 (JoinClosure, 1);
join->disco = realm_disco_ref (disco);
@@ -106,6 +108,14 @@ join_closure_init (GTask *task,
else if (disco->explicit_netbios)
authid = disco->explicit_netbios;
+ /* try to get the NetBIOS name from the keytab while leaving the domain */
+ if (explicit_computer_name == NULL && !do_join) {
+ name_from_keytab = realm_kerberos_get_netbios_name_from_keytab(disco->kerberos_realm);
+ if (name_from_keytab != NULL) {
+ authid = name_from_keytab;
+ }
+ }
+
join->config = realm_ini_config_new (REALM_INI_NO_WATCH | REALM_INI_PRIVATE);
realm_ini_config_set (join->config, REALM_SAMBA_CONFIG_GLOBAL,
"security", "ads",
@@ -151,6 +161,7 @@ join_closure_init (GTask *task,
g_warning ("Couldn't create temp file in: %s", g_get_tmp_dir ());
}
+ g_free (name_from_keytab);
return join;
}
@@ -393,7 +404,7 @@ realm_samba_enroll_join_async (RealmDisco *disco,
g_return_if_fail (cred != NULL);
task = g_task_new (NULL, NULL, callback, user_data);
- join = join_closure_init (task, disco, options, invocation);
+ join = join_closure_init (task, disco, options, invocation, TRUE);
explicit_computer_name = realm_options_computer_name (options, disco->domain_name);
if (explicit_computer_name != NULL) {
realm_diagnostics_info (invocation, "Joining using a manual netbios name: %s",
@@ -462,7 +473,7 @@ realm_samba_enroll_leave_async (RealmDisco *disco,
JoinClosure *join;
task = g_task_new (NULL, NULL, callback, user_data);
- join = join_closure_init (task, disco, options, invocation);
+ join = join_closure_init (task, disco, options, invocation, FALSE);
switch (cred->type) {
case REALM_CREDENTIAL_PASSWORD:
--
2.17.1

32
0001-Fix-for-ini-config-test-issue.patch Normal file
View File

@ -0,0 +1,32 @@
From f2162c30155eb0d9f7475f583856a2675ad2c881 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 3 Jul 2020 17:18:13 +0200
Subject: [PATCH 1/4] Fix for ini-config test issue
Recently I came across some issues with the ini-config tests where the
test run into a deadlock and didn't finish. It looks it happens
somewhere in the glib inotify code and might be a timing issues because
I never saw the issue when running the tests with strace.
To get around the issue I added REALM_INI_NO_WATCH to not use the
inotify code for testing.
---
tests/test-ini-config.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tests/test-ini-config.c b/tests/test-ini-config.c
index 7799e13..854df88 100644
--- a/tests/test-ini-config.c
+++ b/tests/test-ini-config.c
@@ -29,7 +29,7 @@ static void
setup (Test *test,
gconstpointer unused)
{
- test->config = realm_ini_config_new (REALM_INI_LINE_CONTINUATIONS);
+ test->config = realm_ini_config_new (REALM_INI_NO_WATCH | REALM_INI_LINE_CONTINUATIONS);
}
static void
--
2.26.2

37
0001-Fix-invalid-unrefs-on-realm_invocation_get_cancellab.patch Normal file
View File

@ -0,0 +1,37 @@
From 8b8b7bf8eb651c56d6e85101d9ff277155981cb3 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Wed, 18 May 2016 14:42:46 +0200
Subject: [PATCH] Fix invalid unrefs on realm_invocation_get_cancellable()
retval
https://bugzilla.redhat.com/show_bug.cgi?id=1330766
Signed-off-by: Stef Walter <stefw@redhat.com>
---
service/realm-packages.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/service/realm-packages.c b/service/realm-packages.c
index 321921a..9a6984c 100644
--- a/service/realm-packages.c
+++ b/service/realm-packages.c
@@ -479,8 +479,6 @@ on_install_resolved (GObject *source,
packages_install_async (install->connection,
(const gchar **)package_ids, cancellable,
on_install_installed, g_object_ref (task));
- if (cancellable)
- g_object_unref (cancellable);
}
g_free (missing);
@@ -649,7 +647,6 @@ realm_packages_install_async (const gchar **package_sets,
cancellable = realm_invocation_get_cancellable (install->invocation);
packages_resolve_async (connection, (const gchar **)install->packages, cancellable,
on_install_resolved, g_object_ref (task));
- g_object_unref (cancellable);
}
g_object_unref (task);
--
2.5.5

42
0001-Fix-issues-found-by-Coverity.patch Normal file
View File

@ -0,0 +1,42 @@
From 1831748847715a13f0cc911a9a491eb8614d6682 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Tue, 14 Aug 2018 14:09:48 +0200
Subject: [PATCH 1/3] Fix issues found by Coverity
---
service/realm-kerberos.c | 5 ++++-
service/realm-packages.c | 2 +-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c
index d6d109f..252e256 100644
--- a/service/realm-kerberos.c
+++ b/service/realm-kerberos.c
@@ -980,7 +980,10 @@ realm_kerberos_set_details (RealmKerberos *self,
if (name == NULL)
break;
value = va_arg (va, const gchar *);
- g_return_if_fail (value != NULL);
+ if (value == NULL) {
+ va_end (va);
+ g_return_if_reached ();
+ }
values[0] = g_variant_new_string (name);
values[1] = g_variant_new_string (value);
diff --git a/service/realm-packages.c b/service/realm-packages.c
index 9a6984c..5976439 100644
--- a/service/realm-packages.c
+++ b/service/realm-packages.c
@@ -567,7 +567,7 @@ lookup_required_files_and_packages (const gchar **package_sets,
g_ptr_array_add (packages, NULL);
*result_packages = (gchar **)g_ptr_array_free (packages, FALSE);
} else {
- g_ptr_array_free (files, TRUE);
+ g_ptr_array_free (packages, TRUE);
}
if (result_files) {
--
2.17.1

24
0001-Fix-man-page-reference-in-systemd-service-file.patch Normal file
View File

@ -0,0 +1,24 @@
From e8d9d5e9817627dcf208ac742debcc9dc320752d Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Wed, 27 Jul 2016 19:06:29 +0200
Subject: [PATCH] Fix man page reference in systemd service file
---
dbus/realmd.service.in | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/dbus/realmd.service.in b/dbus/realmd.service.in
index b3bcf7a..64c1090 100644
--- a/dbus/realmd.service.in
+++ b/dbus/realmd.service.in
@@ -1,6 +1,6 @@
[Unit]
Description=Realm and Domain Configuration
-Documentation=man:realmd(8)
+Documentation=man:realm(8)
[Service]
Type=dbus
--
2.7.4

62
0001-IPA-do-not-call-sssd-enable-logins.patch Normal file
View File

@ -0,0 +1,62 @@
From 373f2e03736dfd87d50f02208b99d462cf34d891 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Thu, 27 Sep 2018 13:04:47 +0200
Subject: [PATCH] IPA: do not call sssd-enable-logins
It is expected that ipa-client-install will do all PAM and NSS
configuration. To avoid changing IPA default realmd will not try to
update the related configuration.
---
service/realm-sssd-ipa.c | 24 +-----------------------
1 file changed, 1 insertion(+), 23 deletions(-)
diff --git a/service/realm-sssd-ipa.c b/service/realm-sssd-ipa.c
index 5029f6b..70f8b0e 100644
--- a/service/realm-sssd-ipa.c
+++ b/service/realm-sssd-ipa.c
@@ -109,41 +109,19 @@ enroll_closure_free (gpointer data)
g_free (enroll);
}
-static void
-on_enable_nss_done (GObject *source,
- GAsyncResult *result,
- gpointer user_data)
-{
- GTask *task = G_TASK (user_data);
- GError *error = NULL;
- gint status;
-
- status = realm_command_run_finish (result, NULL, &error);
- if (error == NULL && status != 0)
- g_set_error (&error, REALM_ERROR, REALM_ERROR_INTERNAL,
- _("Enabling SSSD in nsswitch.conf and PAM failed."));
- if (error != NULL)
- g_task_return_error (task, error);
- else
- g_task_return_boolean (task, TRUE);
- g_object_unref (task);
-}
-
static void
on_restart_done (GObject *source,
GAsyncResult *result,
gpointer user_data)
{
GTask *task = G_TASK (user_data);
- EnrollClosure *enroll = g_task_get_task_data (task);
RealmSssd *sssd = g_task_get_source_object (task);
GError *error = NULL;
realm_service_enable_and_restart_finish (result, &error);
if (error == NULL) {
realm_sssd_update_properties (sssd);
- realm_command_run_known_async ("sssd-enable-logins", NULL, enroll->invocation,
- on_enable_nss_done, g_object_ref (task));
+ g_task_return_boolean (task, TRUE);
} else {
g_task_return_error (task, error);
}
--
2.17.1

112
0001-Kerberos-fall-back-to-tcp-SRV-lookup.patch Normal file
View File

@ -0,0 +1,112 @@
From 6f0aa79c3e8dd93e723f29bf46e1b8b14403254f Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Mon, 5 Dec 2016 18:25:44 +0100
Subject: [PATCH] Kerberos: fall back to tcp SRV lookup
---
service/realm-kerberos-provider.c | 48 +++++++++++++++++++++++++++++++--------
1 file changed, 39 insertions(+), 9 deletions(-)
diff --git a/service/realm-kerberos-provider.c b/service/realm-kerberos-provider.c
index 2b3a0f8..1477ae8 100644
--- a/service/realm-kerberos-provider.c
+++ b/service/realm-kerberos-provider.c
@@ -19,6 +19,7 @@
#include "realm-kerberos-provider.h"
#include <errno.h>
+#include <string.h>
struct _RealmKerberosProvider {
RealmProvider parent;
@@ -38,28 +39,54 @@ realm_kerberos_provider_init (RealmKerberosProvider *self)
}
+typedef struct {
+ gchar *name;
+ const char *prot;
+} NameProtPair;
+
+static void
+name_prot_pair_free (gpointer data)
+{
+ NameProtPair *name_prot_pair = data;
+ g_free (name_prot_pair->name);
+ g_free (name_prot_pair);
+}
+
static void
on_kerberos_discover (GObject *source,
GAsyncResult *result,
gpointer user_data)
{
GTask *task = G_TASK (user_data);
- const gchar *domain = g_task_get_task_data (task);
+ NameProtPair *name_prot_pair = g_task_get_task_data (task);
GError *error = NULL;
RealmDisco *disco;
GList *targets;
+ GResolver *resolver;
targets = g_resolver_lookup_service_finish (G_RESOLVER (source), result, &error);
if (targets) {
g_list_free_full (targets, (GDestroyNotify)g_srv_target_free);
- disco = realm_disco_new (domain);
- disco->kerberos_realm = g_ascii_strup (domain, -1);
+ disco = realm_disco_new (name_prot_pair->name);
+ disco->kerberos_realm = g_ascii_strup (name_prot_pair->name, -1);
g_task_return_pointer (task, disco, realm_disco_unref);
} else if (error) {
- g_debug ("Resolving %s failed: %s", domain, error->message);
+ g_debug ("Resolving %s failed: %s", name_prot_pair->name, error->message);
g_error_free (error);
- g_task_return_pointer (task, NULL, NULL);
+
+ if (strcmp (name_prot_pair->prot, "tcp") == 0) {
+ g_task_return_pointer (task, NULL, NULL);
+ } else {
+ /* Try tcp */
+ name_prot_pair->prot = "tcp";
+ resolver = g_resolver_get_default ();
+ g_resolver_lookup_service_async (resolver, "kerberos", name_prot_pair->prot,
+ name_prot_pair->name,
+ g_task_get_cancellable (task),
+ on_kerberos_discover, g_object_ref (task));
+ g_object_unref (resolver);
+ }
}
g_object_unref (task);
@@ -76,7 +103,7 @@ realm_kerberos_provider_discover_async (RealmProvider *provider,
GTask *task;
const gchar *software;
GResolver *resolver;
- gchar *name;
+ NameProtPair *name_prot_pair;
task = g_task_new (provider, NULL, callback, user_data);
@@ -86,12 +113,15 @@ realm_kerberos_provider_discover_async (RealmProvider *provider,
g_task_return_pointer (task, NULL, NULL);
} else {
- name = g_hostname_to_ascii (string);
+ name_prot_pair = g_new0 (NameProtPair, 1);
+ name_prot_pair->name = g_hostname_to_ascii (string);
+ name_prot_pair->prot = "udp";
resolver = g_resolver_get_default ();
- g_resolver_lookup_service_async (resolver, "kerberos", "udp", name,
+ g_resolver_lookup_service_async (resolver, "kerberos", name_prot_pair->prot,
+ name_prot_pair->name,
realm_invocation_get_cancellable (invocation),
on_kerberos_discover, g_object_ref (task));
- g_task_set_task_data (task, name, g_free);
+ g_task_set_task_data (task, name_prot_pair, name_prot_pair_free);
g_object_unref (resolver);
}
--
2.9.3

41
0001-LDAP-don-t-close-LDAP-socket-twice.patch Normal file
View File

@ -0,0 +1,41 @@
From 895e5b37d14090541480cebcb297846cbd3662ce Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 25 Nov 2016 17:35:11 +0100
Subject: [PATCH] LDAP: don't close LDAP socket twice
ldap_destroy() will call close() on the LDAP socket so with an explicit
close() before the file descriptor will be closed twice. Even worse,
since the file descriptor can be reused after the explicit call of
close() by any other thread the close() called from ldap_destroy() might
close a file descriptor used by a different thread as seen e.g. in
https://bugzilla.redhat.com/show_bug.cgi?id=1398522.
Additionally the patch makes sure that the closed connection cannot be
used again.
https://bugzilla.redhat.com/show_bug.cgi?id=1398522
---
service/realm-ldap.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/service/realm-ldap.c b/service/realm-ldap.c
index 061ed61..59817fb 100644
--- a/service/realm-ldap.c
+++ b/service/realm-ldap.c
@@ -159,10 +159,11 @@ ldap_source_finalize (GSource *source)
{
LdapSource *ls = (LdapSource *)source;
- /* Yeah, this is pretty rough, but we don't want blocking here */
- close (ls->sock);
ldap_destroy (ls->ldap);
+ ls->sock = -1;
+ ls->ldap = NULL;
+
if (ls->cancellable) {
g_cancellable_release_fd (ls->cancellable);
g_object_unref (ls->cancellable);
--
2.9.3

252
0001-Remove-support-for-deprecated-gtester-format.patch Normal file
View File

@ -0,0 +1,252 @@
From 5ae42c176e7bb550fc6cf10f29e75f58c733ae4f Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 2 Aug 2019 12:10:43 +0200
Subject: [PATCH] Remove support for deprecated gtester format
Support for the already deprecated gtester format was remove from recent
versions of glib2 but the test still call the tab-gtester conversion
tool.
This patch removes tab-gtester and the tab format is used directly.
Related to https://gitlab.freedesktop.org/realmd/realmd/issues/21
---
Makefile.am | 3 +-
build/tap-gtester | 204 ----------------------------------------------
2 files changed, 1 insertion(+), 206 deletions(-)
delete mode 100755 build/tap-gtester
diff --git a/Makefile.am b/Makefile.am
index 27e3494..4ffd5b4 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -161,7 +161,7 @@ endif
#
LOG_DRIVER = $(top_srcdir)/build/tap-driver
-LOG_COMPILER = $(top_srcdir)/build/tap-gtester
+LOG_COMPILER = sh -c '"$$0" "$$@" --tap'
VALGRIND_ARGS = --trace-children=no --quiet --error-exitcode=33 \
--suppressions=valgrind-suppressions --gen-suppressions=all \
@@ -183,7 +183,6 @@ recheck-memory: valgrind-suppressions
EXTRA_DIST += \
$(LOG_DRIVER) \
- $(LOG_COMPILER) \
$(VALGRIND_SUPPRESSIONS) \
$(NULL)
diff --git a/build/tap-gtester b/build/tap-gtester
deleted file mode 100755
index bbda266..0000000
--- a/build/tap-gtester
+++ /dev/null
@@ -1,204 +0,0 @@
-#!/usr/bin/python3
-# This can also be run with Python 2.
-
-# Copyright (C) 2014 Red Hat, Inc.
-#
-# Cockpit is free software; you can redistribute it and/or modify it
-# under the terms of the GNU Lesser General Public License as published by
-# the Free Software Foundation; either version 2.1 of the License, or
-# (at your option) any later version.
-#
-# Cockpit is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-# Lesser General Public License for more details.
-#
-# You should have received a copy of the GNU Lesser General Public License
-# along with Cockpit; If not, see <http://www.gnu.org/licenses/>.
-
-#
-# This is a test output compiler which produces TAP from GTest output
-# if GTest output is detected.
-#
-# Versions of glib later than 2.38.x output TAP natively when tests are
-# run with the --tap option. However we can't depend on such a recent
-# version of glib for our purposes.
-#
-# This implements the Test Anything Protocol (ie: TAP)
-# https://metacpan.org/pod/release/PETDANCE/Test-Harness-2.64/lib/Test/Harness/TAP.pod
-#
-
-import argparse
-import os
-import select
-import signal
-import subprocess
-import sys
-
-# Yes, it's dumb, but strsignal is not exposed in python
-# In addition signal numbers varify heavily from arch to arch
-def strsignal(sig):
- for name in dir(signal):
- if name.startswith("SIG") and sig == getattr(signal, name):
- return name
- return str(sig)
-
-
-class NullCompiler:
- def __init__(self, command):
- self.command = command
-
- def input(self, line):
- sys.stdout.write(line)
-
- def process(self, proc):
- while True:
- line = proc.stdout.readline()
- if not line:
- break
- self.input(line)
- proc.wait()
- return proc.returncode
-
- def run(self, proc, line=None):
- if line:
- self.input(line)
- return self.process(proc)
-
-
-class GTestCompiler(NullCompiler):
- def __init__(self, filename):
- NullCompiler.__init__(self, filename)
- self.test_num = 0
- self.test_name = None
- self.test_remaining = []
-
- def input(self, line):
- line = line.strip()
- if line.startswith("GTest: "):
- (cmd, unused, data) = line[7:].partition(": ")
- cmd = cmd.strip()
- data = data.strip()
- if cmd == "run":
- self.test_name = data
- assert self.test_name in self.test_remaining, "%s %s" % (self.test_name, repr(self.test_remaining))
- self.test_remaining.remove(self.test_name)
- self.test_num += 1
- elif cmd == "result":
- if self.test_name:
- if data == "OK":
- print("ok %d %s" % (self.test_num, self.test_name))
- if data == "FAIL":
- print("not ok %d %s" % (self.test_num, self.test_name))
- self.test_name = None
- elif cmd == "skipping":
- if "/subprocess" not in data:
- print("ok %d # skip -- %s" % (self.test_num, data))
- self.test_name = None
- elif data:
- print("# %s: %s" % (cmd, data))
- else:
- print("# %s" % cmd)
- elif line.startswith("(MSG: "):
- print("# %s" % line[6:-1])
- elif line:
- print("# %s" % line)
- sys.stdout.flush()
-
- def run(self, proc, output=""):
- # Complete retrieval of the list of tests
- output += proc.stdout.read()
- proc.wait()
- if proc.returncode:
- sys.stderr.write("tap-gtester: listing GTest tests failed: %d\n" % proc.returncode)
- return proc.returncode
- self.test_remaining = []
- for line in output.split("\n"):
- if line.startswith("/"):
- self.test_remaining.append(line.strip())
- if not self.test_remaining:
- print("Bail out! No tests found in GTest: %s" % self.command[0])
- return 0
-
- print("1..%d" % len(self.test_remaining))
-
- # First try to run all the tests in a batch
- proc = subprocess.Popen(self.command + ["--verbose" ], close_fds=True,
- stdout=subprocess.PIPE, universal_newlines=True)
- result = self.process(proc)
- if result == 0:
- return 0
-
- if result < 0:
- sys.stderr.write("%s terminated with %s\n" % (self.command[0], strsignal(-result)))
-
- # Now pick up any stragglers due to failures
- while True:
- # Assume that the last test failed
- if self.test_name:
- print("not ok %d %s" % (self.test_num, self.test_name))
- self.test_name = None
-
- # Run any tests which didn't get run
- if not self.test_remaining:
- break
-
- proc = subprocess.Popen(self.command + ["--verbose", "-p", self.test_remaining[0]],
- close_fds=True, stdout=subprocess.PIPE,
- universal_newlines=True)
- result = self.process(proc)
-
- # The various exit codes and signals we continue for
- if result not in [ 0, 1, -4, -5, -6, -7, -8, -11, 33 ]:
- break
-
- return result
-
-def main(argv):
- parser = argparse.ArgumentParser(description='Automake TAP compiler',
- usage="tap-gtester [--format FORMAT] command ...")
- parser.add_argument('--format', metavar='FORMAT', choices=[ "auto", "gtest", "tap" ],
- default="auto", help='The input format to compile')
- parser.add_argument('--verbose', action='store_true',
- default=True, help='Verbose mode (ignored)')
- parser.add_argument('command', nargs=argparse.REMAINDER, help="A test command to run")
- args = parser.parse_args(argv[1:])
-
- output = None
- format = args.format
- cmd = args.command
- if not cmd:
- sys.stderr.write("tap-gtester: specify a command to run\n")
- return 2
- if cmd[0] == '--':
- cmd.pop(0)
-
- proc = None
-
- os.environ['HARNESS_ACTIVE'] = '1'
-
- if format in ["auto", "gtest"]:
- list_cmd = cmd + ["-l", "--verbose"]
- proc = subprocess.Popen(list_cmd, close_fds=True, stdout=subprocess.PIPE,
- universal_newlines=True)
- output = proc.stdout.readline()
- # Smell whether we're dealing with GTest list output from first line
- if "random seed" in output or "GTest" in output or output.startswith("/"):
- format = "gtest"
- else:
- format = "tap"
- else:
- proc = subprocess.Popen(cmd, close_fds=True, stdout=subprocess.PIPE,
- universal_newlines=True)
-
- if format == "gtest":
- compiler = GTestCompiler(cmd)
- elif format == "tap":
- compiler = NullCompiler(cmd)
- else:
- assert False, "not reached"
-
- return compiler.run(proc, output)
-
-if __name__ == "__main__":
- sys.exit(main(sys.argv))
--
2.21.0

47
0001-Set-NEWEST-flag-when-resolving-packages-with-Package.patch Normal file
View File

@ -0,0 +1,47 @@
From fa6dd59c5eaabc8c7e540f2aa2ded6f785de0a13 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Wed, 20 Feb 2019 11:12:04 -0800
Subject: [PATCH] Set 'NEWEST' flag when resolving packages with PackageKit
When resolving package names via PackageKit, realmd does not set
the PK_FILTER_ENUM_NEWEST flag that asks PK to only give the
*newest available* package for each package name. So if there
are three different versions of the package available in three
repositories, realmd winds up producing an array containing the
package IDs for all three of those packages and calling
InstallPackages on all of them. I don't know if PK's behaviour
in this case is defined or predictable, but in practice in at
least one case it reliably results in one of the older package
versions being installed.
This does not seem desirable, we should always want to install
the newest available version. So let's set the NEWEST flag to
ensure this.
A possible consequence here is that, if a newer version of the
package is not installable but an older version is, we will now
fail where previously we did not. But even in that case I don't
know if we would *reliably* succeed before, and silently
installing an older version still doesn't necessarily seem like
the right thing to do.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
---
service/realm-packages.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/service/realm-packages.c b/service/realm-packages.c
index 5976439..0309c57 100644
--- a/service/realm-packages.c
+++ b/service/realm-packages.c
@@ -343,6 +343,7 @@ packages_resolve_async (GDBusConnection *connection,
gpointer user_data)
{
guint64 flags = 1 << 18 /* PK_FILTER_ENUM_ARCH */;
+ flags |= 1 << 16 /* PK_FILTER_ENUM_NEWEST */;
package_transaction_create ("Resolve", g_variant_new ("(t^as)", flags, package_names),
connection, cancellable, callback, user_data);
}
--
2.20.1

185
0001-Use-current-idmap-options-for-smb.conf.patch Normal file
View File

@ -0,0 +1,185 @@
From e683fb573bc09893ec541be29751560cea30ce3f Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Wed, 30 May 2018 13:10:57 +0200
Subject: [PATCH] Use current idmap options for smb.conf
Samba change some time ago the way how to configure id-mapping. With
this patch realmd will use the current supported options when creating
smb.conf.
A new option --legacy-samba-config is added to use the old options if
realmd is used with Samba 3.5 or earlier.
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1484072
---
dbus/realm-dbus-constants.h | 1 +
doc/manual/realmd.conf.xml | 17 ++++++++++++
service/realm-samba-enroll.c | 2 +-
service/realm-samba-enroll.h | 3 +++
service/realm-samba-winbind.c | 63 ++++++++++++++++++++++++++++++++++---------
5 files changed, 72 insertions(+), 14 deletions(-)
diff --git a/dbus/realm-dbus-constants.h b/dbus/realm-dbus-constants.h
index 9cd30ef..40ffa2d 100644
--- a/dbus/realm-dbus-constants.h
+++ b/dbus/realm-dbus-constants.h
@@ -69,6 +69,7 @@ G_BEGIN_DECLS
#define REALM_DBUS_OPTION_COMPUTER_NAME "computer-name"
#define REALM_DBUS_OPTION_OS_NAME "os-name"
#define REALM_DBUS_OPTION_OS_VERSION "os-version"
+#define REALM_DBUS_OPTION_LEGACY_SMB_CONF "legacy-samba-config"
#define REALM_DBUS_IDENTIFIER_ACTIVE_DIRECTORY "active-directory"
#define REALM_DBUS_IDENTIFIER_WINBIND "winbind"
diff --git a/doc/manual/realmd.conf.xml b/doc/manual/realmd.conf.xml
index 7853230..a2b577c 100644
--- a/doc/manual/realmd.conf.xml
+++ b/doc/manual/realmd.conf.xml
@@ -192,6 +192,23 @@ automatic-install = no
</listitem>
</varlistentry>
+ <varlistentry>
+ <term><option>legacy-samba-config</option></term>
+ <listitem>
+ <para>Set this to <parameter>yes</parameter> to create a Samba
+ configuration file with id-mapping options used by Samba-3.5
+ and earlier version.</para>
+
+ <informalexample>
+<programlisting language="js">
+[service]
+legacy-samba-config = no
+# legacy-samba-config = yes
+</programlisting>
+ </informalexample>
+ </listitem>
+ </varlistentry>
+
</variablelist>
</refsect1>
diff --git a/service/realm-samba-enroll.c b/service/realm-samba-enroll.c
index c81aed2..76e7b79 100644
--- a/service/realm-samba-enroll.c
+++ b/service/realm-samba-enroll.c
@@ -69,7 +69,7 @@ join_closure_free (gpointer data)
g_free (join);
}
-static gchar *
+gchar *
fallback_workgroup (const gchar *realm)
{
const gchar *pos;
diff --git a/service/realm-samba-enroll.h b/service/realm-samba-enroll.h
index 84e8b2f..310ec65 100644
--- a/service/realm-samba-enroll.h
+++ b/service/realm-samba-enroll.h
@@ -46,6 +46,9 @@ void realm_samba_enroll_leave_async (RealmDisco *disco,
gboolean realm_samba_enroll_leave_finish (GAsyncResult *result,
GError **error);
+gchar *
+fallback_workgroup (const gchar *realm);
+
G_END_DECLS
#endif /* __REALM_SAMBA_ENROLL_H__ */
diff --git a/service/realm-samba-winbind.c b/service/realm-samba-winbind.c
index a7ddec3..9335e26 100644
--- a/service/realm-samba-winbind.c
+++ b/service/realm-samba-winbind.c
@@ -21,8 +21,10 @@
#include "realm-options.h"
#include "realm-samba-config.h"
#include "realm-samba-winbind.h"
+#include "realm-samba-enroll.h"
#include "realm-settings.h"
#include "realm-service.h"
+#include "dbus/realm-dbus-constants.h"
#include <glib/gstdio.h>
@@ -80,6 +82,10 @@ realm_samba_winbind_configure_async (RealmIniConfig *config,
RealmIniConfig *pwc;
GTask *task;
GError *error = NULL;
+ gchar *workgroup = NULL;
+ gchar *idmap_config_backend = NULL;
+ gchar *idmap_config_range = NULL;
+ gchar *idmap_config_schema_mode = NULL;
g_return_if_fail (config != NULL);
g_return_if_fail (invocation != NULL || G_IS_DBUS_METHOD_INVOCATION (invocation));
@@ -100,23 +106,54 @@ realm_samba_winbind_configure_async (RealmIniConfig *config,
"template shell", realm_settings_string ("users", "default-shell"),
NULL);
- if (realm_options_automatic_mapping (options, domain_name)) {
- realm_ini_config_set (config, REALM_SAMBA_CONFIG_GLOBAL,
- "idmap uid", "10000-2000000",
- "idmap gid", "10000-2000000",
- "idmap backend", "tdb",
- "idmap schema", NULL,
- NULL);
+ if (realm_settings_boolean ("service", REALM_DBUS_OPTION_LEGACY_SMB_CONF, FALSE)) {
+ if (realm_options_automatic_mapping (options, domain_name)) {
+ realm_ini_config_set (config, REALM_SAMBA_CONFIG_GLOBAL,
+ "idmap uid", "10000-2000000",
+ "idmap gid", "10000-2000000",
+ "idmap backend", "tdb",
+ "idmap schema", NULL,
+ NULL);
+ } else {
+ realm_ini_config_set (config, REALM_SAMBA_CONFIG_GLOBAL,
+ "idmap uid", "500-4294967296",
+ "idmap gid", "500-4294967296",
+ "idmap backend", "ad",
+ "idmap schema", "rfc2307",
+ NULL);
+ }
} else {
- realm_ini_config_set (config, REALM_SAMBA_CONFIG_GLOBAL,
- "idmap uid", "500-4294967296",
- "idmap gid", "500-4294967296",
- "idmap backend", "ad",
- "idmap schema", "rfc2307",
- NULL);
+ workgroup = realm_ini_config_get (config, REALM_SAMBA_CONFIG_GLOBAL, "workgroup");
+ if (workgroup == NULL) {
+ workgroup = fallback_workgroup (domain_name);
+ }
+ idmap_config_backend = g_strdup_printf ("idmap config %s : backend", workgroup != NULL ? workgroup : "PLEASE_REPLACE");
+ idmap_config_range = g_strdup_printf ("idmap config %s : range", workgroup != NULL ? workgroup : "PLEASE_REPLACE");
+ idmap_config_schema_mode = g_strdup_printf ("idmap config %s : schema_mode", workgroup != NULL ? workgroup : "PLEASE_REPLACE");
+ g_free (workgroup);
+
+ if (realm_options_automatic_mapping (options, domain_name)) {
+ realm_ini_config_set (config, REALM_SAMBA_CONFIG_GLOBAL,
+ "idmap config * : backend", "tdb",
+ "idmap config * : range", "10000-999999",
+ idmap_config_backend != NULL ? idmap_config_backend : "idmap config PLEASE_REPLACE : backend", "rid",
+ idmap_config_range != NULL ? idmap_config_range: "idmap config PLEASE_REPLACE : range", "2000000-2999999",
+ idmap_config_schema_mode != NULL ? idmap_config_schema_mode: "idmap config PLEASE_REPLACE : schema_mode", NULL,
+ NULL);
+ } else {
+ realm_ini_config_set (config, REALM_SAMBA_CONFIG_GLOBAL,
+ "idmap config * : backend", "tdb",
+ "idmap config * : range", "10000000-10999999",
+ idmap_config_backend != NULL ? idmap_config_backend : "idmap config PLEASE_REPLACE : backend", "ad",
+ idmap_config_range != NULL ? idmap_config_range: "idmap config PLEASE_REPLACE : range", "500-999999",
+ idmap_config_schema_mode != NULL ? idmap_config_schema_mode: "idmap config PLEASE_REPLACE : schema_mode", "rfc2307",
+ NULL);
+ }
}
realm_ini_config_finish_change (config, &error);
+ g_free (idmap_config_backend);
+ g_free (idmap_config_range);
}
/* Setup pam_winbind.conf with decent defaults matching our expectations */
--
2.14.4

1500
0001-doc-make-sure-cross-reference-ids-are-predictable.patch Normal file
View File

File diff suppressed because it is too large Load Diff

96
0001-service-Add-nss-and-pam-sssd.conf-services-after-joi.patch Normal file
View File

@ -0,0 +1,96 @@
From 402cbab6e8267fcd959bcfa84a47f4871b59944d Mon Sep 17 00:00:00 2001
From: Stef Walter <stefw@redhat.com>
Date: Fri, 28 Oct 2016 20:27:48 +0200
Subject: [PATCH] service: Add nss and pam sssd.conf services after joining
After adding a domain to sssd.conf add the nss and pam services
to the [sssd] block.
https://bugs.freedesktop.org/show_bug.cgi?id=98479
---
service/realm-sssd-ad.c | 3 +++
service/realm-sssd-config.c | 2 --
service/realm-sssd-ipa.c | 3 +++
tests/test-sssd-config.c | 4 ++--
4 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/service/realm-sssd-ad.c b/service/realm-sssd-ad.c
index 5ed384d..5fa81ce 100644
--- a/service/realm-sssd-ad.c
+++ b/service/realm-sssd-ad.c
@@ -160,6 +160,7 @@ configure_sssd_for_domain (RealmIniConfig *config,
gboolean use_adcli,
GError **error)
{
+ const gchar *services[] = { "nss", "pam", NULL };
GString *realmd_tags;
const gchar *access_provider;
const gchar *shell;
@@ -206,6 +207,8 @@ configure_sssd_for_domain (RealmIniConfig *config,
"ldap_sasl_authid", authid,
NULL);
+ realm_ini_config_set_list_diff (config, "sssd", "services", ", ", services, NULL);
+
g_free (authid);
g_string_free (realmd_tags, TRUE);
diff --git a/service/realm-sssd-config.c b/service/realm-sssd-config.c
index 2096afd..d4398b9 100644
--- a/service/realm-sssd-config.c
+++ b/service/realm-sssd-config.c
@@ -154,8 +154,6 @@ realm_sssd_config_add_domain (RealmIniConfig *config,
g_strfreev (already);
/* Setup a default sssd section */
- if (!realm_ini_config_have (config, "section", "services"))
- realm_ini_config_set (config, "sssd", "services", "nss, pam", NULL);
if (!realm_ini_config_have (config, "sssd", "config_file_version"))
realm_ini_config_set (config, "sssd", "config_file_version", "2", NULL);
diff --git a/service/realm-sssd-ipa.c b/service/realm-sssd-ipa.c
index b12136e..001870d 100644
--- a/service/realm-sssd-ipa.c
+++ b/service/realm-sssd-ipa.c
@@ -156,6 +156,7 @@ on_ipa_client_do_restart (GObject *source,
GAsyncResult *result,
gpointer user_data)
{
+ const gchar *services[] = { "nss", "pam", NULL };
GTask *task = G_TASK (user_data);
EnrollClosure *enroll = g_task_get_task_data (task);
RealmSssd *sssd = g_task_get_source_object (task);
@@ -207,6 +208,8 @@ on_ipa_client_do_restart (GObject *source,
"realmd_tags", realmd_tags,
NULL);
+ realm_ini_config_set_list_diff (config, "sssd", "services", ", ", services, NULL);
+
g_free (home);
}
diff --git a/tests/test-sssd-config.c b/tests/test-sssd-config.c
index 59eab75..892b9d5 100644
--- a/tests/test-sssd-config.c
+++ b/tests/test-sssd-config.c
@@ -90,7 +90,7 @@ test_add_domain (Test *test,
gconstpointer unused)
{
const gchar *data = "[domain/one]\nval=1\n[sssd]\ndomains=one";
- const gchar *check = "[domain/one]\nval=1\n[sssd]\ndomains = one, two\nconfig_file_version = 2\nservices = nss, pam\n\n[domain/two]\ndos = 2\n";
+ const gchar *check = "[domain/one]\nval=1\n[sssd]\ndomains = one, two\nconfig_file_version = 2\n\n[domain/two]\ndos = 2\n";
GError *error = NULL;
gchar *output;
gboolean ret;
@@ -140,7 +140,7 @@ static void
test_add_domain_only (Test *test,
gconstpointer unused)
{
- const gchar *check = "\n[sssd]\ndomains = two\nconfig_file_version = 2\nservices = nss, pam\n\n[domain/two]\ndos = 2\n";
+ const gchar *check = "\n[sssd]\ndomains = two\nconfig_file_version = 2\n\n[domain/two]\ndos = 2\n";
GError *error = NULL;
gchar *output;
gboolean ret;
--
2.9.3

98
0001-service-Add-pam-and-nss-services-in-realm_sssd_confi.patch Normal file
View File

@ -0,0 +1,98 @@
From 9d5b6f5c88df582fb94edcf5cc05a8cfaa63cf6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <fidencio@redhat.com>
Date: Tue, 25 Apr 2017 07:20:17 +0200
Subject: [PATCH] service: Add "pam" and "nss" services in
realm_sssd_config_add_domain()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
realm_sssd_config_add_domain() must setup the services line in sssd.conf
otherwise SSSD won't be able to start any of its services.
It's a regression caused by 402cbab which leaves SSSD with no services
line when joining to an ad client doing "realm join ad.example".
https://bugs.freedesktop.org/show_bug.cgi?id=98479
Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
---
service/realm-sssd-ad.c | 3 ++-
service/realm-sssd-config.c | 2 ++
service/realm-sssd-ipa.c | 3 ++-
tests/test-sssd-config.c | 4 ++--
4 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/service/realm-sssd-ad.c b/service/realm-sssd-ad.c
index 5fa81ce..8543ca8 100644
--- a/service/realm-sssd-ad.c
+++ b/service/realm-sssd-ad.c
@@ -207,7 +207,8 @@ configure_sssd_for_domain (RealmIniConfig *config,
"ldap_sasl_authid", authid,
NULL);
- realm_ini_config_set_list_diff (config, "sssd", "services", ", ", services, NULL);
+ if (ret)
+ ret = realm_ini_config_change_list (config, "sssd", "services", ", ", services, NULL, error);
g_free (authid);
g_string_free (realmd_tags, TRUE);
diff --git a/service/realm-sssd-config.c b/service/realm-sssd-config.c
index d4398b9..140d7dc 100644
--- a/service/realm-sssd-config.c
+++ b/service/realm-sssd-config.c
@@ -130,6 +130,7 @@ realm_sssd_config_add_domain (RealmIniConfig *config,
gchar **already;
gboolean ret;
gchar *section;
+ const gchar *services[] = { "nss", "pam", NULL };
va_list va;
gint i;
@@ -154,6 +155,7 @@ realm_sssd_config_add_domain (RealmIniConfig *config,
g_strfreev (already);
/* Setup a default sssd section */
+ realm_ini_config_set_list_diff (config, "sssd", "services", ", ", services, NULL);
if (!realm_ini_config_have (config, "sssd", "config_file_version"))
realm_ini_config_set (config, "sssd", "config_file_version", "2", NULL);
diff --git a/service/realm-sssd-ipa.c b/service/realm-sssd-ipa.c
index 001870d..ff1dc8a 100644
--- a/service/realm-sssd-ipa.c
+++ b/service/realm-sssd-ipa.c
@@ -208,7 +208,8 @@ on_ipa_client_do_restart (GObject *source,
"realmd_tags", realmd_tags,
NULL);
- realm_ini_config_set_list_diff (config, "sssd", "services", ", ", services, NULL);
+ if (error == NULL)
+ realm_ini_config_change_list (config, "sssd", "services", ", ", services, NULL, &error);
g_free (home);
}
diff --git a/tests/test-sssd-config.c b/tests/test-sssd-config.c
index 892b9d5..59eab75 100644
--- a/tests/test-sssd-config.c
+++ b/tests/test-sssd-config.c
@@ -90,7 +90,7 @@ test_add_domain (Test *test,
gconstpointer unused)
{
const gchar *data = "[domain/one]\nval=1\n[sssd]\ndomains=one";
- const gchar *check = "[domain/one]\nval=1\n[sssd]\ndomains = one, two\nconfig_file_version = 2\n\n[domain/two]\ndos = 2\n";
+ const gchar *check = "[domain/one]\nval=1\n[sssd]\ndomains = one, two\nconfig_file_version = 2\nservices = nss, pam\n\n[domain/two]\ndos = 2\n";
GError *error = NULL;
gchar *output;
gboolean ret;
@@ -140,7 +140,7 @@ static void
test_add_domain_only (Test *test,
gconstpointer unused)
{
- const gchar *check = "\n[sssd]\ndomains = two\nconfig_file_version = 2\n\n[domain/two]\ndos = 2\n";
+ const gchar *check = "\n[sssd]\ndomains = two\nconfig_file_version = 2\nservices = nss, pam\n\n[domain/two]\ndos = 2\n";
GError *error = NULL;
gchar *output;
gboolean ret;
--
2.9.3

36
0001-switch-to-authselect.patch Normal file
View File

@ -0,0 +1,36 @@
From 32645f2fc1ddfb2eed7069fd749602619f26ed37 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
Date: Mon, 19 Feb 2018 11:51:06 +0100
Subject: [PATCH] switch to authselect
---
service/realmd-redhat.conf | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/service/realmd-redhat.conf b/service/realmd-redhat.conf
index e39fad525c716d1ed99715280cd5d497b9039427..26cf6147f352e1b48c3261fa42707d816428f879 100644
--- a/service/realmd-redhat.conf
+++ b/service/realmd-redhat.conf
@@ -23,15 +23,15 @@ adcli = /usr/sbin/adcli
freeipa-client = /usr/sbin/ipa-client-install
[commands]
-winbind-enable-logins = /usr/bin/sh -c "/usr/sbin/authconfig --update --enablewinbind --enablewinbindauth --enablemkhomedir --nostart && /usr/bin/systemctl enable oddjobd.service && /usr/bin/systemctl start oddjobd.service"
-winbind-disable-logins = /usr/sbin/authconfig --update --disablewinbind --disablewinbindauth --nostart
+winbind-enable-logins = /usr/bin/sh -c "/usr/bin/authselect select winbind with-mkhomedir --force && /usr/bin/systemctl enable oddjobd.service && /usr/bin/systemctl start oddjobd.service"
+winbind-disable-logins = /usr/bin/authselect select sssd with-mkhomedir
winbind-enable-service = /usr/bin/systemctl enable winbind.service
winbind-disable-service = /usr/bin/systemctl disable winbind.service
winbind-restart-service = /usr/bin/systemctl restart winbind.service
winbind-stop-service = /usr/bin/systemctl stop winbind.service
-sssd-enable-logins = /usr/bin/sh -c "/usr/sbin/authconfig --update --enablesssd --enablesssdauth --enablemkhomedir --nostart && /usr/bin/systemctl enable oddjobd.service && /usr/bin/systemctl start oddjobd.service"
-sssd-disable-logins = /usr/sbin/authconfig --update --disablesssdauth --nostart
+sssd-enable-logins = /usr/bin/sh -c "/usr/bin/authselect select sssd with-mkhomedir --force && /usr/bin/systemctl enable oddjobd.service && /usr/bin/systemctl start oddjobd.service"
+sssd-disable-logins = /usr/bin/authselect select sssd with-mkhomedir
sssd-enable-service = /usr/bin/systemctl enable sssd.service
sssd-disable-service = /usr/bin/systemctl disable sssd.service
sssd-restart-service = /usr/bin/systemctl restart sssd.service
--
2.9.3

82
0001-tests-ignore-order-in-test_update_domain.patch Normal file
View File

@ -0,0 +1,82 @@
From b6753bd048b4012b11d60c094d1ab6ca181ee50d Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Thu, 21 Feb 2019 21:16:26 +0100
Subject: [PATCH] tests: ignore order in test_update_domain
Individual options of a domain or in general for a section in an ini
file are stored by realmd in a hash table. When writing out the ini file
the options can show up in any order and the unit tests should be aware
of it.
Resolves: https://gitlab.freedesktop.org/realmd/realmd/issues/19
---
tests/test-sssd-config.c | 41 ++++++++++++++++++++++++++++++++++++++--
1 file changed, 39 insertions(+), 2 deletions(-)
diff --git a/tests/test-sssd-config.c b/tests/test-sssd-config.c
index 59eab75..8f3fec5 100644
--- a/tests/test-sssd-config.c
+++ b/tests/test-sssd-config.c
@@ -163,12 +163,49 @@ test_add_domain_only (Test *test,
g_free (output);
}
+static void check_for_test_update_domain (char *new)
+{
+ char *token;
+ char *saveptr;
+ size_t c;
+ int result = 0;
+
+ token = strtok_r (new, "\n", &saveptr);
+ g_assert_nonnull (token);
+ g_assert_cmpstr (token, ==, "[domain/one]");
+
+ for (c = 0; c < 3; c++) {
+ token = strtok_r (NULL, "\n", &saveptr);
+ g_assert_nonnull (token);
+ if (strcmp (token, "val=1") == 0) {
+ result += 1;
+ } else if (strcmp (token, "uno = 1") == 0) {
+ result += 2;
+ } else if (strcmp (token, "eins = one") == 0) {
+ result += 4;
+ } else {
+ g_assert_not_reached ();
+ }
+ }
+ g_assert_cmpint (result, ==, 7);
+
+ token = strtok_r (NULL, "\n", &saveptr);
+ g_assert_nonnull (token);
+ g_assert_cmpstr (token, ==, "[sssd]");
+
+ token = strtok_r (NULL, "\n", &saveptr);
+ g_assert_nonnull (token);
+ g_assert_cmpstr (token, ==, "domains=one");
+
+ token = strtok_r (NULL, "\n", &saveptr);
+ g_assert_null (token);
+}
+
static void
test_update_domain (Test *test,
gconstpointer unused)
{
const gchar *data = "[domain/one]\nval=1\n[sssd]\ndomains=one";
- const gchar *check = "[domain/one]\nval=1\nuno = 1\neins = one\n[sssd]\ndomains=one";
GError *error = NULL;
gchar *output;
gboolean ret;
@@ -190,7 +227,7 @@ test_update_domain (Test *test,
g_assert_no_error (error);
g_assert (ret == TRUE);
- g_assert_cmpstr (check, ==, output);
+ check_for_test_update_domain (output);
g_free (output);
}
--
2.20.1

374
0001-tests-run-tests-with-python3.patch Normal file
View File

@ -0,0 +1,374 @@
From c257850912897a07e20f205faecf3c1b692fa9e9 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Wed, 4 Jul 2018 16:41:16 +0200
Subject: [PATCH] tests: run tests with python3
To allow the test to run with python3 build/tap-driver and
build/tap-gtester are updated to the latest version provided by the
cockpit project https://github.com/cockpit-project/cockpit.
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1595813
---
build/tap-driver | 104 +++++++++++++++++++++++++++++++++++++++++++-----------
build/tap-gtester | 59 ++++++++++++++++++++++---------
2 files changed, 125 insertions(+), 38 deletions(-)
diff --git a/build/tap-driver b/build/tap-driver
index 42f57c8..241fd50 100755
--- a/build/tap-driver
+++ b/build/tap-driver
@@ -1,4 +1,5 @@
-#!/usr/bin/python
+#!/usr/bin/python3
+# This can also be run with Python 2.
# Copyright (C) 2013 Red Hat, Inc.
#
@@ -29,20 +30,58 @@
#
import argparse
+import fcntl
import os
import select
+import struct
import subprocess
import sys
+import termios
+import errno
+
+_PY3 = sys.version[0] >= '3'
+_str = _PY3 and str or unicode
+
+def out(data, stream=None, flush=False):
+ if not isinstance(data, bytes):
+ data = data.encode("UTF-8")
+ if not stream:
+ stream = _PY3 and sys.stdout.buffer or sys.stdout
+ while True:
+ try:
+ if data:
+ stream.write(data)
+ data = None
+ if flush:
+ stream.flush()
+ flush = False
+ break
+ except IOError as e:
+ if e.errno == errno.EAGAIN:
+ continue
+ raise
+
+def terminal_width():
+ try:
+ h, w, hp, wp = struct.unpack('HHHH',
+ fcntl.ioctl(1, termios.TIOCGWINSZ,
+ struct.pack('HHHH', 0, 0, 0, 0)))
+ return w
+ except IOError as e:
+ if e.errno != errno.ENOTTY:
+ sys.stderr.write("%i %s %s\n" % (e.errno, e.strerror, sys.exc_info()))
+ return sys.maxsize
class Driver:
def __init__(self, args):
self.argv = args.command
self.test_name = args.test_name
- self.log = open(args.log_file, "w")
- self.log.write("# %s\n" % " ".join(sys.argv))
+ self.log = open(args.log_file, "wb")
+ self.log.write(("# %s\n" % " ".join(sys.argv)).encode("UTF-8"))
self.trs = open(args.trs_file, "w")
self.color_tests = args.color_tests
self.expect_failure = args.expect_failure
+ self.width = terminal_width() - 9
def report(self, code, *args):
CODES = {
@@ -57,17 +96,18 @@ class Driver:
# Print out to console
if self.color_tests:
if code in CODES:
- sys.stdout.write(CODES[code])
- sys.stdout.write(code)
+ out(CODES[code])
+ out(code)
if self.color_tests:
- sys.stdout.write('\x1b[m')
- sys.stdout.write(": ")
- sys.stdout.write(self.test_name)
- sys.stdout.write(" ")
- for arg in args:
- sys.stdout.write(str(arg))
- sys.stdout.write("\n")
- sys.stdout.flush()
+ out('\x1b[m')
+ out(": ")
+ msg = "".join([ self.test_name + " " ] + list(map(_str, args)))
+ if code == "PASS" and len(msg) > self.width:
+ out(msg[:self.width])
+ out("...")
+ else:
+ out(msg)
+ out("\n", flush=True)
# Book keeping
if code in CODES:
@@ -100,12 +140,14 @@ class Driver:
def execute(self):
try:
proc = subprocess.Popen(self.argv, close_fds=True,
+ stdin=subprocess.PIPE,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE)
- except OSError, ex:
+ except OSError as ex:
self.report_error("Couldn't run %s: %s" % (self.argv[0], str(ex)))
return
+ proc.stdin.close()
outf = proc.stdout.fileno()
errf = proc.stderr.fileno()
rset = [outf, errf]
@@ -113,18 +155,25 @@ class Driver:
ret = select.select(rset, [], [], 10)
if outf in ret[0]:
data = os.read(outf, 1024)
- if data == "":
+ if data == b"":
rset.remove(outf)
self.log.write(data)
self.process(data)
if errf in ret[0]:
data = os.read(errf, 1024)
- if data == "":
+ if data == b"":
rset.remove(errf)
self.log.write(data)
- sys.stderr.write(data)
+ stream = _PY3 and sys.stderr.buffer or sys.stderr
+ out(data, stream=stream, flush=True)
proc.wait()
+
+ # Make sure the test didn't change blocking output
+ assert fcntl.fcntl(0, fcntl.F_GETFL) & os.O_NONBLOCK == 0
+ assert fcntl.fcntl(1, fcntl.F_GETFL) & os.O_NONBLOCK == 0
+ assert fcntl.fcntl(2, fcntl.F_GETFL) & os.O_NONBLOCK == 0
+
return proc.returncode
@@ -137,6 +186,7 @@ class TapDriver(Driver):
self.late_plan = False
self.errored = False
self.bail_out = False
+ self.skip_all_reason = None
def report(self, code, num, *args):
if num:
@@ -170,13 +220,19 @@ class TapDriver(Driver):
else:
self.result_fail(num, description)
- def consume_test_plan(self, first, last):
+ def consume_test_plan(self, line):
# Only one test plan is supported
if self.test_plan:
self.report_error("Get a second TAP test plan")
return
+ if line.lower().startswith('1..0 # skip'):
+ self.skip_all_reason = line[5:].strip()
+ self.bail_out = True
+ return
+
try:
+ (first, unused, last) = line.partition("..")
first = int(first)
last = int(last)
except ValueError:
@@ -192,7 +248,7 @@ class TapDriver(Driver):
def process(self, output):
if output:
- self.output += output
+ self.output += output.decode("UTF-8")
elif self.output:
self.output += "\n"
(ready, unused, self.output) = self.output.rpartition("\n")
@@ -202,8 +258,7 @@ class TapDriver(Driver):
elif line.startswith("not ok "):
self.consume_test_line(False, line[7:])
elif line and line[0].isdigit() and ".." in line:
- (first, unused, last) = line.partition("..")
- self.consume_test_plan(first, last)
+ self.consume_test_plan(line)
elif line.lower().startswith("bail out!"):
self.consume_bail_out(line)
@@ -213,6 +268,13 @@ class TapDriver(Driver):
failed = False
skipped = True
+ if self.skip_all_reason is not None:
+ self.result_skip("skipping:", self.skip_all_reason)
+ self.trs.write(":global-test-result: SKIP\n")
+ self.trs.write(":test-global-result: SKIP\n")
+ self.trs.write(":recheck: no\n")
+ return 0
+
# Basic collation of results
for (num, code) in self.reported.items():
if code == "ERROR":
diff --git a/build/tap-gtester b/build/tap-gtester
index 7e667d4..bbda266 100755
--- a/build/tap-gtester
+++ b/build/tap-gtester
@@ -1,4 +1,5 @@
-#!/usr/bin/python
+#!/usr/bin/python3
+# This can also be run with Python 2.
# Copyright (C) 2014 Red Hat, Inc.
#
@@ -30,9 +31,19 @@
import argparse
import os
import select
+import signal
import subprocess
import sys
+# Yes, it's dumb, but strsignal is not exposed in python
+# In addition signal numbers varify heavily from arch to arch
+def strsignal(sig):
+ for name in dir(signal):
+ if name.startswith("SIG") and sig == getattr(signal, name):
+ return name
+ return str(sig)
+
+
class NullCompiler:
def __init__(self, command):
self.command = command
@@ -76,22 +87,22 @@ class GTestCompiler(NullCompiler):
elif cmd == "result":
if self.test_name:
if data == "OK":
- print "ok %d %s" % (self.test_num, self.test_name)
+ print("ok %d %s" % (self.test_num, self.test_name))
if data == "FAIL":
- print "not ok %d %s", (self.test_num, self.test_name)
+ print("not ok %d %s" % (self.test_num, self.test_name))
self.test_name = None
elif cmd == "skipping":
if "/subprocess" not in data:
- print "ok %d # skip -- %s" % (self.test_num, data)
+ print("ok %d # skip -- %s" % (self.test_num, data))
self.test_name = None
elif data:
- print "# %s: %s" % (cmd, data)
+ print("# %s: %s" % (cmd, data))
else:
- print "# %s" % cmd
+ print("# %s" % cmd)
elif line.startswith("(MSG: "):
- print "# %s" % line[6:-1]
+ print("# %s" % line[6:-1])
elif line:
- print "# %s" % line
+ print("# %s" % line)
sys.stdout.flush()
def run(self, proc, output=""):
@@ -106,22 +117,26 @@ class GTestCompiler(NullCompiler):
if line.startswith("/"):
self.test_remaining.append(line.strip())
if not self.test_remaining:
- print "Bail out! No tests found in GTest: %s" % self.command[0]
+ print("Bail out! No tests found in GTest: %s" % self.command[0])
return 0
- print "1..%d" % len(self.test_remaining)
+ print("1..%d" % len(self.test_remaining))
# First try to run all the tests in a batch
- proc = subprocess.Popen(self.command + ["--verbose" ], close_fds=True, stdout=subprocess.PIPE)
+ proc = subprocess.Popen(self.command + ["--verbose" ], close_fds=True,
+ stdout=subprocess.PIPE, universal_newlines=True)
result = self.process(proc)
if result == 0:
return 0
+ if result < 0:
+ sys.stderr.write("%s terminated with %s\n" % (self.command[0], strsignal(-result)))
+
# Now pick up any stragglers due to failures
while True:
# Assume that the last test failed
if self.test_name:
- print "not ok %d %s" % (self.test_num, self.test_name)
+ print("not ok %d %s" % (self.test_num, self.test_name))
self.test_name = None
# Run any tests which didn't get run
@@ -129,7 +144,8 @@ class GTestCompiler(NullCompiler):
break
proc = subprocess.Popen(self.command + ["--verbose", "-p", self.test_remaining[0]],
- close_fds=True, stdout=subprocess.PIPE)
+ close_fds=True, stdout=subprocess.PIPE,
+ universal_newlines=True)
result = self.process(proc)
# The various exit codes and signals we continue for
@@ -139,24 +155,32 @@ class GTestCompiler(NullCompiler):
return result
def main(argv):
- parser = argparse.ArgumentParser(description='Automake TAP compiler')
+ parser = argparse.ArgumentParser(description='Automake TAP compiler',
+ usage="tap-gtester [--format FORMAT] command ...")
parser.add_argument('--format', metavar='FORMAT', choices=[ "auto", "gtest", "tap" ],
default="auto", help='The input format to compile')
parser.add_argument('--verbose', action='store_true',
default=True, help='Verbose mode (ignored)')
- parser.add_argument('command', nargs='+', help="A test command to run")
+ parser.add_argument('command', nargs=argparse.REMAINDER, help="A test command to run")
args = parser.parse_args(argv[1:])
output = None
format = args.format
cmd = args.command
+ if not cmd:
+ sys.stderr.write("tap-gtester: specify a command to run\n")
+ return 2
+ if cmd[0] == '--':
+ cmd.pop(0)
+
proc = None
os.environ['HARNESS_ACTIVE'] = '1'
if format in ["auto", "gtest"]:
list_cmd = cmd + ["-l", "--verbose"]
- proc = subprocess.Popen(list_cmd, close_fds=True, stdout=subprocess.PIPE)
+ proc = subprocess.Popen(list_cmd, close_fds=True, stdout=subprocess.PIPE,
+ universal_newlines=True)
output = proc.stdout.readline()
# Smell whether we're dealing with GTest list output from first line
if "random seed" in output or "GTest" in output or output.startswith("/"):
@@ -164,7 +188,8 @@ def main(argv):
else:
format = "tap"
else:
- proc = subprocess.Popen(cmd, close_fds=True, stdout=subprocess.PIPE)
+ proc = subprocess.Popen(cmd, close_fds=True, stdout=subprocess.PIPE,
+ universal_newlines=True)
if format == "gtest":
compiler = GTestCompiler(cmd)
--
2.14.4

113
0002-Change-qualified-names-default-for-IPA.patch Normal file
View File

@ -0,0 +1,113 @@
From 21ab1fdd127d242a9b4e95c3c90dd2bf3159d149 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Tue, 14 Aug 2018 16:44:39 +0200
Subject: [PATCH 2/3] Change qualified names default for IPA
In a FreeIPA domain it is typically expected that the IPA accounts use
sort names while accounts from trusted domains have fully qualified
names. This is automatically done by SSSD's IPA provider so there is no
need to force fully qualified names in the SSSD configuration.
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1575538
---
service/realm-options.c | 9 +++++----
service/realm-options.h | 3 ++-
service/realm-samba-winbind.c | 2 +-
service/realm-sssd-ad.c | 2 +-
service/realm-sssd-ipa.c | 2 +-
5 files changed, 10 insertions(+), 8 deletions(-)
diff --git a/service/realm-options.c b/service/realm-options.c
index bd804ea..34a209f 100644
--- a/service/realm-options.c
+++ b/service/realm-options.c
@@ -98,7 +98,7 @@ realm_options_automatic_mapping (GVariant *options,
if (realm_name && !option) {
section = g_utf8_casefold (realm_name, -1);
- mapping = realm_settings_boolean (realm_name, REALM_DBUS_OPTION_AUTOMATIC_ID_MAPPING, TRUE);
+ mapping = realm_settings_boolean (section, REALM_DBUS_OPTION_AUTOMATIC_ID_MAPPING, TRUE);
g_free (section);
}
@@ -112,20 +112,21 @@ realm_options_automatic_join (const gchar *realm_name)
gboolean mapping;
section = g_utf8_casefold (realm_name, -1);
- mapping = realm_settings_boolean (realm_name, "automatic-join", FALSE);
+ mapping = realm_settings_boolean (section, "automatic-join", FALSE);
g_free (section);
return mapping;
}
gboolean
-realm_options_qualify_names (const gchar *realm_name)
+realm_options_qualify_names (const gchar *realm_name,
+ gboolean def)
{
gchar *section;
gboolean qualify;
section = g_utf8_casefold (realm_name, -1);
- qualify = realm_settings_boolean (realm_name, "fully-qualified-names", TRUE);
+ qualify = realm_settings_boolean (section, "fully-qualified-names", def);
g_free (section);
return qualify;
diff --git a/service/realm-options.h b/service/realm-options.h
index 7a1355e..b71d219 100644
--- a/service/realm-options.h
+++ b/service/realm-options.h
@@ -37,7 +37,8 @@ const gchar * realm_options_user_principal (GVariant *options,
gboolean realm_options_automatic_mapping (GVariant *options,
const gchar *realm_name);
-gboolean realm_options_qualify_names (const gchar *realm_name);
+gboolean realm_options_qualify_names (const gchar *realm_name,
+ gboolean def);
gboolean realm_options_check_domain_name (const gchar *domain_name);
diff --git a/service/realm-samba-winbind.c b/service/realm-samba-winbind.c
index 9335e26..61988eb 100644
--- a/service/realm-samba-winbind.c
+++ b/service/realm-samba-winbind.c
@@ -102,7 +102,7 @@ realm_samba_winbind_configure_async (RealmIniConfig *config,
"winbind enum groups", "no",
"winbind offline logon", "yes",
"winbind refresh tickets", "yes",
- "winbind use default domain", realm_options_qualify_names (domain_name )? "no" : "yes",
+ "winbind use default domain", realm_options_qualify_names (domain_name, TRUE )? "no" : "yes",
"template shell", realm_settings_string ("users", "default-shell"),
NULL);
diff --git a/service/realm-sssd-ad.c b/service/realm-sssd-ad.c
index 8543ca8..de7ce30 100644
--- a/service/realm-sssd-ad.c
+++ b/service/realm-sssd-ad.c
@@ -172,7 +172,7 @@ configure_sssd_for_domain (RealmIniConfig *config,
gchar *home;
home = realm_sssd_build_default_home (realm_settings_string ("users", "default-home"));
- qualify = realm_options_qualify_names (disco->domain_name);
+ qualify = realm_options_qualify_names (disco->domain_name, TRUE);
shell = realm_settings_string ("users", "default-shell");
explicit_computer_name = realm_options_computer_name (options, disco->domain_name);
realmd_tags = g_string_new ("");
diff --git a/service/realm-sssd-ipa.c b/service/realm-sssd-ipa.c
index ff1dc8a..5029f6b 100644
--- a/service/realm-sssd-ipa.c
+++ b/service/realm-sssd-ipa.c
@@ -201,7 +201,7 @@ on_ipa_client_do_restart (GObject *source,
realm_sssd_config_update_domain (config, domain, &error,
"cache_credentials", "True",
- "use_fully_qualified_names", realm_options_qualify_names (domain) ? "True" : "False",
+ "use_fully_qualified_names", realm_options_qualify_names (domain, FALSE) ? "True" : "False",
"krb5_store_password_if_offline", "True",
"default_shell", shell,
"fallback_homedir", home,
--
2.17.1

74
0002-Use-startTLS-with-FreeIPA.patch Normal file
View File

@ -0,0 +1,74 @@
From b53c3e5fb5c90813ce1b47ddc570dd9c800232f9 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 3 Jul 2020 17:18:27 +0200
Subject: [PATCH 2/4] Use startTLS with FreeIPA
FreeIPA is planning to required a minimal security strength factor (ssf)
in an upcoming version. This basically means that communication should
be encrypted. The most straight forward way is use TLS by doing a
StartLS operation after the rootDSE lookup. Since FreeIPA supports TLS
since the initial release we will call StartTLS unconditionally but try
without if it fails.
Resolves: https://gitlab.freedesktop.org/realmd/realmd/-/issues/23
---
service/realm-disco-rootdse.c | 23 +++++++++++++++++++++++
service/realm-ldap.c | 4 +++-
2 files changed, 26 insertions(+), 1 deletion(-)
diff --git a/service/realm-disco-rootdse.c b/service/realm-disco-rootdse.c
index 3100650..7614071 100644
--- a/service/realm-disco-rootdse.c
+++ b/service/realm-disco-rootdse.c
@@ -226,10 +226,33 @@ request_domain_info (GTask *task,
LDAP *ldap)
{
const char *attrs[] = { "info", "associatedDomain", NULL };
+ int ret;
+ int ldap_opt_val;
clo->request = NULL;
clo->result = result_domain_info;
+ /* Trying to setup a TLS tunnel in the case the IPA server requires an
+ * encrypted connected. Trying without in case of an error. Since we
+ * most probably do not have the IPA CA certificate we will not check
+ * the server certificate. */
+ ldap_opt_val = LDAP_OPT_X_TLS_NEVER;
+ ret = ldap_set_option (ldap, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_opt_val);
+ if (ret != LDAP_OPT_SUCCESS) {
+ g_debug ("Failed to disable certificate checking, trying without");
+ }
+
+ ldap_opt_val = 0;
+ ret = ldap_set_option (ldap, LDAP_OPT_X_TLS_NEWCTX, &ldap_opt_val);
+ if (ret != LDAP_OPT_SUCCESS) {
+ g_debug ("Failed to refresh LDAP context for TLS, trying without");
+ }
+
+ ret = ldap_start_tls_s (ldap, NULL, NULL);
+ if (ret != LDAP_SUCCESS) {
+ g_debug ("Failed to setup TLS tunnel, trying without");
+ }
+
return search_ldap (task, clo, ldap, clo->default_naming_context,
LDAP_SCOPE_BASE, NULL, attrs);
}
diff --git a/service/realm-ldap.c b/service/realm-ldap.c
index 59817fb..7831b5b 100644
--- a/service/realm-ldap.c
+++ b/service/realm-ldap.c
@@ -238,7 +238,9 @@ realm_ldap_connect_anonymous (GSocketAddress *address,
if (!g_unix_set_fd_nonblocking (ls->sock, FALSE, NULL))
g_warning ("couldn't set to blocking");
- rc = ldap_init_fd (ls->sock, 1, NULL, &ls->ldap);
+ url = g_strdup_printf ("ldap://%s:%d", addrname, port);
+ rc = ldap_init_fd (ls->sock, 1, url, &ls->ldap);
+ g_free (url);
g_free (native);
--
2.26.2

32
0002-configure-do-not-inherit-DISTRO-from-the-environment.patch Normal file
View File

@ -0,0 +1,32 @@
From 506887297ea33339d8ad8b274be643d220bf22f8 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Thu, 28 Nov 2019 18:51:30 +0100
Subject: [PATCH 2/7] configure: do not inherit DISTRO from the environment
The argument of the --with-distro configure option is stored in the
variable DISTRO. If DISTRO is already set in the build environment it
should not be used hence DISTRO must be cleared by the configure script
if not set by --with-distro.
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1638396
---
configure.ac | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/configure.ac b/configure.ac
index e335247..a424a49 100644
--- a/configure.ac
+++ b/configure.ac
@@ -31,7 +31,8 @@ AC_ARG_WITH([distro],
[AS_HELP_STRING([--with-distro],
[Configure for a specific distribution (eg: redhat)]
)],
- [DISTRO=$withval])
+ [DISTRO=$withval],
+ [DISTRO=])
if test -z $DISTRO; then
AC_CHECK_FILE(/etc/redhat-release, [DISTRO="redhat"])
--
2.25.1

25
0002-tools-remove-duplicated-va_start.patch Normal file
View File

@ -0,0 +1,25 @@
From 6b41b3292bb826d90fd7986e4a66b20b6fb658b3 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 28 Sep 2018 10:39:13 +0200
Subject: [PATCH 2/7] tools: remove duplicated va_start()
---
tools/realm.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/tools/realm.c b/tools/realm.c
index ed8ab3e..4d76a94 100644
--- a/tools/realm.c
+++ b/tools/realm.c
@@ -52,8 +52,6 @@ realm_print_error (const gchar *format,
GString *message;
va_list va;
- va_start (va, format);
-
message = g_string_new ("");
g_string_append_printf (message, "%s: ", g_get_prgname ());
--
2.25.1

76
0003-discover-try-to-get-domain-name-from-hostname.patch Normal file
View File

@ -0,0 +1,76 @@
From 5e28cf702ad338e399f8fff0b3fa18736a297318 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Tue, 21 Aug 2018 13:09:20 +0200
Subject: [PATCH 3/3] discover: try to get domain name from hostname
If there is no domain name returned by DHCP check if the hostname
contains a domain part and use this to discover a realm.
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1619162
---
service/realm-provider.c | 28 +++++++++++++++++++++++++++-
1 file changed, 27 insertions(+), 1 deletion(-)
diff --git a/service/realm-provider.c b/service/realm-provider.c
index d647c7a..258e8e1 100644
--- a/service/realm-provider.c
+++ b/service/realm-provider.c
@@ -28,6 +28,8 @@
#include <glib/gi18n.h>
#include <gio/gio.h>
+#include <errno.h>
+
#define TIMEOUT_SECONDS 15
G_DEFINE_TYPE (RealmProvider, realm_provider, G_TYPE_DBUS_OBJECT_SKELETON);
@@ -181,6 +183,25 @@ on_discover_complete (GObject *source,
return_discover_result (method, realms, relevance, error);
}
+static gchar *
+get_domain_from_hostname (void)
+{
+ gchar hostname[HOST_NAME_MAX + 1];
+ gchar *dot;
+
+ if (gethostname (hostname, sizeof (hostname)) < 0) {
+ g_warning ("Couldn't get the computer host name: %s", g_strerror (errno));
+ return NULL;
+ }
+
+ dot = strchr (hostname, '.');
+ if (dot != NULL) {
+ return g_strdup (dot + 1);
+ }
+
+ return NULL;
+}
+
static void
on_discover_default (GObject *source,
GAsyncResult *result,
@@ -195,6 +216,10 @@ on_discover_default (GObject *source,
g_clear_error (&error);
}
+ if (method->string == NULL) {
+ method->string = get_domain_from_hostname ();
+ }
+
if (method->string) {
g_strstrip (method->string);
if (g_str_equal (method->string, "")) {
@@ -210,7 +235,8 @@ on_discover_default (GObject *source,
on_discover_complete, method);
} else {
- realm_diagnostics_info (method->invocation, "No default domain received via DHCP");
+ realm_diagnostics_info (method->invocation,
+ "No default domain received via DHCP or given by hostname");
return_discover_result (method, NULL, 0, NULL);
}
}
--
2.17.1

75
0003-doc-extend-user-principal-section.patch Normal file
View File

@ -0,0 +1,75 @@
From d6d1ce2f8b1c81903115b018973c61fc71235b7b Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 29 Nov 2019 18:10:03 +0100
Subject: [PATCH 3/7] doc: extend user-principal section
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1643814
---
doc/manual/realm.xml | 21 +++++++++++++++++++--
doc/manual/realmd.conf.xml | 15 ++++++++++-----
2 files changed, 29 insertions(+), 7 deletions(-)
diff --git a/doc/manual/realm.xml b/doc/manual/realm.xml
index 7b73331..55a7640 100644
--- a/doc/manual/realm.xml
+++ b/doc/manual/realm.xml
@@ -238,10 +238,27 @@ $ realm join --user=admin --computer-ou=OU=Special domain.example.com
</varlistentry>
<varlistentry>
<term><option>--user-principal=<parameter>host/name@REALM</parameter></option></term>
- <listitem><para>Set the userPrincipalName field of the
+ <listitem><para>Set the
+ <option>userPrincipalName</option> field of the
computer account to this kerberos principal. If you omit
the value for this option, then a principal will be set
- in the form of <literal>host/shortname@REALM</literal></para></listitem>
+ based on the defaults of the membership software.</para>
+ <para>AD makes a distinction between user and service
+ principals. Only with user principals you can request a
+ Kerberos Ticket-Granting-Ticket (TGT), i.e. only user
+ principals can be used with the <command>kinit</command>
+ command. By default the user principal and the canonical
+ principal name of an AD computer account is
+ <code>shortname$@AD.DOMAIN</code>, where shortname is
+ the NetBIOS name which is limited to 15 characters.</para>
+ <para>If there are applications which are not aware of
+ the AD default and are using a hard-coded default
+ principal the <option>--user-principal</option> can be
+ used to make AD aware of this principal. Please note
+ that <option>userPrincipalName</option> is a single
+ value LDAP attribute, i.e. only one alternative user
+ principal besides the AD default user principal can be
+ set.</para></listitem>
</varlistentry>
<varlistentry>
<term><option>--os-name=xxx</option></term>
diff --git a/doc/manual/realmd.conf.xml b/doc/manual/realmd.conf.xml
index f0b0879..a26a60c 100644
--- a/doc/manual/realmd.conf.xml
+++ b/doc/manual/realmd.conf.xml
@@ -365,12 +365,17 @@ computer-name = SERVER01
</listitem>
</varlistentry>
<varlistentry>
- <term><option>user-prinicpal</option></term>
+ <term><option>user-principal</option></term>
<listitem>
- <para>Set the <option>user-prinicpal</option> to <code>yes</code>
- to create <option>userPrincipalName</option> attributes for the
- computer account in the realm, in the form
- <code>host/computer@REALM</code></para>
+ <para>Set the <option>user-principal</option> to <code>yes</code>
+ to create <option>userPrincipalName</option> attribute for the
+ computer accounts in the realm. The exact value depends on the
+ defaults of the used membership software. To have full control
+ over the value please use the
+ <option>--user-principal</option> option of the
+ <command>realm</command> command, see
+ <citerefentry><refentrytitle>realm</refentrytitle>
+ <manvolnum>8</manvolnum></citerefentry> for details.</para>
<informalexample>
<programlisting language="js">
--
2.25.1

33
0003-service-remove-dead-code.patch Normal file
View File

@ -0,0 +1,33 @@
From 4cd0cc0ace4a346444dd34e7f3c6a23fd654fef4 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 28 Sep 2018 11:00:13 +0200
Subject: [PATCH 3/7] service: remove dead code
---
service/realm-samba.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/service/realm-samba.c b/service/realm-samba.c
index 5cf2aa8..e2a3608 100644
--- a/service/realm-samba.c
+++ b/service/realm-samba.c
@@ -180,7 +180,6 @@ on_join_do_winbind (GObject *source,
GTask *task = G_TASK (user_data);
EnrollClosure *enroll = g_task_get_task_data (task);
RealmSamba *self = g_task_get_source_object (task);
- GHashTable *settings = NULL;
GError *error = NULL;
const gchar *name;
const gchar *computer_name;
@@ -215,8 +214,6 @@ on_join_do_winbind (GObject *source,
g_task_return_error (task, error);
}
- if (settings)
- g_hash_table_unref (settings);
g_object_unref (task);
}
--
2.25.1

32
0003-service-use-net-ads-join-with-k-for-user-join-as-wel.patch Normal file
View File

@ -0,0 +1,32 @@
From f5a5b00033a3d9d55cb8661d1cf5e63facc1ea72 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Tue, 11 Aug 2020 11:18:17 +0200
Subject: [PATCH 3/4] service: use net ads join with -k for user join as well
The NTLM authentication used by 'net ads join' does only support crypto
algorithms which e.g. are not allowed by FIPS. It would be better to
tell 'net ads join' to try Kerberos first before falling back to NTLM by
adding the '-k' option.
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1859503
---
service/realm-samba-enroll.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/service/realm-samba-enroll.c b/service/realm-samba-enroll.c
index f5edca3..3f86c51 100644
--- a/service/realm-samba-enroll.c
+++ b/service/realm-samba-enroll.c
@@ -372,7 +372,8 @@ begin_join (GTask *task,
} else if (join->user_name) {
begin_net_process (join, join->password_input,
on_join_do_keytab, g_object_ref (task),
- "-U", join->user_name, "ads", "join", join->disco->domain_name,
+ "-U", join->user_name,
+ "-k", "ads", "join", join->disco->domain_name,
join->join_args[0], join->join_args[1],
join->join_args[2], join->join_args[3],
join->join_args[4], NULL);
--
2.26.2

26
0004-doc-fix-discover-name-only.patch Normal file
View File

@ -0,0 +1,26 @@
From 878e40f5a3b50d37a0ed981a4f0872a9d5d99e6b Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 29 Nov 2019 18:49:15 +0100
Subject: [PATCH 4/7] doc: fix discover name-only
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1625001
---
doc/manual/realmd.conf.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/doc/manual/realmd.conf.xml b/doc/manual/realmd.conf.xml
index a26a60c..fc6a785 100644
--- a/doc/manual/realmd.conf.xml
+++ b/doc/manual/realmd.conf.xml
@@ -308,7 +308,7 @@ DOMAIN\user:*:13445:13446:Name:/home/DOMAIN/user:/bin/bash
<informalexample>
<screen>
-$ <command>realm discover --name DOMAIN.example.com</command>
+$ <command>realm discover --name-only DOMAIN.example.com</command>
domain.example.com
...
</screen>
--
2.25.1

36
0004-service-check-return-value-of-fcntl.patch Normal file
View File

@ -0,0 +1,36 @@
From f4636827818d514ebc2f73df2a55b22e7bc8ab89 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 28 Sep 2018 11:00:30 +0200
Subject: [PATCH 4/7] service: check return value of fcntl()
---
service/realm-command.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/service/realm-command.c b/service/realm-command.c
index 2fe02ab..5257caa 100644
--- a/service/realm-command.c
+++ b/service/realm-command.c
@@ -361,6 +361,7 @@ on_unix_process_child_setup (gpointer user_data)
int *child_fds = user_data;
long val;
guint i;
+ int ret;
/*
* Become a process leader in order to close the controlling terminal.
@@ -378,7 +379,10 @@ on_unix_process_child_setup (gpointer user_data)
for (i = 0; i < NUM_FDS; i++) {
if (child_fds[i] >= 0) {
val = fcntl (child_fds[i], F_GETFD);
- fcntl (child_fds[i], F_SETFD, val & ~FD_CLOEXEC);
+ ret = fcntl (child_fds[i], F_SETFD, val & ~FD_CLOEXEC);
+ if (ret != 0) {
+ /* ignore */
+ }
}
}
}
--
2.25.1

167
0004-service-use-additional-dns-hostnames-with-net-ads-jo.patch Normal file
View File

@ -0,0 +1,167 @@
From a49994ab4ac36ff39a1e24a228e57a5269bf8fdf Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Wed, 12 Aug 2020 12:58:27 +0200
Subject: [PATCH 4/4] service: use 'additional dns hostnames' with net ads join
With newer versions of Samba the net ads join does not add services
principals with the configured host name anymore but added the new
option 'additional dns hostnames' for this.
realmd will try to figure out a fully-qualified host name and use it
with the new option if it is from a different domain.
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1867912
---
service/realm-disco.c | 1 +
service/realm-disco.h | 1 +
service/realm-samba-enroll.c | 57 +++++++++++++++++++++++++++++++++++-
service/realm-samba.c | 6 ++++
4 files changed, 64 insertions(+), 1 deletion(-)
diff --git a/service/realm-disco.c b/service/realm-disco.c
index ab06939..a12be50 100644
--- a/service/realm-disco.c
+++ b/service/realm-disco.c
@@ -62,6 +62,7 @@ realm_disco_unref (gpointer data)
g_free (disco->explicit_netbios);
g_free (disco->kerberos_realm);
g_free (disco->workgroup);
+ g_free (disco->dns_fqdn);
if (disco->server_address)
g_object_unref (disco->server_address);
g_free (disco);
diff --git a/service/realm-disco.h b/service/realm-disco.h
index 5f3e5e9..35532d2 100644
--- a/service/realm-disco.h
+++ b/service/realm-disco.h
@@ -30,6 +30,7 @@ typedef struct {
gchar *explicit_server;
gchar *explicit_netbios;
GSocketAddress *server_address;
+ gchar *dns_fqdn;
} RealmDisco;
#define REALM_TYPE_DISCO (realm_disco_get_type ())
diff --git a/service/realm-samba-enroll.c b/service/realm-samba-enroll.c
index 3f86c51..5624a08 100644
--- a/service/realm-samba-enroll.c
+++ b/service/realm-samba-enroll.c
@@ -33,6 +33,9 @@
#include <errno.h>
#include <fcntl.h>
#include <string.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netdb.h>
typedef struct {
GDBusMethodInvocation *invocation;
@@ -81,6 +84,44 @@ fallback_workgroup (const gchar *realm)
return g_utf8_strup (realm, pos - realm);
}
+static char *
+try_to_get_fqdn (void)
+{
+ char hostname[HOST_NAME_MAX + 1];
+ gchar *fqdn = NULL;
+ int ret;
+ struct addrinfo *res;
+ struct addrinfo hints;
+
+ ret = gethostname (hostname, sizeof (hostname));
+ if (ret < 0) {
+ return NULL;
+ }
+
+ if (strchr (hostname, '.') == NULL) {
+ memset (&hints, 0, sizeof (struct addrinfo));
+ hints.ai_socktype = SOCK_DGRAM;
+ hints.ai_flags = AI_CANONNAME;
+
+ ret = getaddrinfo (hostname, NULL, &hints, &res);
+ if (ret != 0) {
+ return NULL;
+ }
+
+ /* Only use a fully-qualified name */
+ if (strchr (res->ai_canonname, '.') != NULL) {
+ fqdn = g_strdup (res->ai_canonname);
+ }
+
+ freeaddrinfo (res);
+
+ } else {
+ fqdn = g_strdup (hostname);
+ }
+
+ return fqdn;
+}
+
static JoinClosure *
join_closure_init (GTask *task,
RealmDisco *disco,
@@ -95,6 +136,8 @@ join_closure_init (GTask *task,
const gchar *explicit_computer_name = NULL;
const gchar *authid = NULL;
gchar *name_from_keytab = NULL;
+ gchar *fqdn = NULL;
+ gchar *fqdn_dom = NULL;
join = g_new0 (JoinClosure, 1);
join->disco = realm_disco_ref (disco);
@@ -124,7 +167,7 @@ join_closure_init (GTask *task,
"netbios name", authid,
NULL);
- /*
+ /*
* Samba complains if we don't set a 'workgroup' setting for the realm we're
* going to join. If we didn't yet manage to lookup the workgroup, then go ahead
* and assume that the first domain component is the workgroup name.
@@ -144,6 +187,18 @@ join_closure_init (GTask *task,
g_free (workgroup);
}
+ /* Add the fully-qualified DNS hostname as additional name if it is from
+ * a different domain. */
+ fqdn = try_to_get_fqdn ();
+ if (fqdn != NULL && join->disco->domain_name != NULL
+ && (fqdn_dom = strchr (fqdn, '.')) != NULL
+ && g_ascii_strcasecmp (fqdn_dom + 1, join->disco->domain_name) != 0 ) {
+ disco->dns_fqdn = g_strdup (fqdn);
+ realm_ini_config_set (join->config, REALM_SAMBA_CONFIG_GLOBAL,
+ "additional dns hostnames", disco->dns_fqdn, NULL);
+ }
+ g_free (fqdn);
+
/* Write out the config file for use by various net commands */
join->custom_smb_conf = g_build_filename (g_get_tmp_dir (), "realmd-smb-conf.XXXXXX", NULL);
temp_fd = g_mkstemp_full (join->custom_smb_conf, O_WRONLY, S_IRUSR | S_IWUSR);
diff --git a/service/realm-samba.c b/service/realm-samba.c
index 4940b38..fe33600 100644
--- a/service/realm-samba.c
+++ b/service/realm-samba.c
@@ -204,6 +204,11 @@ on_join_do_winbind (GObject *source,
NULL);
}
+ if (error == NULL && enroll->disco->dns_fqdn != NULL) {
+ realm_ini_config_change (self->config, REALM_SAMBA_CONFIG_GLOBAL, &error,
+ "additional dns hostnames", enroll->disco->dns_fqdn,
+ NULL);
+ }
if (error == NULL) {
name = realm_kerberos_get_name (REALM_KERBEROS (self));
@@ -364,6 +369,7 @@ leave_deconfigure_begin (RealmSamba *self,
if (!realm_ini_config_change (self->config, REALM_SAMBA_CONFIG_GLOBAL, &error,
"workgroup", NULL,
"realm", NULL,
+ "additional dns hostnames", NULL,
"security", "user",
NULL)) {
g_task_return_error (task, error);
--
2.26.2

46
0005-doc-add-see-also-to-man-pages.patch Normal file
View File

@ -0,0 +1,46 @@
From 799821650c538754aae842d400df75d3bd8864bf Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 29 Nov 2019 18:49:51 +0100
Subject: [PATCH 5/7] doc: add see also to man pages
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1625001
---
doc/manual/realm.xml | 7 +++++++
doc/manual/realmd.conf.xml | 7 +++++++
2 files changed, 14 insertions(+)
diff --git a/doc/manual/realm.xml b/doc/manual/realm.xml
index 55a7640..e5d4608 100644
--- a/doc/manual/realm.xml
+++ b/doc/manual/realm.xml
@@ -440,4 +440,11 @@ $ realm deny --all
</refsect1>
+<refsect1 id='realm_see_also'>
+ <title>SEE ALSO</title>
+
+ <para><citerefentry><refentrytitle>realmd.conf</refentrytitle>
+ <manvolnum>5</manvolnum></citerefentry></para>
+</refsect1>
+
</refentry>
diff --git a/doc/manual/realmd.conf.xml b/doc/manual/realmd.conf.xml
index fc6a785..1592291 100644
--- a/doc/manual/realmd.conf.xml
+++ b/doc/manual/realmd.conf.xml
@@ -471,4 +471,11 @@ fully-qualified-names = no
</variablelist>
</refsect1>
+<refsect1 id='realmd_conf_see_also'>
+ <title>SEE ALSO</title>
+
+ <para><citerefentry><refentrytitle>realm</refentrytitle>
+ <manvolnum>8</manvolnum></citerefentry></para>
+</refsect1>
+
</refentry>
--
2.25.1

39
0005-service-avoid-dereference-of-a-null-pointer.patch Normal file
View File

@ -0,0 +1,39 @@
From 7a1711b180a746ba574bdbfc814ec706a474cda8 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 28 Sep 2018 11:07:03 +0200
Subject: [PATCH 5/7] service: avoid dereference of a null pointer
---
service/realm-kerberos.c | 2 +-
service/realm-provider.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c
index 252e256..a8b3553 100644
--- a/service/realm-kerberos.c
+++ b/service/realm-kerberos.c
@@ -720,7 +720,7 @@ realm_kerberos_get_disco (RealmKerberos *self)
if (!disco->kerberos_realm)
disco->kerberos_realm = g_strdup (realm_kerberos_get_realm_name (self));
klass = REALM_KERBEROS_GET_CLASS (self);
- if (klass->discover_myself)
+ if (klass && klass->discover_myself)
(klass->discover_myself) (self, disco);
self->pv->disco = disco;
}
diff --git a/service/realm-provider.c b/service/realm-provider.c
index 258e8e1..6d7cf96 100644
--- a/service/realm-provider.c
+++ b/service/realm-provider.c
@@ -450,7 +450,7 @@ realm_provider_get_realms (RealmProvider *self)
g_return_val_if_fail (REALM_IS_PROVIDER (self), NULL);
klass = REALM_PROVIDER_GET_CLASS (self);
- g_return_val_if_fail (klass->get_realms != NULL, NULL);
+ g_return_val_if_fail (klass != NULL && klass->get_realms != NULL, NULL);
return (klass->get_realms) (self);
}
--
2.25.1

104
0006-doc-extend-description-of-config-handling.patch Normal file
View File

@ -0,0 +1,104 @@
From 98a69ca00e3441128b181b59c06bb06e8c362360 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 29 Nov 2019 21:57:02 +0100
Subject: [PATCH 6/7] doc: extend description of config handling
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1625005
---
doc/manual/Makefile.am | 8 ++++++++
doc/manual/realmd.conf.xml | 15 +++++++++++----
doc/privatedir.xml.in | 1 +
4 files changed, 21 insertions(+), 4 deletions(-)
create mode 100644 doc/privatedir.xml.in
diff --git a/doc/manual/Makefile.am b/doc/manual/Makefile.am
index 8b33fdd..9812c45 100644
--- a/doc/manual/Makefile.am
+++ b/doc/manual/Makefile.am
@@ -1,14 +1,20 @@
+XSLTPROC_FLAGS = --path $(abs_builddir):$(abs_srcdir):$(abs_builddir)/doc
man8_MANS += \
doc/manual/realm.8
man5_MANS += \
doc/manual/realmd.conf.5
+$(man5_MANS): doc/privatedir.xml
+
MAN_IN_FILES = \
$(man8_MANS:.8=.xml) \
$(man5_MANS:.5=.xml) \
$(NULL)
+doc/privatedir.xml: doc/privatedir.xml.in
+ $(V_SED) $(MKDIR_P) $(dir $@) && $(SED_SUBST) $< > $@
+
MANUAL_DOCBOOK = doc/manual/realmd-docs.xml
MANUAL_INCLUDES = \
@@ -41,6 +47,7 @@ MANUAL_XSLT = \
$(NULL)
EXTRA_DIST += \
+ doc/privatedir.xml.in \
$(MANUAL_DOCBOOK) \
$(MANUAL_INCLUDES) \
$(MAN_IN_FILES) \
@@ -50,6 +57,7 @@ EXTRA_DIST += \
CLEANFILES += \
realmd-org.freedesktop.realmd.generated \
+ doc/privatedir.xml \
$(DBUS_DOC_GENERATED) \
$(DBUS_ESCAPED) \
$(man8_MANS) \
diff --git a/doc/manual/realmd.conf.xml b/doc/manual/realmd.conf.xml
index 1592291..9062252 100644
--- a/doc/manual/realmd.conf.xml
+++ b/doc/manual/realmd.conf.xml
@@ -1,6 +1,9 @@
<?xml version='1.0'?>
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
+[
+<!ENTITY privatedir SYSTEM "privatedir.xml">
+]>
<refentry id="realmd-conf">
@@ -35,7 +38,9 @@
to act in specific ways. This is done by placing settings in a
<filename>/etc/realmd.conf</filename>. This file does not exist by
default. The syntax of this file is the same as an INI file or
- Desktop Entry file.</para>
+ Desktop Entry file. If the file is changed and
+ <command>realmd</command> is running <command>realmd</command> must be
+ restarted to read the new values.</para>
<para>In general, settings in this file only apply at the point of
joining a domain or realm. Once the realm has been setup the settings
@@ -46,8 +51,10 @@
<para>Only specify the settings you wish to override in the
<filename>/etc/realmd.conf</filename> file. Settings not specified will
- be loaded from their packaged defaults. Only override the settings
- below. You may find other settings if you look through the
+ be loaded from their packaged defaults which can be found in
+ <filename>&privatedir;/realmd-defaults.conf</filename> and
+ <filename>&privatedir;/realmd-distro.conf</filename>. Only override the
+ settings below. You may find other settings if you look through the
<command>realmd</command> source code. However these are not guaranteed
to remain stable.</para>
diff --git a/doc/privatedir.xml.in b/doc/privatedir.xml.in
new file mode 100644
index 0000000..7f71afe
--- /dev/null
+++ b/doc/privatedir.xml.in
@@ -0,0 +1 @@
+@privatedir@
\ No newline at end of file
--
2.25.1

24
0006-service-avoid-dereferencing-a-NULL-pointer.patch Normal file
View File

@ -0,0 +1,24 @@
From 9675cc5b6318f848ddf7237d50d02606e16d8003 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 28 Sep 2018 11:17:07 +0200
Subject: [PATCH 6/7] service: avoid dereferencing a NULL pointer
---
service/realm-kerberos.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c
index a8b3553..3294932 100644
--- a/service/realm-kerberos.c
+++ b/service/realm-kerberos.c
@@ -251,6 +251,7 @@ is_credential_supported (RealmKerberosMembershipIface *iface,
gboolean found = FALSE;
gint i;
+ g_assert (iface != NULL);
g_assert (iface->join_creds != NULL);
g_assert (iface->leave_creds != NULL);
--
2.25.1

30
0007-service-use-kerberos-method-secrets-and-keytab.patch Normal file
View File

@ -0,0 +1,30 @@
From 517fa766782421302da827278ca17e6b2ad57da3 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 21 Feb 2020 14:06:16 +0100
Subject: [PATCH 7/7] service: use "kerberos method" "secrets and keytab"
When using Samba with Winbind the host password stored in secrets.tdb is
still important so the "secrets and keytab" should be the preferred
"kerberos method".
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1801195
---
service/realm-samba.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/service/realm-samba.c b/service/realm-samba.c
index e2a3608..4940b38 100644
--- a/service/realm-samba.c
+++ b/service/realm-samba.c
@@ -200,7 +200,7 @@ on_join_do_winbind (GObject *source,
"template shell", realm_settings_string ("users", "default-shell"),
"netbios name", computer_name,
"password server", enroll->disco->explicit_server,
- "kerberos method", "system keytab",
+ "kerberos method", "secrets and keytab",
NULL);
}
--
2.25.1

894
computer-ou.patch Normal file
View File

@ -0,0 +1,894 @@
From 3db35ad73ec57c8af499a0dcef96ffd4da914236 Mon Sep 17 00:00:00 2001
From: Stef Walter <stefw@redhat.com>
Date: Mon, 7 Sep 2015 13:49:10 +0200
Subject: [PATCH 2/2] service: Fully qualify --computer-ou DN before passing to
adcli
This allows us to have a similar behavior for both the Samba and
adcli membership software.
---
service/Makefile.am | 4 +-
service/realm-adcli-enroll.c | 11 +-
service/realm-dn-util.c | 239 +++++++++++++++++++++++++++++++++++++++++++
service/realm-dn-util.h | 32 ++++++
service/realm-samba-enroll.c | 4 +-
service/realm-samba-util.c | 172 -------------------------------
service/realm-samba-util.h | 29 ------
tests/Makefile.am | 16 +--
tests/test-dn-util.c | 129 +++++++++++++++++++++++
tests/test-samba-ou-format.c | 89 ----------------
11 files changed, 422 insertions(+), 305 deletions(-)
create mode 100644 service/realm-dn-util.c
create mode 100644 service/realm-dn-util.h
delete mode 100644 service/realm-samba-util.c
delete mode 100644 service/realm-samba-util.h
create mode 100644 tests/test-dn-util.c
delete mode 100644 tests/test-samba-ou-format.c
diff --git a/service/Makefile.am b/service/Makefile.am
index 06a95ef..88ee780 100644
--- a/service/Makefile.am
+++ b/service/Makefile.am
@@ -43,6 +43,8 @@ realmd_SOURCES = \
service/realm-disco-mscldap.h \
service/realm-disco-rootdse.c \
service/realm-disco-rootdse.h \
+ service/realm-dn-util.c \
+ service/realm-dn-util.h \
service/realm-errors.c \
service/realm-errors.h \
service/realm-example.c \
@@ -79,8 +81,6 @@ realmd_SOURCES = \
service/realm-samba-enroll.h \
service/realm-samba-provider.c \
service/realm-samba-provider.h \
- service/realm-samba-util.c \
- service/realm-samba-util.h \
service/realm-samba-winbind.c \
service/realm-samba-winbind.h \
service/realm-service.c \
diff --git a/service/realm-adcli-enroll.c b/service/realm-adcli-enroll.c
index 7448647..ef1b563 100644
--- a/service/realm-adcli-enroll.c
+++ b/service/realm-adcli-enroll.c
@@ -18,6 +18,7 @@
#include "realm-command.h"
#include "realm-daemon.h"
#include "realm-diagnostics.h"
+#include "realm-dn-util.h"
#include "realm-errors.h"
#include "realm-ini-config.h"
#include "realm-options.h"
@@ -82,6 +83,7 @@ realm_adcli_enroll_join_async (RealmDisco *disco,
gchar *ccache_arg = NULL;
gchar *upn_arg = NULL;
gchar *server_arg = NULL;
+ gchar *ou_arg = NULL;
g_return_if_fail (cred != NULL);
g_return_if_fail (disco != NULL);
@@ -120,9 +122,13 @@ realm_adcli_enroll_join_async (RealmDisco *disco,
}
computer_ou = realm_options_computer_ou (options, disco->domain_name);
- if (computer_ou) {
+ if (computer_ou != NULL) {
+ ou_arg = realm_dn_util_build_qualified (computer_ou, disco->domain_name);
g_ptr_array_add (args, "--computer-ou");
- g_ptr_array_add (args, (gpointer)computer_ou);
+ if (ou_arg)
+ g_ptr_array_add (args, ou_arg);
+ else
+ g_ptr_array_add (args, (gpointer)computer_ou);
}
os = realm_settings_value ("active-directory", "os-name");
@@ -190,6 +196,7 @@ realm_adcli_enroll_join_async (RealmDisco *disco,
free (ccache_arg);
free (upn_arg);
free (server_arg);
+ free (ou_arg);
}
gboolean
diff --git a/service/realm-dn-util.c b/service/realm-dn-util.c
new file mode 100644
index 0000000..85bcdb9
--- /dev/null
+++ b/service/realm-dn-util.c
@@ -0,0 +1,239 @@
+/* realmd -- Realm configuration service
+ *
+ * Copyright 2012 Red Hat Inc
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published
+ * by the Free Software Foundation; either version 2 of the licence or (at
+ * your option) any later version.
+ *
+ * See the included COPYING file for more information.
+ *
+ * Author: Stef Walter <stefw@gnome.org>
+ */
+
+#include "config.h"
+
+#include "realm-dn-util.h"
+
+#include <glib.h>
+
+#include <ldap.h>
+
+static gboolean
+berval_is_string (const struct berval *bv,
+ const gchar *string,
+ gsize length)
+{
+ return (bv->bv_len == length &&
+ g_ascii_strncasecmp (bv->bv_val, string, length) == 0);
+
+}
+
+static gboolean
+berval_case_equals (const struct berval *v1,
+ const struct berval *v2)
+{
+ return (v1->bv_len == v2->bv_len &&
+ g_ascii_strncasecmp (v1->bv_val, v2->bv_val, v1->bv_len) == 0);
+}
+
+static gboolean
+dn_equals_domain (LDAPDN dn,
+ const gchar *domain_dn_str,
+ const gchar *domain)
+{
+ LDAPDN domain_dn;
+ gboolean ret;
+ int rc;
+ gint i, j;
+
+ rc = ldap_str2dn (domain_dn_str, &domain_dn, LDAP_DN_FORMAT_LDAPV3);
+ g_return_val_if_fail (rc == LDAP_SUCCESS, FALSE);
+
+ for (i = 0; dn[i] != NULL && domain_dn[i] != NULL; i++) {
+ for (j = 0; dn[i][j] != NULL && domain_dn[i][j] != NULL; j++) {
+ if (!berval_case_equals (&(dn[i][j]->la_attr), &(domain_dn[i][j]->la_attr)) ||
+ !berval_case_equals (&(dn[i][j]->la_value), &(domain_dn[i][j]->la_value)))
+ break;
+ }
+
+ if (dn[i][j] != NULL && domain_dn[i][j] != NULL)
+ break;
+ }
+
+ /* Did we reach end of both DNs? */
+ ret = (dn[i] == NULL && domain_dn[i] == NULL);
+
+ ldap_dnfree (domain_dn);
+
+ return ret;
+}
+
+gchar *
+realm_dn_util_build_samba_ou (const gchar *ldap_dn,
+ const gchar *domain)
+{
+ gchar *domain_dn_str = NULL;
+ GArray *parts;
+ GString *part;
+ gchar **strv;
+ gchar *str;
+ LDAPAVA* ava;
+ gboolean ret;
+ LDAPDN dn;
+ int rc;
+ gint i, j;
+
+ /*
+ * Here we convert a standard LDAP DN to the strange samba net format,
+ * as "documented" here:
+ *
+ * createcomputer=OU Precreate the computer account in a specific OU.
+ * The OU string read from top to bottom without RDNs and delimited by a '/'.
+ * E.g. "createcomputer=Computers/Servers/Unix"
+ * NB: A backslash '\' is used as escape at multiple levels and may
+ * need to be doubled or even quadrupled. It is not used as a separator.
+ */
+
+ /* ldap_str2dn doesn't like empty strings */
+ while (g_ascii_isspace (ldap_dn[0]))
+ ldap_dn++;
+ if (g_str_equal (ldap_dn, ""))
+ return NULL;
+
+ rc = ldap_str2dn (ldap_dn, &dn, LDAP_DN_FORMAT_LDAPV3);
+ if (rc != LDAP_SUCCESS)
+ return NULL;
+
+ ret = TRUE;
+ parts = g_array_new (TRUE, TRUE, sizeof (gchar *));
+
+ for (i = 0; dn[i] != NULL; i++) {
+ ava = dn[i][0];
+
+ /*
+ * Make sure this is a valid DN, we only support one value per
+ * RDN, string values, and must be an OU. DC values are allowed
+ * but only at the end of the DN.
+ */
+
+ if (ava == NULL || dn[i][1] != NULL || !(ava->la_flags & LDAP_AVA_STRING)) {
+ ret = FALSE;
+ break;
+
+ /* A DC, remainder must match the domain */
+ } else if (berval_is_string (&ava->la_attr, "DC", 2)) {
+ rc = ldap_domain2dn (domain, &domain_dn_str);
+ if (rc != LDAP_SUCCESS)
+ ret = FALSE;
+ else
+ ret = dn_equals_domain (dn + i, domain_dn_str, domain);
+ break;
+
+ /* An OU, include */
+ } else if (berval_is_string (&ava->la_attr, "OU", 2)) {
+ part = g_string_sized_new (ava->la_value.bv_len);
+ for (j = 0; j < ava->la_value.bv_len; j++) {
+ switch (ava->la_value.bv_val[j]) {
+ case '\\':
+ g_string_append (part, "\\\\");
+ break;
+ case '/':
+ g_string_append (part, "\\/");
+ break;
+ default:
+ g_string_append_c (part, ava->la_value.bv_val[j]);
+ break;
+ }
+ }
+ str = g_string_free (part, FALSE);
+ g_array_insert_val (parts, 0, str);
+
+ /* Invalid, stop */
+ } else {
+ ret = FALSE;
+ break;
+ }
+ }
+
+ ldap_dnfree (dn);
+ if (domain_dn_str)
+ ldap_memfree (domain_dn_str);
+
+ strv = (gchar **)g_array_free (parts, FALSE);
+ str = NULL;
+
+ /* Loop completed successfully */
+ if (ret)
+ str = g_strjoinv ("/", strv);
+
+ g_strfreev (strv);
+
+ return str;
+}
+
+gchar *
+realm_dn_util_build_qualified (const gchar *ldap_dn,
+ const gchar *domain)
+{
+ gchar *domain_dn_str = NULL;
+ gboolean had_dc = FALSE;
+ gchar *str;
+ LDAPAVA* ava;
+ gboolean ret;
+ LDAPDN dn;
+ int rc;
+ gint i;
+
+ /* ldap_str2dn doesn't like empty strings */
+ while (g_ascii_isspace (ldap_dn[0]))
+ ldap_dn++;
+ if (g_str_equal (ldap_dn, ""))
+ return NULL;
+
+ rc = ldap_str2dn (ldap_dn, &dn, LDAP_DN_FORMAT_LDAPV3);
+ if (rc != LDAP_SUCCESS)
+ return NULL;
+
+ rc = ldap_domain2dn (domain, &domain_dn_str);
+ if (rc != LDAP_SUCCESS) {
+ ldap_dnfree (dn);
+ return NULL;
+ }
+
+ ret = TRUE;
+
+ for (i = 0; dn[i] != NULL; i++) {
+ ava = dn[i][0];
+
+ /*
+ * Make sure this is a valid DN, we only support one value per
+ * RDN, string values. DC values are allowed but only at the end of the DN.
+ */
+
+ if (ava == NULL || dn[i][1] != NULL || !(ava->la_flags & LDAP_AVA_STRING)) {
+ ret = FALSE;
+ break;
+
+ /* A DC, remainder must match the domain */
+ } else if (berval_is_string (&ava->la_attr, "DC", 2)) {
+ had_dc = TRUE;
+ ret = dn_equals_domain (dn + i, domain_dn_str, domain);
+ break;
+ }
+ }
+
+ ldap_dnfree (dn);
+
+ if (!ret)
+ return NULL;
+
+ if (had_dc)
+ str = g_strdup (ldap_dn);
+ else
+ str = g_strdup_printf ("%s,%s", ldap_dn, domain_dn_str);
+
+ ldap_memfree (domain_dn_str);
+ return str;
+}
diff --git a/service/realm-dn-util.h b/service/realm-dn-util.h
new file mode 100644
index 0000000..f5e5e69
--- /dev/null
+++ b/service/realm-dn-util.h
@@ -0,0 +1,32 @@
+/* realmd -- Realm configuration service
+ *
+ * Copyright 2012 Red Hat Inc
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published
+ * by the Free Software Foundation; either version 2 of the licence or (at
+ * your option) any later version.
+ *
+ * See the included COPYING file for more information.
+ *
+ * Author: Stef Walter <stefw@gnome.org>
+ */
+
+#include "config.h"
+
+#ifndef __REALM_DN_UTIL_H__
+#define __REALM_DN_UTIL_H__
+
+#include <gio/gio.h>
+
+G_BEGIN_DECLS
+
+gchar * realm_dn_util_build_samba_ou (const gchar *ldap_dn,
+ const gchar *domain);
+
+gchar * realm_dn_util_build_qualified (const gchar *ldap_dn,
+ const gchar *domain);
+
+G_END_DECLS
+
+#endif /* __REALM_DN_UTIL_H__ */
diff --git a/service/realm-samba-enroll.c b/service/realm-samba-enroll.c
index e8739d7..e749764 100644
--- a/service/realm-samba-enroll.c
+++ b/service/realm-samba-enroll.c
@@ -18,12 +18,12 @@
#include "realm-daemon.h"
#include "realm-dbus-constants.h"
#include "realm-diagnostics.h"
+#include "realm-dn-util.h"
#include "realm-errors.h"
#include "realm-options.h"
#include "realm-samba-config.h"
#include "realm-samba-enroll.h"
#include "realm-samba-provider.h"
-#include "realm-samba-util.h"
#include "realm-settings.h"
#include <glib/gstdio.h>
@@ -314,7 +314,7 @@ begin_join (GTask *task,
computer_ou = realm_options_computer_ou (options, join->disco->domain_name);
if (computer_ou != NULL) {
- strange_ou = realm_samba_util_build_strange_ou (computer_ou, join->disco->domain_name);
+ strange_ou = realm_dn_util_build_samba_ou (computer_ou, join->disco->domain_name);
if (strange_ou) {
if (!g_str_equal (strange_ou, ""))
join->join_args[at++] = g_strdup_printf ("createcomputer=%s", strange_ou);
diff --git a/service/realm-samba-util.c b/service/realm-samba-util.c
deleted file mode 100644
index 3f6a53e..0000000
--- a/service/realm-samba-util.c
+++ /dev/null
@@ -1,172 +0,0 @@
-/* realmd -- Realm configuration service
- *
- * Copyright 2012 Red Hat Inc
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published
- * by the Free Software Foundation; either version 2 of the licence or (at
- * your option) any later version.
- *
- * See the included COPYING file for more information.
- *
- * Author: Stef Walter <stefw@gnome.org>
- */
-
-#include "config.h"
-
-#include "realm-samba-util.h"
-
-#include <glib.h>
-
-#include <ldap.h>
-
-static gboolean
-berval_is_string (const struct berval *bv,
- const gchar *string,
- gsize length)
-{
- return (bv->bv_len == length &&
- g_ascii_strncasecmp (bv->bv_val, string, length) == 0);
-
-}
-
-static gboolean
-berval_case_equals (const struct berval *v1,
- const struct berval *v2)
-{
- return (v1->bv_len == v2->bv_len &&
- g_ascii_strncasecmp (v1->bv_val, v2->bv_val, v1->bv_len) == 0);
-}
-
-static gboolean
-dn_equals_domain (LDAPDN dn,
- const gchar *domain)
-{
- LDAPDN domain_dn;
- gchar *domain_dn_str;
- gboolean ret;
- int rc;
- gint i, j;
-
- rc = ldap_domain2dn (domain, &domain_dn_str);
- g_return_val_if_fail (rc == LDAP_SUCCESS, FALSE);
-
- rc = ldap_str2dn (domain_dn_str, &domain_dn, LDAP_DN_FORMAT_LDAPV3);
- g_return_val_if_fail (rc == LDAP_SUCCESS, FALSE);
-
- ldap_memfree (domain_dn_str);
-
- for (i = 0; dn[i] != NULL && domain_dn[i] != NULL; i++) {
- for (j = 0; dn[i][j] != NULL && domain_dn[i][j] != NULL; j++) {
- if (!berval_case_equals (&(dn[i][j]->la_attr), &(domain_dn[i][j]->la_attr)) ||
- !berval_case_equals (&(dn[i][j]->la_value), &(domain_dn[i][j]->la_value)))
- break;
- }
-
- if (dn[i][j] != NULL && domain_dn[i][j] != NULL)
- break;
- }
-
- /* Did we reach end of both DNs? */
- ret = (dn[i] == NULL && domain_dn[i] == NULL);
-
- ldap_dnfree (domain_dn);
-
- return ret;
-}
-
-gchar *
-realm_samba_util_build_strange_ou (const gchar *ldap_dn,
- const gchar *domain)
-{
- GArray *parts;
- GString *part;
- gchar **strv;
- gchar *str;
- LDAPAVA* ava;
- gboolean ret;
- LDAPDN dn;
- int rc;
- gint i, j;
-
- /*
- * Here we convert a standard LDAP DN to the strange samba net format,
- * as "documented" here:
- *
- * createcomputer=OU Precreate the computer account in a specific OU.
- * The OU string read from top to bottom without RDNs and delimited by a '/'.
- * E.g. "createcomputer=Computers/Servers/Unix"
- * NB: A backslash '\' is used as escape at multiple levels and may
- * need to be doubled or even quadrupled. It is not used as a separator.
- */
-
- /* ldap_str2dn doesn't like empty strings */
- while (g_ascii_isspace (ldap_dn[0]))
- ldap_dn++;
- if (g_str_equal (ldap_dn, ""))
- return NULL;
-
- rc = ldap_str2dn (ldap_dn, &dn, LDAP_DN_FORMAT_LDAPV3);
- if (rc != LDAP_SUCCESS)
- return NULL;
-
- ret = TRUE;
- parts = g_array_new (TRUE, TRUE, sizeof (gchar *));
-
- for (i = 0; dn[i] != NULL; i++) {
- ava = dn[i][0];
-
- /*
- * Make sure this is a valid DN, we only support one value per
- * RDN, string values, and must be an OU. DC values are allowed
- * but only at the end of the DN.
- */
-
- if (ava == NULL || dn[i][1] != NULL || !(ava->la_flags & LDAP_AVA_STRING)) {
- ret = FALSE;
- break;
-
- /* A DC, remainder must match the domain */
- } else if (berval_is_string (&ava->la_attr, "DC", 2)) {
- ret = dn_equals_domain (dn + i, domain);
- break;
-
- /* An OU, include */
- } else if (berval_is_string (&ava->la_attr, "OU", 2)) {
- part = g_string_sized_new (ava->la_value.bv_len);
- for (j = 0; j < ava->la_value.bv_len; j++) {
- switch (ava->la_value.bv_val[j]) {
- case '\\':
- g_string_append (part, "\\\\");
- break;
- case '/':
- g_string_append (part, "\\/");
- break;
- default:
- g_string_append_c (part, ava->la_value.bv_val[j]);
- break;
- }
- }
- str = g_string_free (part, FALSE);
- g_array_insert_val (parts, 0, str);
-
- /* Invalid, stop */
- } else {
- ret = FALSE;
- break;
- }
- }
-
- ldap_dnfree (dn);
-
- strv = (gchar **)g_array_free (parts, FALSE);
- str = NULL;
-
- /* Loop completed successfully */
- if (ret)
- str = g_strjoinv ("/", strv);
-
- g_strfreev (strv);
-
- return str;
-}
diff --git a/service/realm-samba-util.h b/service/realm-samba-util.h
deleted file mode 100644
index 2a680e7..0000000
--- a/service/realm-samba-util.h
+++ /dev/null
@@ -1,29 +0,0 @@
-/* realmd -- Realm configuration service
- *
- * Copyright 2012 Red Hat Inc
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published
- * by the Free Software Foundation; either version 2 of the licence or (at
- * your option) any later version.
- *
- * See the included COPYING file for more information.
- *
- * Author: Stef Walter <stefw@gnome.org>
- */
-
-#include "config.h"
-
-#ifndef __REALM_SAMBA_UTIL_H__
-#define __REALM_SAMBA_UTIL_H__
-
-#include <gio/gio.h>
-
-G_BEGIN_DECLS
-
-gchar * realm_samba_util_build_strange_ou (const gchar *ldap_dn,
- const gchar *suffix_dn);
-
-G_END_DECLS
-
-#endif /* __REALM_SAMBA_UTIL_H__ */
diff --git a/tests/Makefile.am b/tests/Makefile.am
index ddeba4d..3b05066 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -12,11 +12,11 @@ TEST_LIBS = \
$(GLIB_LIBS)
TEST_PROGS = \
+ test-dn-util \
test-ini-config \
test-sssd-config \
test-safe-format \
test-login-name \
- test-samba-ou-format \
test-settings \
$(NULL)
@@ -27,6 +27,13 @@ noinst_PROGRAMS += \
frob-install-packages \
$(NULL)
+test_dn_util_SOURCES = \
+ tests/test-dn-util.c \
+ service/realm-dn-util.c \
+ $(NULL)
+test_dn_util_LDADD = $(TEST_LIBS)
+test_dn_util_CFLAGS = $(TEST_CFLAGS)
+
test_ini_config_SOURCES = \
tests/test-ini-config.c \
service/realm-ini-config.c \
@@ -59,13 +66,6 @@ test_login_name_SOURCES = \
test_login_name_LDADD = $(TEST_LIBS)
test_login_name_CFLAGS = $(TEST_CFLAGS)
-test_samba_ou_format_SOURCES = \
- tests/test-samba-ou-format.c \
- service/realm-samba-util.c \
- $(NULL)
-test_samba_ou_format_LDADD = $(TEST_LIBS)
-test_samba_ou_format_CFLAGS = $(TEST_CFLAGS)
-
test_settings_SOURCES = \
tests/test-settings.c \
service/realm-settings.c \
diff --git a/tests/test-dn-util.c b/tests/test-dn-util.c
new file mode 100644
index 0000000..c62a40f
--- /dev/null
+++ b/tests/test-dn-util.c
@@ -0,0 +1,129 @@
+/* realmd -- Realm configuration service
+ *
+ * Copyright 2012 Red Hat Inc
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published
+ * by the Free Software Foundation; either version 2 of the licence or (at
+ * your option) any later version.
+ *
+ * See the included COPYING file for more information.
+ *
+ * Author: Stef Walter <stefw@gnome.org>
+ */
+
+#include "config.h"
+
+#include "service/realm-dn-util.h"
+
+#include <glib/gstdio.h>
+
+#include <string.h>
+
+typedef struct {
+ const gchar *ldap_dn;
+ const gchar *domain;
+ const gchar *result;
+} Fixture;
+
+static void
+test_samba_ou_format (gconstpointer user_data)
+{
+ const Fixture *fixture = user_data;
+ gchar *result;
+
+ result = realm_dn_util_build_samba_ou (fixture->ldap_dn, fixture->domain);
+ g_assert_cmpstr (result, ==, fixture->result);
+ g_free (result);
+}
+
+static const Fixture samba_ou_fixtures[] = {
+ { "OU=One", "domain.example.com", "One" },
+ { "OU=One,ou=two", "domain.example.com", "two/One" },
+ { "Ou=One Long,OU=two", "domain.example.com", "two/One Long" },
+ { "Ou=One,OU=two, ou=Three", "domain.example.com", "Three/two/One" },
+ { "Ou=Test/Escape,Ou=Two", "domain.example.com", "Two/Test\\/Escape" },
+ { "Ou=Test\\\\Escape,Ou=Two", "domain.example.com", "Two/Test\\\\Escape" },
+ { "OU=One,DC=domain,dc=example,Dc=COM", "domain.example.com", "One" },
+ { "OU=One,OU=Two Here,DC=domain,dc=example,Dc=COM", "domain.example.com", "Two Here/One" },
+ { "OU=One,OU=Two Here,DC=invalid,Dc=COM", "domain.example.com", NULL },
+ { " ", "domain.example.com", NULL },
+ { "", "domain.example.com", NULL },
+ { "OU", "domain.example.com", NULL },
+ { "OU=One,", "domain.example.com", NULL },
+ { "CN=Unsupported", "domain.example.com", NULL },
+ { "OU=One+CN=Unsupported", "domain.example.com", NULL },
+ { "DC=radi07, DC=segad, DC=lab, DC=sjc, DC=redhat, DC=com", "radi08.segad.lab.sjc.redhat.com", NULL },
+
+};
+
+static void
+test_qualify_dn (gconstpointer user_data)
+{
+ const Fixture *fixture = user_data;
+ gchar *result;
+
+ result = realm_dn_util_build_qualified (fixture->ldap_dn, fixture->domain);
+ g_assert_cmpstr (result, ==, fixture->result);
+ g_free (result);
+}
+
+static const Fixture qualify_fixtures[] = {
+ { "OU=One", "domain.example.com", "OU=One,dc=domain,dc=example,dc=com" },
+ { "OU=One,ou=two", "domain.example.com", "OU=One,ou=two,dc=domain,dc=example,dc=com" },
+ { "Ou=One Long,OU=two", "domain.example.com", "Ou=One Long,OU=two,dc=domain,dc=example,dc=com" },
+ { "OU=One,DC=domain,dc=example,Dc=COM", "domain.example.com", "OU=One,DC=domain,dc=example,Dc=COM" },
+ { "OU=One,OU=Two Here,DC=domain,dc=example,Dc=COM", "domain.example.com", "OU=One,OU=Two Here,DC=domain,dc=example,Dc=COM" },
+ { "OU=One,OU=Two Here,DC=invalid,Dc=COM", "domain.example.com", NULL },
+ { " ", "domain.example.com", NULL },
+ { "", "domain.example.com", NULL },
+ { "OU", "domain.example.com", NULL },
+ { "OU=One,", "domain.example.com", NULL },
+ { "CN=Test", "domain.example.com", "CN=Test,dc=domain,dc=example,dc=com" },
+ { "OU=One+CN=Unsupported", "domain.example.com", NULL },
+ { "DC=radi07, DC=segad, DC=lab, DC=sjc, DC=redhat, DC=com", "radi08.segad.lab.sjc.redhat.com", NULL },
+};
+
+int
+main (int argc,
+ char **argv)
+{
+ gchar *escaped;
+ gchar *name;
+ gint i;
+
+#if !GLIB_CHECK_VERSION(2, 36, 0)
+ g_type_init ();
+#endif
+
+ g_test_init (&argc, &argv, NULL);
+ g_set_prgname ("test-dn-util");
+
+ for (i = 0; i < G_N_ELEMENTS (samba_ou_fixtures); i++) {
+ if (g_str_equal (samba_ou_fixtures[i].ldap_dn, ""))
+ escaped = g_strdup ("_empty_");
+ else
+ escaped = g_strdup (samba_ou_fixtures[i].ldap_dn);
+ g_strdelimit (escaped, ", =\\/", '_');
+ name = g_strdup_printf ("/realmd/samba-ou-format/%s", escaped);
+ g_free (escaped);
+
+ g_test_add_data_func (name, samba_ou_fixtures + i, test_samba_ou_format);
+ g_free (name);
+ }
+
+ for (i = 0; i < G_N_ELEMENTS (qualify_fixtures); i++) {
+ if (g_str_equal (qualify_fixtures[i].ldap_dn, ""))
+ escaped = g_strdup ("_empty_");
+ else
+ escaped = g_strdup (qualify_fixtures[i].ldap_dn);
+ g_strdelimit (escaped, ", =\\/", '_');
+ name = g_strdup_printf ("/realmd/qualify-dn/%s", escaped);
+ g_free (escaped);
+
+ g_test_add_data_func (name, qualify_fixtures + i, test_qualify_dn);
+ g_free (name);
+ }
+
+ return g_test_run ();
+}
diff --git a/tests/test-samba-ou-format.c b/tests/test-samba-ou-format.c
deleted file mode 100644
index 0a482ee..0000000
--- a/tests/test-samba-ou-format.c
+++ /dev/null
@@ -1,89 +0,0 @@
-/* realmd -- Realm configuration service
- *
- * Copyright 2012 Red Hat Inc
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published
- * by the Free Software Foundation; either version 2 of the licence or (at
- * your option) any later version.
- *
- * See the included COPYING file for more information.
- *
- * Author: Stef Walter <stefw@gnome.org>
- */
-
-#include "config.h"
-
-#include "service/realm-samba-util.h"
-
-#include <glib/gstdio.h>
-
-#include <string.h>
-
-typedef struct {
- const gchar *ldap_dn;
- const gchar *domain;
- const gchar *ou_format;
-} Fixture;
-
-static void
-test_samba_ou_format (gconstpointer user_data)
-{
- const Fixture *fixture = user_data;
- gchar *result;
-
- result = realm_samba_util_build_strange_ou (fixture->ldap_dn, fixture->domain);
- g_assert_cmpstr (result, ==, fixture->ou_format);
- g_free (result);
-}
-
-static const Fixture samba_ou_fixtures[] = {
- { "OU=One", "domain.example.com", "One" },
- { "OU=One,ou=two", "domain.example.com", "two/One" },
- { "Ou=One Long,OU=two", "domain.example.com", "two/One Long" },
- { "Ou=One,OU=two, ou=Three", "domain.example.com", "Three/two/One" },
- { "Ou=Test/Escape,Ou=Two", "domain.example.com", "Two/Test\\/Escape" },
- { "Ou=Test\\\\Escape,Ou=Two", "domain.example.com", "Two/Test\\\\Escape" },
- { "OU=One,DC=domain,dc=example,Dc=COM", "domain.example.com", "One" },
- { "OU=One,OU=Two Here,DC=domain,dc=example,Dc=COM", "domain.example.com", "Two Here/One" },
- { "OU=One,OU=Two Here,DC=invalid,Dc=COM", "domain.example.com", NULL },
- { " ", "domain.example.com", NULL },
- { "", "domain.example.com", NULL },
- { "OU", "domain.example.com", NULL },
- { "OU=One,", "domain.example.com", NULL },
- { "CN=Unsupported", "domain.example.com", NULL },
- { "OU=One+CN=Unsupported", "domain.example.com", NULL },
- { "DC=radi07, DC=segad, DC=lab, DC=sjc, DC=redhat, DC=com", "radi08.segad.lab.sjc.redhat.com", NULL },
-
-};
-
-int
-main (int argc,
- char **argv)
-{
- gchar *escaped;
- gchar *name;
- gint i;
-
-#if !GLIB_CHECK_VERSION(2, 36, 0)
- g_type_init ();
-#endif
-
- g_test_init (&argc, &argv, NULL);
- g_set_prgname ("test-samba-ou-format");
-
- for (i = 0; i < G_N_ELEMENTS (samba_ou_fixtures); i++) {
- if (g_str_equal (samba_ou_fixtures[i].ldap_dn, ""))
- escaped = g_strdup ("_empty_");
- else
- escaped = g_strdup (samba_ou_fixtures[i].ldap_dn);
- g_strdelimit (escaped, ", =\\/", '_');
- name = g_strdup_printf ("/realmd/samba-ou-format/%s", escaped);
- g_free (escaped);
-
- g_test_add_data_func (name, samba_ou_fixtures + i, test_samba_ou_format);
- g_free (name);
- }
-
- return g_test_run ();
-}
--
2.4.3

26
duplicate-test-path.patch Normal file
View File

@ -0,0 +1,26 @@
From ab41e2830d2f7540d58370b5f35f85c2808c1871 Mon Sep 17 00:00:00 2001
From: Stef Walter <stefw@redhat.com>
Date: Fri, 11 Sep 2015 12:32:36 +0200
Subject: [PATCH] tests: Fix duplicate test case path
GLib is now stricter about this
---
tests/test-safe-format.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tests/test-safe-format.c b/tests/test-safe-format.c
index 02aa5f1..204e10d 100644
--- a/tests/test-safe-format.c
+++ b/tests/test-safe-format.c
@@ -194,7 +194,7 @@ main (int argc,
else
escaped = g_strdup (fixtures[i].format);
g_strdelimit (escaped, " =\\/", '_');
- name = g_strdup_printf ("/realmd/safe-format/%s", escaped);
+ name = g_strdup_printf ("/realmd/safe-format/%d-%s", i, escaped);
g_free (escaped);
g_test_add_data_func (name, fixtures + i, test_safe_format_string_cb);
--
2.4.3

29
install-diagnostic.patch Normal file
View File

@ -0,0 +1,29 @@
From ef0797e5ed116a98cc074a6d4e1d1d6b6e6384db Mon Sep 17 00:00:00 2001
From: Stef Walter <stefw@redhat.com>
Date: Mon, 7 Sep 2015 12:53:02 +0200
Subject: [PATCH 1/2] service: Fix issue where diagnostics about package
install hidden
Due to the recent refactoring the diagnostics about package
installation were hidden (even when --verbose).
https://bugzilla.redhat.com/show_bug.cgi?id=1258745
---
service/realm-packages.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/service/realm-packages.c b/service/realm-packages.c
index 9da852c..321921a 100644
--- a/service/realm-packages.c
+++ b/service/realm-packages.c
@@ -615,6 +615,7 @@ realm_packages_install_async (const gchar **package_sets,
task = g_task_new (NULL, NULL, callback, user_data);
install = g_new0 (InstallClosure, 1);
install->automatic = realm_options_automatic_install ();
+ install->invocation = invocation ? g_object_ref (invocation) : NULL;
install->connection = g_object_ref (connection);
g_task_set_task_data (task, install, install_closure_free);
--
2.4.3

428
realmd.spec Normal file
View File

@ -0,0 +1,428 @@
Name: realmd
Version: 0.16.3
Release: 26%{?dist}
Summary: Kerberos realm enrollment service
License: LGPLv2+
URL: https://freedesktop.org/software/realmd/
Source0: http://www.freedesktop.org/software/realmd/releases/realmd-%{version}.tar.gz
Patch1: 0001-LDAP-don-t-close-LDAP-socket-twice.patch
Patch2: 0001-service-Add-nss-and-pam-sssd.conf-services-after-joi.patch
Patch3: 0001-Kerberos-fall-back-to-tcp-SRV-lookup.patch
Patch4: 0001-service-Add-pam-and-nss-services-in-realm_sssd_confi.patch
Patch5: 0001-switch-to-authselect.patch
Patch6: 0001-Fix-man-page-reference-in-systemd-service-file.patch
Patch7: 0001-Use-current-idmap-options-for-smb.conf.patch
Patch8: 0001-Find-NetBIOS-name-in-keytab-while-leaving.patch
Patch9: 0001-tests-run-tests-with-python3.patch
Patch10: 0001-Fix-issues-found-by-Coverity.patch
Patch11: 0002-Change-qualified-names-default-for-IPA.patch
Patch12: 0003-discover-try-to-get-domain-name-from-hostname.patch
Patch13: 0001-IPA-do-not-call-sssd-enable-logins.patch
Patch14: 0001-Set-NEWEST-flag-when-resolving-packages-with-Package.patch
# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1675879
Patch15: 0001-tests-ignore-order-in-test_update_domain.patch
# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1736578
Patch16: 0001-Remove-support-for-deprecated-gtester-format.patch
# Sync with upstream
Patch17: 0001-doc-make-sure-cross-reference-ids-are-predictable.patch
Patch18: 0002-tools-remove-duplicated-va_start.patch
Patch19: 0003-service-remove-dead-code.patch
Patch20: 0004-service-check-return-value-of-fcntl.patch
Patch21: 0005-service-avoid-dereference-of-a-null-pointer.patch
Patch22: 0006-service-avoid-dereferencing-a-NULL-pointer.patch
Patch23: 0001-Add-missing-xsl-file-to-Makefile.am.patch
Patch24: 0002-configure-do-not-inherit-DISTRO-from-the-environment.patch
Patch25: 0003-doc-extend-user-principal-section.patch
Patch26: 0004-doc-fix-discover-name-only.patch
Patch27: 0005-doc-add-see-also-to-man-pages.patch
Patch28: 0006-doc-extend-description-of-config-handling.patch
Patch29: 0007-service-use-kerberos-method-secrets-and-keytab.patch
# Sync with upstream
Patch30: 0001-Fix-for-ini-config-test-issue.patch
Patch31: 0002-Use-startTLS-with-FreeIPA.patch
Patch32: 0003-service-use-net-ads-join-with-k-for-user-join-as-wel.patch
Patch33: 0004-service-use-additional-dns-hostnames-with-net-ads-jo.patch
BuildRequires: gcc
BuildRequires: automake
BuildRequires: autoconf
BuildRequires: intltool pkgconfig
BuildRequires: gettext-devel
BuildRequires: glib2-devel >= 2.32.0
BuildRequires: openldap-devel
BuildRequires: polkit-devel
BuildRequires: krb5-devel
BuildRequires: systemd-devel
BuildRequires: libxslt
BuildRequires: xmlto
BuildRequires: python3
Requires: authselect
Requires: polkit
%description
realmd is a DBus system service which manages discovery and enrollment in realms
and domains like Active Directory or IPA. The control center uses realmd as the
back end to 'join' a domain simply and automatically configure things correctly.
%package devel-docs
Summary: Developer documentation files for %{name}
%description devel-docs
The %{name}-devel package contains developer documentation for developing
applications that use %{name}.
%define _hardened_build 1
%prep
%autosetup -p1
%build
autoreconf -fi
%configure --disable-silent-rules
make %{?_smp_mflags}
%check
make check
%install
make install DESTDIR=%{buildroot}
%find_lang realmd
%files -f realmd.lang
%doc AUTHORS COPYING NEWS README
%{_sysconfdir}/dbus-1/system.d/org.freedesktop.realmd.conf
%{_sbindir}/realm
%dir %{_prefix}/lib/realmd
%{_prefix}/lib/realmd/realmd
%{_prefix}/lib/realmd/realmd-defaults.conf
%{_prefix}/lib/realmd/realmd-distro.conf
%{_unitdir}/realmd.service
%{_datadir}/dbus-1/system-services/org.freedesktop.realmd.service
%{_datadir}/polkit-1/actions/org.freedesktop.realmd.policy
%{_mandir}/man8/realm.8.gz
%{_mandir}/man5/realmd.conf.5.gz
%{_localstatedir}/cache/realmd/
%files devel-docs
%doc %{_datadir}/doc/realmd/
%doc ChangeLog
%changelog
* Wed Aug 12 2020 Sumit Bose <sbose@redhat.com> - 0.16.3-25
- Sync with latest upstream patches
* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.16.3-25
- Second attempt - Rebuilt for
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.16.3-24
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Wed Mar 18 2020 Sumit Bose <sbose@redhat.com> - 0.16.3-23
- Sync with latest upstream patches and fix package URL
Resolves: rhbz#1800897
* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.16.3-22
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Fri Aug 02 2019 Sumit Bose <sbose@redhat.com> - 0.16.3-21
- Remove gtester support, use autosetup
Resolves: rhbz#1736578
* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.16.3-20
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Thu Feb 21 2019 Sumit Bose <sbose@redhat.com> - 0.16.3-19
- fix test depending on order
Resolves: rhbz#1675879
* Wed Feb 20 2019 Adam Williamson <awilliam@redhat.com> - 0.16.3-18
- Backport fix from upstream to always install latest packages via PK
* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.16.3-17
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Thu Sep 27 2018 Sumit Bose <sbose@redhat.com> - 0.16.3-16
- Do not call authselect for IPA domains
Resolves: rhbz#1620097
* Tue Aug 21 2018 Sumit Bose <sbose@redhat.com> - 0.16.3-15
- Change IPA defaults and improve realm discovery
Resolves: rhbz#1575538
Resolves: rhbz#1145777
* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.16.3-14
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Wed Jul 04 2018 Sumit Bose <sbose@redhat.com> - 0.16.3-13
- Drop python2 build dependency
- Add polkit runtime dependency
Resolves: rhbz#1577178
- Fix documentation reference in systemd unit file
Resolves: rhbz#1596323
- Use current Samba config options
Resolves: rhbz#1482926
* Sun Mar 18 2018 René Genz <liebundartig@freenet.de> - 0.16.3-12
- use correct authselect syntax for *-disable-logins to fix rhbz#1558245
- Iryna Shcherbina <ishcherb@redhat.com>
Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
* Thu Mar 01 2018 Sumit Bose <sbose@redhat.com> - 0.16.3-11
- Require authselect instead of authconfig, related: rhbz#1537246
* Tue Feb 20 2018 Sumit Bose <sbose@redhat.com> - 0.16.3-10
- added BuildRequires gcc
- Use authselect instead of authconfig, related: rhbz#1537246
* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.16.3-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Tue Sep 05 2017 Petr Pisar <ppisar@redhat.com> - 0.16.3-8
- Update all m4 macros to prevent from mismatching between Automake versions
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.16.3-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.16.3-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Tue Apr 25 2017 Sumit Bose <sbose@redhat.com> - 0.16.3-5
- Resolves: rhbz#1445017
* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.16.3-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
* Thu Jan 19 2017 Merlin Mathesius <mmathesi@redhat.com> - 0.16.3-3
- Add BuildRequires: python to fix FTBFS (BZ#1415000).
* Tue Dec 13 2016 Sumit Bose <sbose@redhat.com> - 0.16.3-2
- Resolves: rhbz#1401605
* Wed Nov 30 2016 Sumit Bose <sbose@redhat.com> - 0.16.3-1
- Updated to upstream 0.16.3 plus patches from git master
* Fri Jun 03 2016 Sumit Bose <sbose@redhat.com> - 0.16.2-5
- properly apply patch for rhbz#1330766
- Resolves: rhbz#1330766
* Wed May 18 2016 Sumit Bose <sbose@redhat.com> - 0.16.2-4
- Resolves: rhbz#1330766
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 0.16.2-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
* Fri Sep 11 2015 Stef Walter <stefw@redhat.com> - 0.16.2-2
- Fixed --computer-ou regression
- Show message when installing packages
* Fri Jul 31 2015 Stef Walter <stefw@redhat.com> - 0.16.2-1
- Updated to upstream 0.16.2
- Install to $prefix/lib instead of $libdir
- Resolves: rhbz#1246741
* Tue Jul 14 2015 Stef Walter <stefw@redhat.com> - 0.16.1-1
- Updated to upstream 0.16.1
- Resolves: rhbz#1231128
* Thu Jun 18 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.16.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
* Tue Apr 14 2015 Stef Walter <stefw@redhat.com> - 0.16.0-1
- Updated to upstream 0.16.0
- Resolves: rhbz#1205753
- Resolves: rhbz#1142190
- Resolves: rhbz#1061091
- Resolves: rhbz#1205752
* Thu Apr 09 2015 Stephen Gallagher <sgallagh@redhat.com> - 0.15.2-2
- Resolves: rhbz#1210483
* Mon Oct 06 2014 Stef Walter <stefw@redhat.com> - 0.15.2-1
- Update to upstream 0.15.2
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.15.1-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
* Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.15.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Sat May 31 2014 Peter Robinson <pbrobinson@fedoraproject.org> 0.15.1-2
- Move ChangeLog to devel-docs. NEWS is probably riveting enough for users
* Fri May 23 2014 Stef Walter <stefw@redhat.com> - 0.15.1-1
- Update to upstream 0.15.1
- Remove the packagekit patch that's now integrated upstream
* Thu Jan 30 2014 Richard Hughes <rhughes@redhat.com> - 0.15.0-2
- Rebuild for libpackagekit-glib soname bump
* Tue Jan 07 2014 Stef Walter <stefw@redhat.com> - 0.15.0-1
- Update to upstream 0.15.0 release, fixing various bugs
* Mon Sep 09 2013 Stef Walter <stefw@redhat.com> - 0.14.6-1
- Update to upstream 0.14.6 point release
- Set 'kerberos method = system keytab' in smb.conf properly
- Limit Netbios name to 15 chars when joining AD domain
* Thu Aug 15 2013 Stef Walter <stefw@redhat.com> - 0.14.5-1
- Update to upstream 0.14.5 point release
- Fix regression conflicting --unattended and -U as in --user args
- Pass discovered server address to adcli tool
* Wed Aug 07 2013 Stef Walter <stefw@redhot.com> - 0.14.4-1
- Update to upstream 0.14.4 point release
- Fix up the [sssd] section in sssd.conf if it's screwed up
- Add an --unattended argument to realm command line client
- Clearer 'realm permit' manual page example
* Wed Aug 07 2013 Stef Walter <stefw@redhot.com> - 0.14.3-1
- Update to upstream 0.14.3 point release
- Populate LoginFormats correctly [#961442]
- Documentation clarifications
- Set sssd.conf default_shell per domain
- Notify in terminal output when installing packages
- If joined via adcli, delete computer with adcli too [#961244]
- If input is not a tty, read from stdin without getpass() [#983153]
- Configure pam_winbind.conf appropriately [#983153]
- Refer to FreeIPA as IPA
- Support use of kerberos ccache to join when winbind
* Sun Aug 04 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.14.2-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
* Mon Jul 15 2013 Stef Walter <stefw@redhat.com> - 0.14.2-4
- Build with verbose automake output
* Tue Jun 11 2013 Stef Walter <stefw@redhat.com> - 0.14.2-3
- Run test suite when building the package
- Fix rpmlint errors
* Thu Jun 06 2013 Stef Walter <stefw@redhat.com> - 0.14.2-2
- Install oddjobd and oddjob-mkhomedir when joining domains [#969441]
* Mon May 27 2013 Stef Walter <stefw@redhat.com> - 0.14.2-1
- Update to upstream 0.14.2 version
- Discover FreeIPA 3.0 with AD trust correctly [#966148]
- Only allow joining one realm by default [#966650]
- Enable the oddjobd service after joining a domain [#964971]
- Remove sssd.conf allow lists when permitting all [#965760]
- Add dependency on authconfig [#964675]
- Remove glib-networking dependency now that we no longer use SSL.
* Mon May 13 2013 Stef Walter <stefw@redhat.com> - 0.14.1-1
- Update to upstream 0.14.1 version
- Fix crasher/regression using passwords with joins [#961435]
- Make second Ctrl-C just quit realm tool [#961325]
- Fix critical warning when leaving IPA realm [#961320]
- Don't print out journalctl command in obvious situations [#961230]
- Document the --all option to 'realm discover' [#961279]
- No need to require sssd-tools package [#961254]
- Enable services even in install mode [#960887]
- Use the AD domain name in sssd.conf directly [#960270]
- Fix critical warning when service Release() method [#961385]
* Mon May 06 2013 Stef Walter <stefw@redhat.com> - 0.14.0-1
- Work around broken krb5 with empty passwords [#960001]
- Add manual page for realmd.conf [#959357]
- Update to upstream 0.14.0 version
* Thu May 02 2013 Stef Walter <stefw@redhat.com> - 0.13.91-1
- Fix regression when using one time password [#958667]
- Support for permitting logins by group [#887675]
* Mon Apr 29 2013 Stef Walter <stefw@redhat.com> - 0.13.90-1
- Add option to disable package-kit installs [#953852]
- Add option to use unqualified names [#953825]
- Better discovery of domains [#953153]
- Concept of managing parts of the system [#914892]
- Fix problems with cache directory [#913457]
- Clearly explain when realm cannot be joined [#878018]
- Many other upstream enhancements and fixes
* Wed Apr 17 2013 Stef Walter <stefw@redhat.com> - 0.13.3-2
- Add missing glib-networking dependency, currently used
for FreeIPA discovery [#953151]
* Wed Apr 17 2013 Stef Walter <stefw@redhat.com> - 0.13.3-1
- Update for upstream 0.13.3 version
- Add dependency on systemd for installing service file
* Tue Apr 16 2013 Stef Walter <stefw@redhat.com> - 0.13.2-2
- Fix problem with sssd not starting after joining
* Mon Feb 18 2013 Stef Walter <stefw@redhat.com> - 0.13.2-1
- Update to upstream 0.13.2 version
* Mon Feb 18 2013 Stef Walter <stefw@redhat.com> - 0.13.1-1
- Update to upstream 0.13.1 version for bug fixes
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.12-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
* Mon Nov 12 2012 Stef Walter <stefw@redhat.com> - 0.12-1
- Update to upstream 0.12 version for bug fixes
* Tue Oct 30 2012 Stef Walter <stefw@redhat.com> - 0.11-1
- Update to upstream 0.11 version
* Sat Oct 20 2012 Stef Walter <stefw@redhat.com> - 0.10-1
- Update to upstream 0.10 version
* Wed Oct 17 2012 Stef Walter <stefw@redhat.com> - 0.9-1
- Update to upstream 0.9 version
* Wed Sep 19 2012 Stef Walter <stefw@redhat.com> - 0.8-2
- Add openldap-devel build requirement
* Wed Sep 19 2012 Stef Walter <stefw@redhat.com> - 0.8-1
- Update to upstream 0.8 version
- Add support for translations
* Mon Aug 20 2012 Stef Walter <stefw@redhat.com> - 0.7-2
- Build requires gtk-doc
* Mon Aug 20 2012 Stef Walter <stefw@redhat.com> - 0.7-1
- Update to upstream 0.7 version
- Remove files no longer present in upstream version
- Put documentation in its own realmd-devel-docs subpackage
- Update upstream URLs
* Mon Aug 6 2012 Stef Walter <stefw@redhat.com> - 0.6-1
- Update to upstream 0.6 version
* Tue Jul 17 2012 Stef Walter <stefw@redhat.com> - 0.5-2
- Remove missing SssdIpa.service file from the files list.
This file will return upstream in 0.6
* Tue Jul 17 2012 Stef Walter <stefw@redhat.com> - 0.5-1
- Update to upstream 0.5 version
* Tue Jun 19 2012 Stef Walter <stefw@redhat.com> - 0.4-1
- Update to upstream 0.4 version
- Cleanup various rpmlint warnings
* Tue Jun 19 2012 Stef Walter <stefw@redhat.com> - 0.3-2
- Add doc files
- Own directories
- Remove obsolete parts of spec file
- Remove explicit dependencies
- Updated License line to LGPLv2+
* Tue Jun 19 2012 Stef Walter <stefw@redhat.com> - 0.3
- Build fixes
* Mon Jun 18 2012 Stef Walter <stefw@redhat.com> - 0.2
- Initial RPM

1
sources Normal file
View File

@ -0,0 +1 @@
a8b3bf5692c4255298ae962a0c8813fa realmd-0.16.3.tar.gz