From 9899f885834ab0688059304bb3b6b60cbc397564 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Tue, 14 Oct 2025 14:04:17 +0200 Subject: [PATCH] add renew command Resolves: RHEL-117645 --- ...al-implementation-of-a-renew-request.patch | 335 ++++++++++++ 0002-renew-implement-support-for-adcli.patch | 516 ++++++++++++++++++ 0003-renew-add-translatable-strings.patch | 21 + 0004-renew-fix-issues-found-by-Coverity.patch | 47 ++ ...c-add-renew-option-of-realm-man-page.patch | 90 +++ realmd.spec | 12 +- 6 files changed, 1020 insertions(+), 1 deletion(-) create mode 100644 0001-Initial-implementation-of-a-renew-request.patch create mode 100644 0002-renew-implement-support-for-adcli.patch create mode 100644 0003-renew-add-translatable-strings.patch create mode 100644 0004-renew-fix-issues-found-by-Coverity.patch create mode 100644 0005-doc-add-renew-option-of-realm-man-page.patch diff --git a/0001-Initial-implementation-of-a-renew-request.patch b/0001-Initial-implementation-of-a-renew-request.patch new file mode 100644 index 0000000..b23abb6 --- /dev/null +++ b/0001-Initial-implementation-of-a-renew-request.patch @@ -0,0 +1,335 @@ +From 7a19dbe6620565817769f6862d3af5bac761235e Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Mon, 2 Dec 2024 17:22:06 +0100 +Subject: [PATCH] Initial implementation of a renew request + +This patch implements a new D-Bus request for realmd to renew the machine +account credentials in a keytab. This patch does not implement calling +the membership-software to do the actual update. + +https://issues.redhat.com/browse/SSSD-8347 +--- + dbus/org.freedesktop.realmd.xml | 9 ++ + service/org.freedesktop.realmd.policy.in | 10 ++ + service/realm-invocation.c | 1 + + service/realm-kerberos.c | 15 ++ + tools/Makefile.am | 1 + + tools/realm-renew.c | 179 +++++++++++++++++++++++ + tools/realm.c | 1 + + tools/realm.h | 4 + + 8 files changed, 220 insertions(+) + create mode 100644 tools/realm-renew.c + +diff --git a/dbus/org.freedesktop.realmd.xml b/dbus/org.freedesktop.realmd.xml +index c34a47a..58e5773 100644 +--- a/dbus/org.freedesktop.realmd.xml ++++ b/dbus/org.freedesktop.realmd.xml +@@ -725,6 +725,15 @@ + + + ++ ++ ++ ++ ++ + + + +diff --git a/service/org.freedesktop.realmd.policy.in b/service/org.freedesktop.realmd.policy.in +index 562cbbc..4ce97d7 100644 +--- a/service/org.freedesktop.realmd.policy.in ++++ b/service/org.freedesktop.realmd.policy.in +@@ -44,6 +44,16 @@ + + + ++ ++ Renew machine creadentials in realm ++ Authentication is required to renew the credentials of this computer in a realm or domain. ++ ++ auth_admin ++ auth_admin ++ auth_admin_keep ++ ++ ++ + + Change login policy + Authentication is required to change the policy of who can log in on this computer. +diff --git a/service/realm-invocation.c b/service/realm-invocation.c +index bb26fe3..91977e9 100644 +--- a/service/realm-invocation.c ++++ b/service/realm-invocation.c +@@ -37,6 +37,7 @@ static InvocationMethod invocation_methods[] = { + { REALM_DBUS_PROVIDER_INTERFACE, "Discover", "org.freedesktop.realmd.discover-realm", 2 }, + { REALM_DBUS_KERBEROS_MEMBERSHIP_INTERFACE, "Join", "org.freedesktop.realmd.configure-realm", 2 }, + { REALM_DBUS_KERBEROS_MEMBERSHIP_INTERFACE, "Leave", "org.freedesktop.realmd.deconfigure-realm", 2 }, ++ { REALM_DBUS_KERBEROS_MEMBERSHIP_INTERFACE, "Renew", "org.freedesktop.realmd.renew-realm", 1 }, + { REALM_DBUS_REALM_INTERFACE, "Deconfigure", "org.freedesktop.realmd.deconfigure-realm", 1 }, + { REALM_DBUS_REALM_INTERFACE, "ChangeLoginPolicy", "org.freedesktop.realmd.login-policy", 4 }, + }; +diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c +index 51a1b11..3c9c71c 100644 +--- a/service/realm-kerberos.c ++++ b/service/realm-kerberos.c +@@ -407,6 +407,19 @@ handle_leave (RealmDbusKerberosMembership *membership, + return TRUE; + } + ++static gboolean ++handle_renew (RealmDbusKerberosMembership *membership, ++ GDBusMethodInvocation *invocation, ++ GVariant *options, ++ gpointer user_data) ++{ ++ //RealmKerberos *self = REALM_KERBEROS (user_data); ++ ++ g_dbus_method_invocation_return_error (invocation, G_DBUS_ERROR, G_DBUS_ERROR_UNKNOWN_METHOD, ++ "Renew is currently not impemented."); ++ return TRUE; ++} ++ + static gboolean + handle_deconfigure (RealmDbusRealm *realm, + GDBusMethodInvocation *invocation, +@@ -567,6 +580,8 @@ realm_kerberos_constructed (GObject *obj) + G_CALLBACK (handle_join), self); + g_signal_connect (self->pv->membership_iface, "handle-leave", + G_CALLBACK (handle_leave), self); ++ g_signal_connect (self->pv->membership_iface, "handle-renew", ++ G_CALLBACK (handle_renew), self); + g_dbus_object_skeleton_add_interface (G_DBUS_OBJECT_SKELETON (self), + G_DBUS_INTERFACE_SKELETON (self->pv->membership_iface)); + +diff --git a/tools/Makefile.am b/tools/Makefile.am +index 97b67e7..65abb60 100644 +--- a/tools/Makefile.am ++++ b/tools/Makefile.am +@@ -9,6 +9,7 @@ realm_SOURCES = \ + tools/realm-discover.c \ + tools/realm-join.c \ + tools/realm-leave.c \ ++ tools/realm-renew.c \ + tools/realm-logins.c \ + service/realm-kerberos-helper.c \ + $(NULL) +diff --git a/tools/realm-renew.c b/tools/realm-renew.c +new file mode 100644 +index 0000000..7b28e48 +--- /dev/null ++++ b/tools/realm-renew.c +@@ -0,0 +1,179 @@ ++/* realmd -- Realm configuration service ++ * ++ * Copyright 2024 Red Hat Inc ++ * ++ * This program is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU Lesser General Public License as published ++ * by the Free Software Foundation; either version 2 of the licence or (at ++ * your option) any later version. ++ * ++ * See the included COPYING file for more information. ++ * ++ * Author: Sumit Bose ++ */ ++ ++#include "config.h" ++ ++#include "realm.h" ++#include "realm-client.h" ++#include "realm-dbus-constants.h" ++#include "realm-dbus-generated.h" ++ ++#include ++#include ++ ++#include ++#include ++#include ++ ++typedef struct { ++ GAsyncResult *result; ++ GMainLoop *loop; ++} SyncClosure; ++ ++static void ++on_complete_get_result (GObject *source, ++ GAsyncResult *result, ++ gpointer user_data) ++{ ++ SyncClosure *sync = user_data; ++ sync->result = g_object_ref (result); ++ g_main_loop_quit (sync->loop); ++} ++ ++static int ++call_renew (RealmDbusKerberosMembership *membership, ++ GVariant *options, ++ GError **error) ++{ ++ SyncClosure sync; ++ gboolean ret; ++ ++ sync.result = NULL; ++ sync.loop = g_main_loop_new (NULL, FALSE); ++ ++ /* Start actual operation */ ++ realm_dbus_kerberos_membership_call_renew (membership, options, NULL, ++ on_complete_get_result, &sync); ++ ++ /* This mainloop is quit by on_complete_get_result */ ++ g_main_loop_run (sync.loop); ++ ++ ret = realm_dbus_kerberos_membership_call_renew_finish (membership, sync.result, error); ++ ++ g_object_unref (sync.result); ++ g_main_loop_unref (sync.loop); ++ ++ return ret ? 0 : 1; ++} ++ ++typedef struct { ++ gchar *membership_software; ++ gboolean use_ldaps; ++} RealmRenewArgs; ++ ++static void ++realm_renew_args_clear (gpointer data) ++{ ++ RealmRenewArgs *args = data; ++ g_free (args->membership_software); ++} ++ ++static int ++perform_renew (RealmClient *client, ++ const gchar *string, ++ RealmRenewArgs *args) ++{ ++ RealmDbusKerberosMembership *membership; ++ gboolean had_mismatched = FALSE; ++ RealmDbusRealm *realm; ++ GError *error = NULL; ++ GVariant *options; ++ GList *realms; ++ gint ret; ++ ++ realms = realm_client_discover (client, string, args->use_ldaps, NULL, ++ NULL, args->membership_software, ++ REALM_DBUS_KERBEROS_MEMBERSHIP_INTERFACE, ++ &had_mismatched, &error); ++ ++ if (error != NULL) { ++ realm_handle_error(error, NULL); ++ return 1; ++ } else if (realms == NULL) { ++ if (had_mismatched) ++ realm_handle_error (NULL, _("Cannot renew credentials for this realm")); ++ else ++ realm_handle_error(NULL, _("No such realm found")); ++ return 1; ++ } ++ ++ membership = realms->data; ++ realm = realm_client_to_realm (client, membership); ++ if (!realm_is_configured (realm)) { ++ realm_handle_error (NULL, _("Not joined to this domain")); ++ return 1; ++ } ++ ++ options = realm_build_options (REALM_DBUS_OPTION_MEMBERSHIP_SOFTWARE, args->membership_software, ++ REALM_DBUS_OPTION_USE_LDAPS, args->use_ldaps ? "True" : "False", ++ NULL); ++ g_variant_ref_sink (options); ++ ++ ret = call_renew (membership, options, &error); ++ if (error != NULL) { ++ realm_handle_error (error, _("Couldn't renew realm credentials")); ++ } ++ ++ g_variant_unref (options); ++ g_list_free_full (realms, g_object_unref); ++ return ret; ++} ++ ++int ++realm_renew (RealmClient *client, ++ int argc, ++ char *argv[]) ++{ ++ GOptionContext *context; ++ GError *error = NULL; ++ const gchar *realm_name; ++ RealmRenewArgs args; ++ GOptionGroup *group; ++ gint ret = 0; ++ ++ GOptionEntry option_entries[] = { ++ { "membership-software", 0, 0, G_OPTION_ARG_STRING, &args.membership_software, ++ N_("Use specific membership software"), NULL }, ++ { "use-ldaps", 0, 0, G_OPTION_ARG_NONE, &args.use_ldaps, ++ N_("Use ldaps to connect to LDAP"), NULL }, ++ { NULL, } ++ }; ++ ++ memset (&args, 0, sizeof (args)); ++ ++ context = g_option_context_new ("renew REALM"); ++ g_option_context_set_translation_domain (context, GETTEXT_PACKAGE); ++ ++ group = g_option_group_new (NULL, NULL, NULL, &args, realm_renew_args_clear); ++ g_option_group_add_entries (group, option_entries); ++ g_option_group_add_entries (group, realm_global_options); ++ g_option_context_set_main_group (context, group); ++ ++ if (!g_option_context_parse (context, &argc, &argv, &error)) { ++ g_printerr ("%s: %s\n", g_get_prgname (), error->message); ++ g_error_free (error); ++ ret = 2; ++ ++ } else if (argc > 2) { ++ g_printerr ("%s: %s\n", g_get_prgname (), _("Specify one realm to renew credentials")); ++ ret = 2; ++ ++ } else { ++ realm_name = argc < 2 ? "" : argv[1]; ++ ret = perform_renew (client, realm_name, &args); ++ } ++ ++ g_option_context_free (context); ++ return ret; ++} +diff --git a/tools/realm.c b/tools/realm.c +index 8fdca16..3902017 100644 +--- a/tools/realm.c ++++ b/tools/realm.c +@@ -40,6 +40,7 @@ struct { + { "discover", realm_discover, "realm discover -v [realm-name]", N_("Discover available realm") }, + { "join", realm_join, "realm join -v [-U user] realm-name", N_("Enroll this machine in a realm") }, + { "leave", realm_leave, "realm leave -v [-U user] [realm-name]", N_("Unenroll this machine from a realm") }, ++ { "renew", realm_renew, "realm renew -v [realm-name]", N_("Renew credentials for this machine in a realm") }, + { "list", realm_list, "realm list", N_("List known realms") }, + { "permit", realm_permit, "realm permit [-ax] [-R realm] user ...", N_("Permit user logins") }, + { "deny", realm_deny, "realm deny --all [-R realm]", N_("Deny user logins") }, +diff --git a/tools/realm.h b/tools/realm.h +index 380b58b..68118e3 100644 +--- a/tools/realm.h ++++ b/tools/realm.h +@@ -41,6 +41,10 @@ int realm_leave (RealmClient *client, + int argc, + char *argv[]); + ++int realm_renew (RealmClient *client, ++ int argc, ++ char *argv[]); ++ + int realm_discover (RealmClient *client, + int argc, + char *argv[]); +-- +2.51.0 + diff --git a/0002-renew-implement-support-for-adcli.patch b/0002-renew-implement-support-for-adcli.patch new file mode 100644 index 0000000..39ab414 --- /dev/null +++ b/0002-renew-implement-support-for-adcli.patch @@ -0,0 +1,516 @@ +From aab58393b1f5255d905d5872c697522b3a52a64c Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Tue, 7 Jan 2025 15:11:53 +0100 +Subject: [PATCH] renew: implement support for adcli + +With this patch realmd can call adcli to renew the machine account +credentials in a given keytab. + +Resolves: https://issues.redhat.com/browse/SSSD-8347 +--- + dbus/realm-dbus-constants.h | 4 + + service/realm-adcli-enroll.c | 103 ++++++++++++++++++++++++ + service/realm-adcli-enroll.h | 6 ++ + service/realm-kerberos-membership.h | 10 +++ + service/realm-kerberos.c | 49 +++++++++++- + service/realm-options.c | 36 +++++++++ + service/realm-options.h | 3 + + service/realm-sssd-ad.c | 120 ++++++++++++++++++++++++++++ + tools/realm-renew.c | 18 ++++- + 9 files changed, 344 insertions(+), 5 deletions(-) + +diff --git a/dbus/realm-dbus-constants.h b/dbus/realm-dbus-constants.h +index e49034b..1608901 100644 +--- a/dbus/realm-dbus-constants.h ++++ b/dbus/realm-dbus-constants.h +@@ -72,6 +72,10 @@ G_BEGIN_DECLS + #define REALM_DBUS_OPTION_LEGACY_SMB_CONF "legacy-samba-config" + #define REALM_DBUS_OPTION_USE_LDAPS "use-ldaps" + #define REALM_DBUS_OPTION_DO_NOT_TOUCH_CONFIG "do-not-touch-config" ++#define REALM_DBUS_OPTION_ADD_SAMBA_DATA "add-samba-data" ++#define REALM_DBUS_OPTION_COMPUTER_PWD_LIFETIME "computer-password-lifetime" ++#define REALM_DBUS_OPTION_HOST_KEYTAB "host-keytab" ++#define REALM_DBUS_OPTION_HOST_FQDN "host-fqdn" + + #define REALM_DBUS_IDENTIFIER_ACTIVE_DIRECTORY "active-directory" + #define REALM_DBUS_IDENTIFIER_WINBIND "winbind" +diff --git a/service/realm-adcli-enroll.c b/service/realm-adcli-enroll.c +index c58175e..c428f70 100644 +--- a/service/realm-adcli-enroll.c ++++ b/service/realm-adcli-enroll.c +@@ -23,6 +23,7 @@ + #include "realm-ini-config.h" + #include "realm-options.h" + #include "realm-settings.h" ++#include "realm-dbus-constants.h" + + static void + on_join_leave_process (GObject *source, +@@ -84,6 +85,14 @@ on_leave_process (GObject *source, + on_join_leave_process (source, result, user_data, FALSE); + } + ++static void ++on_renew_process (GObject *source, ++ GAsyncResult *result, ++ gpointer user_data) ++{ ++ on_join_leave_process (source, result, user_data, FALSE); ++} ++ + void + realm_adcli_enroll_join_async (RealmDisco *disco, + RealmCredential *cred, +@@ -330,3 +339,97 @@ realm_adcli_enroll_delete_finish (GAsyncResult *result, + g_return_val_if_fail (g_task_is_valid (result, NULL), FALSE); + return g_task_propagate_boolean (G_TASK (result), error); + } ++ ++void ++realm_adcli_enroll_renew_async (RealmDisco *disco, ++ GVariant *options, ++ gboolean use_ldaps, ++ GDBusMethodInvocation *invocation, ++ GAsyncReadyCallback callback, ++ gpointer user_data) ++{ ++ gchar *environ[] = { "LANG=C", NULL }; ++ GInetAddress *address; ++ GTask *task; ++ GPtrArray *args; ++ gchar *ccache_arg = NULL; ++ gchar *server_arg = NULL; ++ gboolean add_samba_data = FALSE; ++ const gchar *computer_password_lifetime = NULL; ++ gchar *lifetime_arg = NULL; ++ const gchar *host_keytab = NULL; ++ gchar *keytab_arg = NULL; ++ const gchar *host_fqdn = NULL; ++ gchar *fqdn_arg = NULL; ++ ++ g_return_if_fail (disco != NULL); ++ g_return_if_fail (invocation != NULL); ++ ++ task = g_task_new (NULL, NULL, callback, user_data); ++ args = g_ptr_array_new (); ++ ++ add_samba_data = realm_option_add_samba_data (options); ++ computer_password_lifetime = realm_option_computer_pwd_lifetime (options); ++ host_keytab = realm_options_ad_specific (options, ++ REALM_DBUS_OPTION_HOST_KEYTAB); ++ host_fqdn = realm_options_ad_specific (options, ++ REALM_DBUS_OPTION_HOST_FQDN); ++ ++ g_ptr_array_add (args, (gpointer)realm_settings_path ("adcli")); ++ g_ptr_array_add (args, "update"); ++ g_ptr_array_add (args, "--verbose"); ++ g_ptr_array_add (args, "--domain"); ++ g_ptr_array_add (args, (gpointer)disco->domain_name); ++ ++ if (use_ldaps) { ++ g_ptr_array_add (args, "--use-ldaps"); ++ } ++ ++ if (add_samba_data) { ++ g_ptr_array_add (args, "--add-samba-data"); ++ } ++ ++ if (computer_password_lifetime != NULL) { ++ lifetime_arg = g_strdup_printf ("--computer-password-lifetime=%s", ++ computer_password_lifetime); ++ g_ptr_array_add (args, lifetime_arg); ++ } ++ ++ if (host_keytab != NULL) { ++ keytab_arg = g_strdup_printf ("--host-keytab=%s", host_keytab); ++ g_ptr_array_add (args, keytab_arg); ++ } ++ ++ if (host_fqdn != NULL) { ++ fqdn_arg = g_strdup_printf ("--host-fqdn=%s", host_fqdn); ++ g_ptr_array_add (args, fqdn_arg); ++ } ++ ++ if (G_IS_INET_SOCKET_ADDRESS (disco->server_address)) { ++ address = g_inet_socket_address_get_address (G_INET_SOCKET_ADDRESS (disco->server_address)); ++ server_arg = g_inet_address_to_string (address); ++ if (server_arg) { ++ g_ptr_array_add (args, "--domain-controller"); ++ g_ptr_array_add (args, server_arg); ++ } ++ ++ } else if (disco->explicit_server) { ++ g_ptr_array_add (args, "--domain-controller"); ++ g_ptr_array_add (args, (gpointer)disco->explicit_server); ++ } ++ ++ g_ptr_array_add (args, NULL); ++ ++ realm_command_runv_async ((gchar **)args->pdata, environ, NULL, ++ invocation, on_renew_process, ++ g_object_ref (task)); ++ ++ g_ptr_array_free (args, TRUE); ++ g_object_unref (task); ++ ++ g_free (fqdn_arg); ++ g_free (keytab_arg); ++ g_free (lifetime_arg); ++ g_free (ccache_arg); ++ g_free (server_arg); ++} +diff --git a/service/realm-adcli-enroll.h b/service/realm-adcli-enroll.h +index 3f535d0..e03f3f0 100644 +--- a/service/realm-adcli-enroll.h ++++ b/service/realm-adcli-enroll.h +@@ -48,6 +48,12 @@ void realm_adcli_enroll_delete_async (RealmDisco *disco, + gboolean realm_adcli_enroll_delete_finish (GAsyncResult *result, + GError **error); + ++void realm_adcli_enroll_renew_async (RealmDisco *disco, ++ GVariant *options, ++ gboolean use_ldaps, ++ GDBusMethodInvocation *invocation, ++ GAsyncReadyCallback callback, ++ gpointer user_data); + G_END_DECLS + + #endif /* __REALM_ADCLI_ENROLL_H__ */ +diff --git a/service/realm-kerberos-membership.h b/service/realm-kerberos-membership.h +index 50eea53..90337b7 100644 +--- a/service/realm-kerberos-membership.h ++++ b/service/realm-kerberos-membership.h +@@ -62,6 +62,16 @@ struct _RealmKerberosMembershipIface { + GError **error); + + const RealmCredential * (* leave_creds) (RealmKerberosMembership *realm); ++ ++ void (* renew_async) (RealmKerberosMembership *realm, ++ GVariant *options, ++ GDBusMethodInvocation *invocation, ++ GAsyncReadyCallback callback, ++ gpointer user_data); ++ ++ gboolean (* renew_finish) (RealmKerberosMembership *realm, ++ GAsyncResult *result, ++ GError **error); + }; + + GType realm_kerberos_membership_get_type (void) G_GNUC_CONST; +diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c +index 3c9c71c..0cf2da0 100644 +--- a/service/realm-kerberos.c ++++ b/service/realm-kerberos.c +@@ -407,16 +407,57 @@ handle_leave (RealmDbusKerberosMembership *membership, + return TRUE; + } + ++static void ++on_renew_complete (GObject *source, ++ GAsyncResult *result, ++ gpointer user_data) ++{ ++ MethodClosure *closure = user_data; ++ RealmKerberosMembershipIface *iface; ++ GCancellable *cancellable; ++ GError *error = NULL; ++ ++ iface = REALM_KERBEROS_MEMBERSHIP_GET_IFACE (closure->self); ++ g_return_if_fail (iface->renew_finish != NULL); ++ ++ cancellable = realm_invocation_get_cancellable (closure->invocation); ++ if (!g_cancellable_set_error_if_cancelled (cancellable, &error)) ++ (iface->leave_finish) (REALM_KERBEROS_MEMBERSHIP (closure->self), result, &error); ++ ++ unenroll_method_reply (closure->invocation, error); ++ ++ g_clear_error (&error); ++ method_closure_free (closure); ++} ++ + static gboolean +-handle_renew (RealmDbusKerberosMembership *membership, ++handle_renew (RealmDbusKerberosMembership *dbus_membership, + GDBusMethodInvocation *invocation, + GVariant *options, + gpointer user_data) + { +- //RealmKerberos *self = REALM_KERBEROS (user_data); ++ MethodClosure *method; ++ RealmKerberos *self = REALM_KERBEROS (user_data); ++ RealmKerberosMembershipIface *iface = REALM_KERBEROS_MEMBERSHIP_GET_IFACE (self); ++ RealmKerberosMembership *membership = REALM_KERBEROS_MEMBERSHIP (self); ++ ++ if (!realm_invocation_lock_daemon (invocation)) { ++ g_dbus_method_invocation_return_error (invocation, REALM_ERROR, REALM_ERROR_BUSY, ++ _("Already running another action")); ++ return TRUE; ++ } ++ ++ method = method_closure_new (self, invocation); ++ ++ if (iface->renew_async == NULL || iface->renew_finish == NULL) { ++ g_dbus_method_invocation_return_error (invocation, G_DBUS_ERROR, ++ G_DBUS_ERROR_UNKNOWN_METHOD, ++ "Renew is currently not impemented."); ++ return TRUE; ++ } ++ ++ (iface->renew_async) (membership, options, invocation, on_renew_complete, method); + +- g_dbus_method_invocation_return_error (invocation, G_DBUS_ERROR, G_DBUS_ERROR_UNKNOWN_METHOD, +- "Renew is currently not impemented."); + return TRUE; + } + +diff --git a/service/realm-options.c b/service/realm-options.c +index e1abe3a..919461f 100644 +--- a/service/realm-options.c ++++ b/service/realm-options.c +@@ -215,6 +215,42 @@ gboolean realm_option_use_ldaps (GVariant *options) + return FALSE; + } + ++gboolean realm_option_add_samba_data (GVariant *options) ++{ ++ const gchar *add_samba_data_str; ++ ++ add_samba_data_str = realm_options_ad_specific (options, ++ REALM_DBUS_OPTION_ADD_SAMBA_DATA); ++ if (add_samba_data_str != NULL ++ && ( g_ascii_strcasecmp (add_samba_data_str, "True") == 0 ++ || g_ascii_strcasecmp (add_samba_data_str, "Yes") == 0)) { ++ return TRUE; ++ } ++ ++ return FALSE; ++} ++ ++const gchar *realm_option_computer_pwd_lifetime (GVariant *options) ++{ ++ const gchar *computer_password_lifetime; ++ gint64 tmp64; ++ gchar *endptr; ++ ++ computer_password_lifetime = realm_options_ad_specific (options, ++ REALM_DBUS_OPTION_COMPUTER_PWD_LIFETIME); ++ if (computer_password_lifetime != NULL && *computer_password_lifetime != '\0') { ++ errno = 0; ++ tmp64 = g_ascii_strtoll (computer_password_lifetime, &endptr, 10); ++ if (tmp64 < 0 || errno != 0 || *endptr != '\0') { ++ /* Illegal input, ignored, should be checked earlier ++ * to return an error */ ++ computer_password_lifetime = NULL; ++ } ++ } ++ ++ return computer_password_lifetime; ++} ++ + gboolean realm_option_do_not_touch_config (GVariant *options) + { + const gchar *str; +diff --git a/service/realm-options.h b/service/realm-options.h +index 569ef42..a6b5c41 100644 +--- a/service/realm-options.h ++++ b/service/realm-options.h +@@ -52,6 +52,9 @@ gboolean realm_option_use_ldaps (GVariant *options); + + gboolean realm_option_do_not_touch_config (GVariant *options); + ++gboolean realm_option_add_samba_data (GVariant *options); ++ ++const gchar * realm_option_computer_pwd_lifetime (GVariant *options); + G_END_DECLS + + #endif /* __REALM_OPTIONS_H__ */ +diff --git a/service/realm-sssd-ad.c b/service/realm-sssd-ad.c +index 64bb488..c04557b 100644 +--- a/service/realm-sssd-ad.c ++++ b/service/realm-sssd-ad.c +@@ -644,6 +644,123 @@ realm_sssd_ad_leave_creds (RealmKerberosMembership *membership) + return creds; + } + ++typedef struct { ++ GDBusMethodInvocation *invocation; ++ gchar *realm_name; ++} RenewClosure; ++ ++static void ++renew_closure_free (gpointer data) ++{ ++ RenewClosure *renew = data; ++ g_free (renew->realm_name); ++ g_object_unref (renew->invocation); ++ g_free (renew); ++} ++ ++static void ++on_renew_done (GObject *source, ++ GAsyncResult *result, ++ gpointer user_data) ++{ ++ GTask *task = G_TASK (user_data); ++ RenewClosure *renew = g_task_get_task_data (task); ++ GError *error = NULL; ++ ++ if (!g_task_is_valid (result, NULL)) { ++ realm_diagnostics_info (renew->invocation, "Task not valid."); ++ } ++ ++ g_task_propagate_boolean (G_TASK (result), &error); ++ if (error != NULL) { ++ realm_diagnostics_error (renew->invocation, error, ++ "Task failed with: "); ++ g_error_free (error); ++ g_task_return_error (task, error); ++ } else { ++ g_task_return_boolean (task, TRUE); ++ } ++ ++ g_object_unref (task); ++} ++ ++static void ++realm_sssd_ad_renew_async (RealmKerberosMembership *membership, ++ GVariant *options, ++ GDBusMethodInvocation *invocation, ++ GAsyncReadyCallback callback, ++ gpointer user_data) ++{ ++ RealmSssdAd *self = REALM_SSSD_AD (membership); ++ RealmKerberos *realm = REALM_KERBEROS (self); ++ RealmSssd *sssd = REALM_SSSD (self); ++ RealmDisco *disco; ++ const gchar *section; ++ GTask *task; ++ RenewClosure *renew; ++ gboolean use_ldaps = FALSE; ++ ++ task = g_task_new (self, NULL, callback, user_data); ++ ++ /* Check that enrolled in this realm */ ++ section = realm_sssd_get_config_section (sssd); ++ if (!section) { ++ g_task_return_new_error (task, REALM_ERROR, REALM_ERROR_NOT_CONFIGURED, ++ _("Not currently joined to this domain")); ++ g_object_unref (task); ++ return; ++ } ++ ++ ++ /* This also has the side-effect of populating the disco info if necessary */ ++ disco = realm_kerberos_get_disco (realm); ++ ++ renew = g_new0 (RenewClosure, 1); ++ renew->realm_name = g_strdup (realm_kerberos_get_realm_name (realm)); ++ renew->invocation = g_object_ref (invocation); ++ g_task_set_task_data (task, renew, renew_closure_free); ++ ++ realm_adcli_enroll_renew_async (disco, options, use_ldaps, invocation, on_renew_done, ++ g_object_ref (task)); ++ ++ g_object_unref (task); ++#if 0 ++ switch (cred->type) { ++ case REALM_CREDENTIAL_AUTOMATIC: ++ realm_sssd_deconfigure_domain_tail (REALM_SSSD (self), task, invocation); ++ break; ++ case REALM_CREDENTIAL_CCACHE: ++ case REALM_CREDENTIAL_PASSWORD: ++ leave = g_new0 (LeaveClosure, 1); ++ leave->realm_name = g_strdup (realm_kerberos_get_realm_name (realm)); ++ leave->invocation = g_object_ref (invocation); ++ leave->use_adcli = strstr (tags ? tags : "", "joined-with-adcli") ? TRUE : FALSE; ++ g_task_set_task_data (task, leave, leave_closure_free); ++ ++ use_ldaps = realm_option_use_ldaps (options); ++ if (leave->use_adcli) { ++ realm_adcli_enroll_delete_async (disco, cred, options, ++ use_ldaps, invocation, ++ on_leave_do_deconfigure, g_object_ref (task)); ++ } else { ++ if (use_ldaps) { ++ realm_diagnostics_info (leave->invocation, ++ "Membership software does " ++ "not support ldaps, trying " ++ "without."); ++ } ++ realm_samba_enroll_leave_async (disco, cred, options, invocation, ++ on_leave_do_deconfigure, g_object_ref (task)); ++ } ++ break; ++ default: ++ g_return_if_reached (); ++ } ++ ++ g_object_unref (task); ++#endif ++} ++ + static gboolean + realm_sssd_ad_generic_finish (RealmKerberosMembership *realm, + GAsyncResult *result, +@@ -752,4 +869,7 @@ realm_sssd_ad_kerberos_membership_iface (RealmKerberosMembershipIface *iface) + iface->leave_async = realm_sssd_ad_leave_async; + iface->leave_finish = realm_sssd_ad_generic_finish; + iface->leave_creds = realm_sssd_ad_leave_creds; ++ ++ iface->renew_async = realm_sssd_ad_renew_async; ++ iface->renew_finish = realm_sssd_ad_generic_finish; + } +diff --git a/tools/realm-renew.c b/tools/realm-renew.c +index 7b28e48..c17febc 100644 +--- a/tools/realm-renew.c ++++ b/tools/realm-renew.c +@@ -70,6 +70,10 @@ call_renew (RealmDbusKerberosMembership *membership, + typedef struct { + gchar *membership_software; + gboolean use_ldaps; ++ gboolean add_samba_data; ++ gchar *computer_password_lifetime; ++ gchar *host_keytab; ++ gchar *host_fqdn; + } RealmRenewArgs; + + static void +@@ -116,7 +120,11 @@ perform_renew (RealmClient *client, + } + + options = realm_build_options (REALM_DBUS_OPTION_MEMBERSHIP_SOFTWARE, args->membership_software, ++ REALM_DBUS_OPTION_COMPUTER_PWD_LIFETIME, args->computer_password_lifetime, ++ REALM_DBUS_OPTION_HOST_KEYTAB, args->host_keytab, ++ REALM_DBUS_OPTION_HOST_FQDN, args->host_fqdn, + REALM_DBUS_OPTION_USE_LDAPS, args->use_ldaps ? "True" : "False", ++ REALM_DBUS_OPTION_ADD_SAMBA_DATA, args->add_samba_data ? "True" : "False", + NULL); + g_variant_ref_sink (options); + +@@ -138,7 +146,7 @@ realm_renew (RealmClient *client, + GOptionContext *context; + GError *error = NULL; + const gchar *realm_name; +- RealmRenewArgs args; ++ RealmRenewArgs args = { 0 }; + GOptionGroup *group; + gint ret = 0; + +@@ -147,6 +155,14 @@ realm_renew (RealmClient *client, + N_("Use specific membership software"), NULL }, + { "use-ldaps", 0, 0, G_OPTION_ARG_NONE, &args.use_ldaps, + N_("Use ldaps to connect to LDAP"), NULL }, ++ { "host-keytab", 0, 0, G_OPTION_ARG_STRING, &args.host_keytab, ++ N_("Path to the keytab"), NULL }, ++ { "host-fqdn", 0, 0, G_OPTION_ARG_STRING, &args.host_fqdn, ++ N_("Fully-qualified name of the host"), NULL }, ++ { "computer-password-lifetime", 0, 0, G_OPTION_ARG_STRING, &args.computer_password_lifetime, ++ N_("lifetime of the host accounts password in days"), NULL }, ++ { "add-samba-data", 0, 0, G_OPTION_ARG_NONE, &args.add_samba_data, ++ N_("Try to update Samba's internal machine account password as well"), NULL }, + { NULL, } + }; + +-- +2.51.0 + diff --git a/0003-renew-add-translatable-strings.patch b/0003-renew-add-translatable-strings.patch new file mode 100644 index 0000000..6bf1c04 --- /dev/null +++ b/0003-renew-add-translatable-strings.patch @@ -0,0 +1,21 @@ +From 24d1cb6392a95d2336a66b3538bfe42d4fe73289 Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Tue, 13 May 2025 13:08:10 +0200 +Subject: [PATCH] renew: add translatable strings + +--- + po/POTFILES.in | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/po/POTFILES.in b/po/POTFILES.in +index 140ed4c..2d8b266 100644 +--- a/po/POTFILES.in ++++ b/po/POTFILES.in +@@ -20,3 +20,4 @@ tools/realm-discover.c + tools/realm-join.c + tools/realm-leave.c + tools/realm-logins.c ++tools/realm-renew.c +-- +2.51.0 + diff --git a/0004-renew-fix-issues-found-by-Coverity.patch b/0004-renew-fix-issues-found-by-Coverity.patch new file mode 100644 index 0000000..e5b3dc4 --- /dev/null +++ b/0004-renew-fix-issues-found-by-Coverity.patch @@ -0,0 +1,47 @@ +From 5239baba5ac501358b28e8421935f2a102a57c0f Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Thu, 24 Apr 2025 11:38:35 +0200 +Subject: [PATCH] renew: fix issues found by Coverity + +--- + service/realm-kerberos.c | 4 ++-- + service/realm-sssd-ad.c | 1 - + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/service/realm-kerberos.c b/service/realm-kerberos.c +index 0cf2da0..2b617a5 100644 +--- a/service/realm-kerberos.c ++++ b/service/realm-kerberos.c +@@ -447,8 +447,6 @@ handle_renew (RealmDbusKerberosMembership *dbus_membership, + return TRUE; + } + +- method = method_closure_new (self, invocation); +- + if (iface->renew_async == NULL || iface->renew_finish == NULL) { + g_dbus_method_invocation_return_error (invocation, G_DBUS_ERROR, + G_DBUS_ERROR_UNKNOWN_METHOD, +@@ -456,6 +454,8 @@ handle_renew (RealmDbusKerberosMembership *dbus_membership, + return TRUE; + } + ++ method = method_closure_new (self, invocation); ++ + (iface->renew_async) (membership, options, invocation, on_renew_complete, method); + + return TRUE; +diff --git a/service/realm-sssd-ad.c b/service/realm-sssd-ad.c +index c04557b..249e796 100644 +--- a/service/realm-sssd-ad.c ++++ b/service/realm-sssd-ad.c +@@ -675,7 +675,6 @@ on_renew_done (GObject *source, + if (error != NULL) { + realm_diagnostics_error (renew->invocation, error, + "Task failed with: "); +- g_error_free (error); + g_task_return_error (task, error); + } else { + g_task_return_boolean (task, TRUE); +-- +2.51.0 + diff --git a/0005-doc-add-renew-option-of-realm-man-page.patch b/0005-doc-add-renew-option-of-realm-man-page.patch new file mode 100644 index 0000000..4d71e97 --- /dev/null +++ b/0005-doc-add-renew-option-of-realm-man-page.patch @@ -0,0 +1,90 @@ +From 5ad0311459db3e291db88e1b9c2bcde912698cce Mon Sep 17 00:00:00 2001 +From: Sumit Bose +Date: Tue, 14 Oct 2025 10:37:01 +0200 +Subject: [PATCH] doc: add 'renew' option of realm man page + +--- + doc/manual/realm.xml | 60 ++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 60 insertions(+) + +diff --git a/doc/manual/realm.xml b/doc/manual/realm.xml +index 0693283..caa6308 100644 +--- a/doc/manual/realm.xml ++++ b/doc/manual/realm.xml +@@ -38,6 +38,9 @@ + + realm leave -U user realm-name + ++ ++ realm renew realm-name ++ + + realm list + +@@ -407,6 +410,63 @@ $ realm leave domain.example.com + + + ++ ++ Renew ++ ++ Renew the machine account password and update the keytab. ++ ++ ++ ++$ realm renew ++ ++ ++$ realm renew --computer-password-lifetime=10 domain.example.com ++ ++ ++ ++ Renew the machine account password with the help of the existing one ++ from a keytab and store the new version in the keytab. If no domain name is ++ given it is derived from the existing configuration. ++ ++ The following options can be used: ++ ++ ++ ++ ++ Use specified membership software, currently ++ only adcli is supported. ++ ++ ++ ++ ++ See option description in ++ . ++ ++ ++ ++ Path to the keytab, if not specified the ++ default keytab file will be used. ++ ++ ++ ++ Fully-qualified name of the host, only needed ++ if it is not determined correctly automatically. ++ ++ ++ ++ ++ Lifetime of the machine account password in days, ++ default is 30. ++ ++ ++ ++ Try to update Samba's internal machine account ++ password as well if a membership software other than Samba is used. ++ ++ ++ ++ ++ + + List + +-- +2.51.0 + diff --git a/realmd.spec b/realmd.spec index 28ba2fc..d6bd2ec 100644 --- a/realmd.spec +++ b/realmd.spec @@ -1,6 +1,6 @@ Name: realmd Version: 0.17.1 -Release: 12%{?dist} +Release: 13%{?dist} Summary: Kerberos realm enrollment service License: LGPL-2.1-or-later URL: https://gitlab.freedesktop.org/realmd/realmd @@ -16,6 +16,12 @@ Patch0005: 0001-tools-fix-ccache-handling-for-leave-operation.patch Patch0006: 0001-Various-fixes-for-issues-found-by-static-code-scanne.patch Patch0007: 0002-krb5-add-realm_krb5_get_error_message.patch +# add renew command +Patch0008: 0001-Initial-implementation-of-a-renew-request.patch +Patch0009: 0002-renew-implement-support-for-adcli.patch +Patch0010: 0003-renew-add-translatable-strings.patch +Patch0011: 0004-renew-fix-issues-found-by-Coverity.patch +Patch0012: 0005-doc-add-renew-option-of-realm-man-page.patch BuildRequires: make BuildRequires: gcc @@ -102,6 +108,10 @@ make check %doc ChangeLog %changelog +* Tue Oct 14 2025 Sumit Bose - 0.17.1-13 +- add renew command + Resolves: RHEL-117645 + * Thu Feb 13 2025 Sumit Bose - 0.17.1-12 - Fixes for RHEL SAST Automation Resolves: RHEL-44992