From d4a7de2177e23b0396fbc7df15b7b8855ef4cfa6 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Thu, 8 Dec 2022 12:14:02 +0000 Subject: [PATCH] import sssd-2.8.1-1.el8 --- .gitignore | 2 +- .sssd.metadata | 2 +- ...-Makefile-remove-unneeded-dependency.patch | 51 --- ...context-mutex-outside-of-context-as-.patch | 155 --------- ...E_REQ-Fix-hybrid-lookup-log-spamming.patch | 36 --- ...04-Analyzer-Fix-escaping-raw-fstring.patch | 30 -- ...ore-appropriate-initial-value-for-fd.patch | 34 -- ...r-to-the-context-mutex-shouldn-t-be-.patch | 78 ----- ...-analyzer-to-work-without-SSSD-setup.patch | 33 -- ...008-RESPONDER-Fix-client-ID-tracking.patch | 297 ------------------ ...er-support-parallel-requests-parsing.patch | 185 ----------- SOURCES/0010-CLIENT-fix-client-fd-leak.patch | 295 ----------------- SPECS/sssd.spec | 56 +++- 13 files changed, 45 insertions(+), 1209 deletions(-) delete mode 100644 SOURCES/0001-Makefile-remove-unneeded-dependency.patch delete mode 100644 SOURCES/0002-CLIENT-MC-store-context-mutex-outside-of-context-as-.patch delete mode 100644 SOURCES/0003-CACHE_REQ-Fix-hybrid-lookup-log-spamming.patch delete mode 100644 SOURCES/0004-Analyzer-Fix-escaping-raw-fstring.patch delete mode 100644 SOURCES/0005-CLIENT-MC-1-is-more-appropriate-initial-value-for-fd.patch delete mode 100644 SOURCES/0006-CLIENT-MC-pointer-to-the-context-mutex-shouldn-t-be-.patch delete mode 100644 SOURCES/0007-SSSCTL-Allow-analyzer-to-work-without-SSSD-setup.patch delete mode 100644 SOURCES/0008-RESPONDER-Fix-client-ID-tracking.patch delete mode 100644 SOURCES/0009-Analyzer-support-parallel-requests-parsing.patch delete mode 100644 SOURCES/0010-CLIENT-fix-client-fd-leak.patch diff --git a/.gitignore b/.gitignore index f74e090..8a48e11 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/sssd-2.7.3.tar.gz +SOURCES/sssd-2.8.1.tar.gz diff --git a/.sssd.metadata b/.sssd.metadata index 6132eb6..a1864e7 100644 --- a/.sssd.metadata +++ b/.sssd.metadata @@ -1 +1 @@ -0e0df66226d7e0bfdff7315a0e5e08458c822c8d SOURCES/sssd-2.7.3.tar.gz +946608bad3cd09782912f6f6d68ba3bf21828a70 SOURCES/sssd-2.8.1.tar.gz diff --git a/SOURCES/0001-Makefile-remove-unneeded-dependency.patch b/SOURCES/0001-Makefile-remove-unneeded-dependency.patch deleted file mode 100644 index 271a5d8..0000000 --- a/SOURCES/0001-Makefile-remove-unneeded-dependency.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 4e9e83210601043abab6098f2bda67ae6704fe3e Mon Sep 17 00:00:00 2001 -From: Alexey Tikhonov -Date: Thu, 21 Jul 2022 20:16:32 +0200 -Subject: [PATCH] Makefile: remove unneeded dependency -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Reviewed-by: Justin Stephenson -Reviewed-by: Pavel Březina -(cherry picked from commit c6226c2986ffae9ed17562eb40407367ca37d23f) ---- - Makefile.am | 4 ---- - 1 file changed, 4 deletions(-) - -diff --git a/Makefile.am b/Makefile.am -index 669a0fc56..92d046888 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -1766,12 +1766,10 @@ sssd_kcm_CFLAGS = \ - $(KRB5_CFLAGS) \ - $(UUID_CFLAGS) \ - $(CURL_CFLAGS) \ -- $(JANSSON_CFLAGS) \ - $(NULL) - sssd_kcm_LDADD = \ - $(LIBADD_DL) \ - $(KRB5_LIBS) \ -- $(JANSSON_LIBS) \ - $(SSSD_LIBS) \ - $(UUID_LIBS) \ - $(SYSTEMD_DAEMON_LIBS) \ -@@ -3792,7 +3790,6 @@ test_kcm_marshalling_CFLAGS = \ - $(UUID_CFLAGS) \ - $(NULL) - test_kcm_marshalling_LDADD = \ -- $(JANSSON_LIBS) \ - $(UUID_LIBS) \ - $(KRB5_LIBS) \ - $(CMOCKA_LIBS) \ -@@ -3855,7 +3852,6 @@ test_kcm_renewals_LDFLAGS = \ - test_kcm_renewals_LDADD = \ - $(LIBADD_DL) \ - $(UUID_LIBS) \ -- $(JANSSON_LIBS) \ - $(KRB5_LIBS) \ - $(CARES_LIBS) \ - $(CMOCKA_LIBS) \ --- -2.37.1 - diff --git a/SOURCES/0002-CLIENT-MC-store-context-mutex-outside-of-context-as-.patch b/SOURCES/0002-CLIENT-MC-store-context-mutex-outside-of-context-as-.patch deleted file mode 100644 index 6caa8fc..0000000 --- a/SOURCES/0002-CLIENT-MC-store-context-mutex-outside-of-context-as-.patch +++ /dev/null @@ -1,155 +0,0 @@ -From 03142f8de42faf4f75465d24d3be9a49c2dd86f7 Mon Sep 17 00:00:00 2001 -From: Alexey Tikhonov -Date: Fri, 29 Jul 2022 14:57:20 +0200 -Subject: [PATCH] CLIENT:MC: store context mutex outside of context as it - should survive context destruction / re-initialization -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Reviewed-by: Iker Pedrosa -Reviewed-by: Pavel Březina -(cherry picked from commit 0f3a761ed9d654a61f8caed8eae3863c518b9911) ---- - src/sss_client/nss_mc.h | 4 ++-- - src/sss_client/nss_mc_common.c | 10 ++++++++-- - src/sss_client/nss_mc_group.c | 5 +++++ - src/sss_client/nss_mc_initgr.c | 5 +++++ - src/sss_client/nss_mc_passwd.c | 5 +++++ - src/sss_client/nss_mc_sid.c | 5 +++++ - 6 files changed, 30 insertions(+), 4 deletions(-) - -diff --git a/src/sss_client/nss_mc.h b/src/sss_client/nss_mc.h -index b66e8f09f..de1496ccc 100644 ---- a/src/sss_client/nss_mc.h -+++ b/src/sss_client/nss_mc.h -@@ -48,7 +48,7 @@ enum sss_mc_state { - struct sss_cli_mc_ctx { - enum sss_mc_state initialized; - #if HAVE_PTHREAD -- pthread_mutex_t mutex; -+ pthread_mutex_t *mutex; - #endif - int fd; - -@@ -67,7 +67,7 @@ struct sss_cli_mc_ctx { - }; - - #if HAVE_PTHREAD --#define SSS_CLI_MC_CTX_INITIALIZER {UNINITIALIZED, PTHREAD_MUTEX_INITIALIZER, 1, 0, NULL, 0, NULL, 0, NULL, 0, 0} -+#define SSS_CLI_MC_CTX_INITIALIZER(mtx) {UNINITIALIZED, (mtx), 1, 0, NULL, 0, NULL, 0, NULL, 0, 0} - #else - #define SSS_CLI_MC_CTX_INITIALIZER {UNINITIALIZED, 1, 0, NULL, 0, NULL, 0, NULL, 0, 0} - #endif -diff --git a/src/sss_client/nss_mc_common.c b/src/sss_client/nss_mc_common.c -index c73a93a9a..f38a4a85a 100644 ---- a/src/sss_client/nss_mc_common.c -+++ b/src/sss_client/nss_mc_common.c -@@ -58,14 +58,14 @@ do { \ - static void sss_mt_lock(struct sss_cli_mc_ctx *ctx) - { - #if HAVE_PTHREAD -- pthread_mutex_lock(&ctx->mutex); -+ pthread_mutex_lock(ctx->mutex); - #endif - } - - static void sss_mt_unlock(struct sss_cli_mc_ctx *ctx) - { - #if HAVE_PTHREAD -- pthread_mutex_unlock(&ctx->mutex); -+ pthread_mutex_unlock(ctx->mutex); - #endif - } - -@@ -131,6 +131,9 @@ errno_t sss_nss_check_header(struct sss_cli_mc_ctx *ctx) - static void sss_nss_mc_destroy_ctx(struct sss_cli_mc_ctx *ctx) - { - uint32_t active_threads = ctx->active_threads; -+#if HAVE_PTHREAD -+ pthread_mutex_t *mutex = ctx->mutex; -+#endif - - if ((ctx->mmap_base != NULL) && (ctx->mmap_size != 0)) { - munmap(ctx->mmap_base, ctx->mmap_size); -@@ -143,6 +146,9 @@ static void sss_nss_mc_destroy_ctx(struct sss_cli_mc_ctx *ctx) - - /* restore count of active threads */ - ctx->active_threads = active_threads; -+#if HAVE_PTHREAD -+ ctx->mutex = mutex; -+#endif - } - - static errno_t sss_nss_mc_init_ctx(const char *name, -diff --git a/src/sss_client/nss_mc_group.c b/src/sss_client/nss_mc_group.c -index 2ea40c435..d4f2a82ab 100644 ---- a/src/sss_client/nss_mc_group.c -+++ b/src/sss_client/nss_mc_group.c -@@ -29,7 +29,12 @@ - #include "nss_mc.h" - #include "shared/safealign.h" - -+#if HAVE_PTHREAD -+static pthread_mutex_t gr_mc_ctx_mutex = PTHREAD_MUTEX_INITIALIZER; -+static struct sss_cli_mc_ctx gr_mc_ctx = SSS_CLI_MC_CTX_INITIALIZER(&gr_mc_ctx_mutex); -+#else - static struct sss_cli_mc_ctx gr_mc_ctx = SSS_CLI_MC_CTX_INITIALIZER; -+#endif - - static errno_t sss_nss_mc_parse_result(struct sss_mc_rec *rec, - struct group *result, -diff --git a/src/sss_client/nss_mc_initgr.c b/src/sss_client/nss_mc_initgr.c -index b05946263..bd7282935 100644 ---- a/src/sss_client/nss_mc_initgr.c -+++ b/src/sss_client/nss_mc_initgr.c -@@ -32,7 +32,12 @@ - #include "nss_mc.h" - #include "shared/safealign.h" - -+#if HAVE_PTHREAD -+static pthread_mutex_t initgr_mc_ctx_mutex = PTHREAD_MUTEX_INITIALIZER; -+static struct sss_cli_mc_ctx initgr_mc_ctx = SSS_CLI_MC_CTX_INITIALIZER(&initgr_mc_ctx_mutex); -+#else - static struct sss_cli_mc_ctx initgr_mc_ctx = SSS_CLI_MC_CTX_INITIALIZER; -+#endif - - static errno_t sss_nss_mc_parse_result(struct sss_mc_rec *rec, - long int *start, long int *size, -diff --git a/src/sss_client/nss_mc_passwd.c b/src/sss_client/nss_mc_passwd.c -index 01c6801da..256d48444 100644 ---- a/src/sss_client/nss_mc_passwd.c -+++ b/src/sss_client/nss_mc_passwd.c -@@ -28,7 +28,12 @@ - #include - #include "nss_mc.h" - -+#if HAVE_PTHREAD -+static pthread_mutex_t pw_mc_ctx_mutex = PTHREAD_MUTEX_INITIALIZER; -+static struct sss_cli_mc_ctx pw_mc_ctx = SSS_CLI_MC_CTX_INITIALIZER(&pw_mc_ctx_mutex); -+#else - static struct sss_cli_mc_ctx pw_mc_ctx = SSS_CLI_MC_CTX_INITIALIZER; -+#endif - - static errno_t sss_nss_mc_parse_result(struct sss_mc_rec *rec, - struct passwd *result, -diff --git a/src/sss_client/nss_mc_sid.c b/src/sss_client/nss_mc_sid.c -index af7d7bbd5..52e684da5 100644 ---- a/src/sss_client/nss_mc_sid.c -+++ b/src/sss_client/nss_mc_sid.c -@@ -30,7 +30,12 @@ - #include "util/mmap_cache.h" - #include "idmap/sss_nss_idmap.h" - -+#if HAVE_PTHREAD -+static pthread_mutex_t sid_mc_ctx_mutex = PTHREAD_MUTEX_INITIALIZER; -+static struct sss_cli_mc_ctx sid_mc_ctx = SSS_CLI_MC_CTX_INITIALIZER(&sid_mc_ctx_mutex); -+#else - static struct sss_cli_mc_ctx sid_mc_ctx = SSS_CLI_MC_CTX_INITIALIZER; -+#endif - - static errno_t mc_get_sid_by_typed_id(uint32_t id, enum sss_id_type object_type, - char **sid, uint32_t *type, --- -2.37.1 - diff --git a/SOURCES/0003-CACHE_REQ-Fix-hybrid-lookup-log-spamming.patch b/SOURCES/0003-CACHE_REQ-Fix-hybrid-lookup-log-spamming.patch deleted file mode 100644 index 965ceaa..0000000 --- a/SOURCES/0003-CACHE_REQ-Fix-hybrid-lookup-log-spamming.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 49eb871847a94311bbd2190a315230e4bae1ea2c Mon Sep 17 00:00:00 2001 -From: Justin Stephenson -Date: Mon, 1 Aug 2022 09:54:51 -0400 -Subject: [PATCH] CACHE_REQ: Fix hybrid lookup log spamming -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Skip calling cache_req_data_set_hybrid_lookup() when hybrid data -is NULL for certain NSS request types (e.g. Service by Name). - -Reviewed-by: Alexey Tikhonov -Reviewed-by: Pavel Březina -(cherry picked from commit 96a1dce8096d45e986ab01aaac11d8c77c36d1d7) ---- - src/responder/nss/nss_get_object.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/src/responder/nss/nss_get_object.c b/src/responder/nss/nss_get_object.c -index 9762d6bfe..5a2e7e9bd 100644 ---- a/src/responder/nss/nss_get_object.c -+++ b/src/responder/nss/nss_get_object.c -@@ -171,7 +171,9 @@ hybrid_domain_retry_data(TALLOC_CTX *mem_ctx, - input_name); - } - -- cache_req_data_set_hybrid_lookup(hybrid_data, true); -+ if (hybrid_data != NULL) { -+ cache_req_data_set_hybrid_lookup(hybrid_data, true); -+ } - - return hybrid_data; - } --- -2.37.1 - diff --git a/SOURCES/0004-Analyzer-Fix-escaping-raw-fstring.patch b/SOURCES/0004-Analyzer-Fix-escaping-raw-fstring.patch deleted file mode 100644 index 7f87ccc..0000000 --- a/SOURCES/0004-Analyzer-Fix-escaping-raw-fstring.patch +++ /dev/null @@ -1,30 +0,0 @@ -From f90205831c44cc2849c7221e5117b6af808411c3 Mon Sep 17 00:00:00 2001 -From: Justin Stephenson -Date: Thu, 14 Jul 2022 11:21:04 -0400 -Subject: [PATCH] Analyzer: Fix escaping raw fstring - -Reviewed-by: Alexey Tikhonov -Reviewed-by: Iker Pedrosa -(cherry picked from commit 3d8622031b5240e215201aae1f9c9d05624cca19) ---- - src/tools/analyzer/modules/request.py | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/tools/analyzer/modules/request.py b/src/tools/analyzer/modules/request.py -index b8dd9b25c..935e13adc 100644 ---- a/src/tools/analyzer/modules/request.py -+++ b/src/tools/analyzer/modules/request.py -@@ -243,8 +243,8 @@ class RequestAnalyzer: - be_results = False - component = source.Component.NSS - resp = "nss" -- pattern = [rf'REQ_TRACE.*\[CID #{cid}\\]'] -- pattern.append(rf"\[CID#{cid}\\]") -+ pattern = [rf'REQ_TRACE.*\[CID #{cid}\]'] -+ pattern.append(rf"\[CID#{cid}\]") - - if args.pam: - component = source.Component.PAM --- -2.37.1 - diff --git a/SOURCES/0005-CLIENT-MC-1-is-more-appropriate-initial-value-for-fd.patch b/SOURCES/0005-CLIENT-MC-1-is-more-appropriate-initial-value-for-fd.patch deleted file mode 100644 index a820d44..0000000 --- a/SOURCES/0005-CLIENT-MC-1-is-more-appropriate-initial-value-for-fd.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 0eae0862069e4bbbdd87b809193fc873f3003cff Mon Sep 17 00:00:00 2001 -From: Alexey Tikhonov -Date: Tue, 16 Aug 2022 21:48:43 +0200 -Subject: [PATCH 5/6] CLIENT:MC: -1 is more appropriate initial value for fd -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Reviewed-by: Sumit Bose -Reviewed-by: Tomáš Halman -(cherry picked from commit 579cc0b266d5f8954bc71cfcd3fe68002d681a5f) ---- - src/sss_client/nss_mc.h | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/sss_client/nss_mc.h b/src/sss_client/nss_mc.h -index de1496ccc..0f88521e9 100644 ---- a/src/sss_client/nss_mc.h -+++ b/src/sss_client/nss_mc.h -@@ -67,9 +67,9 @@ struct sss_cli_mc_ctx { - }; - - #if HAVE_PTHREAD --#define SSS_CLI_MC_CTX_INITIALIZER(mtx) {UNINITIALIZED, (mtx), 1, 0, NULL, 0, NULL, 0, NULL, 0, 0} -+#define SSS_CLI_MC_CTX_INITIALIZER(mtx) {UNINITIALIZED, (mtx), -1, 0, NULL, 0, NULL, 0, NULL, 0, 0} - #else --#define SSS_CLI_MC_CTX_INITIALIZER {UNINITIALIZED, 1, 0, NULL, 0, NULL, 0, NULL, 0, 0} -+#define SSS_CLI_MC_CTX_INITIALIZER {UNINITIALIZED, -1, 0, NULL, 0, NULL, 0, NULL, 0, 0} - #endif - - errno_t sss_nss_mc_get_ctx(const char *name, struct sss_cli_mc_ctx *ctx); --- -2.37.1 - diff --git a/SOURCES/0006-CLIENT-MC-pointer-to-the-context-mutex-shouldn-t-be-.patch b/SOURCES/0006-CLIENT-MC-pointer-to-the-context-mutex-shouldn-t-be-.patch deleted file mode 100644 index f759975..0000000 --- a/SOURCES/0006-CLIENT-MC-pointer-to-the-context-mutex-shouldn-t-be-.patch +++ /dev/null @@ -1,78 +0,0 @@ -From d386e94ef49d95d7305a3e6578e41a2cf61dfc5c Mon Sep 17 00:00:00 2001 -From: Alexey Tikhonov -Date: Tue, 16 Aug 2022 21:51:03 +0200 -Subject: [PATCH 6/6] CLIENT:MC: pointer to the context mutex shouldn't be - touched -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Even brief window inside `sss_nss_mc_destroy_ctx()` when `mutex == NULL` -was creating a possibility for a race. - -Reviewed-by: Sumit Bose -Reviewed-by: Tomáš Halman -(cherry picked from commit 4ac93d9c5df59cdb7f397b4467f1c1c4822ff757) ---- - src/sss_client/nss_mc.h | 4 +++- - src/sss_client/nss_mc_common.c | 20 ++++++++++---------- - 2 files changed, 13 insertions(+), 11 deletions(-) - -diff --git a/src/sss_client/nss_mc.h b/src/sss_client/nss_mc.h -index 0f88521e9..9ab2736fa 100644 ---- a/src/sss_client/nss_mc.h -+++ b/src/sss_client/nss_mc.h -@@ -44,7 +44,9 @@ enum sss_mc_state { - RECYCLED, - }; - --/* common stuff */ -+/* In the case this structure is extended, don't forget to update -+ * `SSS_CLI_MC_CTX_INITIALIZER` and `sss_nss_mc_destroy_ctx()`. -+ */ - struct sss_cli_mc_ctx { - enum sss_mc_state initialized; - #if HAVE_PTHREAD -diff --git a/src/sss_client/nss_mc_common.c b/src/sss_client/nss_mc_common.c -index f38a4a85a..3128861bf 100644 ---- a/src/sss_client/nss_mc_common.c -+++ b/src/sss_client/nss_mc_common.c -@@ -130,25 +130,25 @@ errno_t sss_nss_check_header(struct sss_cli_mc_ctx *ctx) - - static void sss_nss_mc_destroy_ctx(struct sss_cli_mc_ctx *ctx) - { -- uint32_t active_threads = ctx->active_threads; --#if HAVE_PTHREAD -- pthread_mutex_t *mutex = ctx->mutex; --#endif - - if ((ctx->mmap_base != NULL) && (ctx->mmap_size != 0)) { - munmap(ctx->mmap_base, ctx->mmap_size); - } -+ ctx->mmap_base = NULL; -+ ctx->mmap_size = 0; -+ - if (ctx->fd != -1) { - close(ctx->fd); - } -- memset(ctx, 0, sizeof(struct sss_cli_mc_ctx)); - ctx->fd = -1; - -- /* restore count of active threads */ -- ctx->active_threads = active_threads; --#if HAVE_PTHREAD -- ctx->mutex = mutex; --#endif -+ ctx->seed = 0; -+ ctx->data_table = NULL; -+ ctx->dt_size = 0; -+ ctx->hash_table = NULL; -+ ctx->ht_size = 0; -+ ctx->initialized = UNINITIALIZED; -+ /* `mutex` and `active_threads` should be left intact */ - } - - static errno_t sss_nss_mc_init_ctx(const char *name, --- -2.37.1 - diff --git a/SOURCES/0007-SSSCTL-Allow-analyzer-to-work-without-SSSD-setup.patch b/SOURCES/0007-SSSCTL-Allow-analyzer-to-work-without-SSSD-setup.patch deleted file mode 100644 index 0e06c29..0000000 --- a/SOURCES/0007-SSSCTL-Allow-analyzer-to-work-without-SSSD-setup.patch +++ /dev/null @@ -1,33 +0,0 @@ -From f8704cc24eafe190e6c78dc21535f6029d51d647 Mon Sep 17 00:00:00 2001 -From: Justin Stephenson -Date: Mon, 15 Aug 2022 16:17:59 -0400 -Subject: [PATCH] SSSCTL: Allow analyzer to work without SSSD setup - -Fixes an issue when the sssctl analyzer option is -used on systems where SSSD is not running or configured. This is -an expected use case when using --logdir option to analyze external -log files. - -Resolves: https://github.com/SSSD/sssd/issues/6298 - -Reviewed-by: Alexey Tikhonov ---- - src/tools/sssctl/sssctl.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/tools/sssctl/sssctl.c b/src/tools/sssctl/sssctl.c -index 3816125ad..f18689f9f 100644 ---- a/src/tools/sssctl/sssctl.c -+++ b/src/tools/sssctl/sssctl.c -@@ -296,7 +296,7 @@ int main(int argc, const char **argv) - SSS_TOOL_COMMAND("logs-remove", "Remove existing SSSD log files", 0, sssctl_logs_remove), - SSS_TOOL_COMMAND("logs-fetch", "Archive SSSD log files in tarball", 0, sssctl_logs_fetch), - SSS_TOOL_COMMAND("debug-level", "Change SSSD debug level", 0, sssctl_debug_level), -- SSS_TOOL_COMMAND("analyze", "Analyze logged data", 0, sssctl_analyze), -+ SSS_TOOL_COMMAND_FLAGS("analyze", "Analyze logged data", 0, sssctl_analyze, SSS_TOOL_FLAG_SKIP_CMD_INIT), - #ifdef HAVE_LIBINI_CONFIG_V1_3 - SSS_TOOL_DELIMITER("Configuration files tools:"), - SSS_TOOL_COMMAND_FLAGS("config-check", "Perform static analysis of SSSD configuration", 0, sssctl_config_check, SSS_TOOL_FLAG_SKIP_CMD_INIT), --- -2.37.1 - diff --git a/SOURCES/0008-RESPONDER-Fix-client-ID-tracking.patch b/SOURCES/0008-RESPONDER-Fix-client-ID-tracking.patch deleted file mode 100644 index 769e082..0000000 --- a/SOURCES/0008-RESPONDER-Fix-client-ID-tracking.patch +++ /dev/null @@ -1,297 +0,0 @@ -From e6d450d4f67c3c639a6ab7e891adccc361d80ecd Mon Sep 17 00:00:00 2001 -From: Justin Stephenson -Date: Fri, 19 Aug 2022 09:50:22 -0400 -Subject: [PATCH 8/9] RESPONDER: Fix client ID tracking -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Client ID is not stored properly to match requests -when parallel requests are made to client SSSD - -Resolves: https://github.com/SSSD/sssd/issues/6307 - -Reviewed-by: Alexey Tikhonov -Reviewed-by: Pavel Březina - -Reviewed-by: Alexey Tikhonov ---- - src/responder/common/cache_req/cache_req.c | 5 +++-- - .../plugins/cache_req_autofs_entry_by_name.c | 3 ++- - .../cache_req/plugins/cache_req_autofs_map_by_name.c | 3 ++- - .../cache_req/plugins/cache_req_autofs_map_entries.c | 3 ++- - .../plugins/cache_req_ssh_host_id_by_name.c | 3 ++- - src/responder/common/responder.h | 2 +- - src/responder/common/responder_common.c | 12 +++++++----- - src/responder/common/responder_dp.c | 5 +++-- - src/responder/common/responder_get_domains.c | 3 ++- - src/responder/pam/pamsrv_cmd.c | 4 ++-- - 10 files changed, 26 insertions(+), 17 deletions(-) - -diff --git a/src/responder/common/cache_req/cache_req.c b/src/responder/common/cache_req/cache_req.c -index 4dd45b038..bc65bae71 100644 ---- a/src/responder/common/cache_req/cache_req.c -+++ b/src/responder/common/cache_req/cache_req.c -@@ -24,6 +24,7 @@ - #include - - #include "util/util.h" -+#include "util/sss_chain_id.h" - #include "responder/common/responder.h" - #include "responder/common/cache_req/cache_req_private.h" - #include "responder/common/cache_req/cache_req_plugin.h" -@@ -1124,8 +1125,8 @@ struct tevent_req *cache_req_send(TALLOC_CTX *mem_ctx, - } - state->first_iteration = true; - -- SSS_REQ_TRACE_CID_CR(SSSDBG_TRACE_FUNC, cr, "New request [CID #%u] '%s'\n", -- rctx->client_id_num, cr->reqname); -+ SSS_REQ_TRACE_CID_CR(SSSDBG_TRACE_FUNC, cr, "New request [CID #%lu] '%s'\n", -+ sss_chain_id_get(), cr->reqname); - - ret = cache_req_is_well_known_object(state, cr, &result); - if (ret == EOK) { -diff --git a/src/responder/common/cache_req/plugins/cache_req_autofs_entry_by_name.c b/src/responder/common/cache_req/plugins/cache_req_autofs_entry_by_name.c -index 788b6708c..b2b0a06eb 100644 ---- a/src/responder/common/cache_req/plugins/cache_req_autofs_entry_by_name.c -+++ b/src/responder/common/cache_req/plugins/cache_req_autofs_entry_by_name.c -@@ -24,6 +24,7 @@ - #include "db/sysdb.h" - #include "db/sysdb_autofs.h" - #include "util/util.h" -+#include "util/sss_chain_id.h" - #include "providers/data_provider.h" - #include "responder/common/cache_req/cache_req_plugin.h" - -@@ -86,7 +87,7 @@ cache_req_autofs_entry_by_name_dp_send(TALLOC_CTX *mem_ctx, - be_conn->bus_name, SSS_BUS_PATH, - 0, data->name.name, - data->autofs_entry_name, -- cr->rctx->client_id_num); -+ sss_chain_id_get()); - } - - bool -diff --git a/src/responder/common/cache_req/plugins/cache_req_autofs_map_by_name.c b/src/responder/common/cache_req/plugins/cache_req_autofs_map_by_name.c -index 5d82641cc..23b11b1cd 100644 ---- a/src/responder/common/cache_req/plugins/cache_req_autofs_map_by_name.c -+++ b/src/responder/common/cache_req/plugins/cache_req_autofs_map_by_name.c -@@ -24,6 +24,7 @@ - #include "db/sysdb.h" - #include "db/sysdb_autofs.h" - #include "util/util.h" -+#include "util/sss_chain_id.h" - #include "providers/data_provider.h" - #include "responder/common/cache_req/cache_req_plugin.h" - -@@ -82,7 +83,7 @@ cache_req_autofs_map_by_name_dp_send(TALLOC_CTX *mem_ctx, - return sbus_call_dp_autofs_GetMap_send(mem_ctx, be_conn->conn, - be_conn->bus_name, SSS_BUS_PATH, - 0, data->name.name, -- cr->rctx->client_id_num); -+ sss_chain_id_get()); - } - - bool -diff --git a/src/responder/common/cache_req/plugins/cache_req_autofs_map_entries.c b/src/responder/common/cache_req/plugins/cache_req_autofs_map_entries.c -index 29f289723..18c08ca39 100644 ---- a/src/responder/common/cache_req/plugins/cache_req_autofs_map_entries.c -+++ b/src/responder/common/cache_req/plugins/cache_req_autofs_map_entries.c -@@ -24,6 +24,7 @@ - #include "db/sysdb.h" - #include "db/sysdb_autofs.h" - #include "util/util.h" -+#include "util/sss_chain_id.h" - #include "providers/data_provider.h" - #include "responder/common/cache_req/cache_req_plugin.h" - -@@ -114,7 +115,7 @@ cache_req_autofs_map_entries_dp_send(TALLOC_CTX *mem_ctx, - return sbus_call_dp_autofs_Enumerate_send(mem_ctx, be_conn->conn, - be_conn->bus_name, SSS_BUS_PATH, - 0, data->name.name, -- cr->rctx->client_id_num); -+ sss_chain_id_get()); - } - - bool -diff --git a/src/responder/common/cache_req/plugins/cache_req_ssh_host_id_by_name.c b/src/responder/common/cache_req/plugins/cache_req_ssh_host_id_by_name.c -index a8b8f47a8..29f52f10d 100644 ---- a/src/responder/common/cache_req/plugins/cache_req_ssh_host_id_by_name.c -+++ b/src/responder/common/cache_req/plugins/cache_req_ssh_host_id_by_name.c -@@ -23,6 +23,7 @@ - - #include "db/sysdb_ssh.h" - #include "util/util.h" -+#include "util/sss_chain_id.h" - #include "providers/data_provider.h" - #include "responder/common/cache_req/cache_req_plugin.h" - -@@ -86,7 +87,7 @@ cache_req_host_by_name_dp_send(TALLOC_CTX *mem_ctx, - return sbus_call_dp_dp_hostHandler_send(mem_ctx, be_conn->conn, - be_conn->bus_name, SSS_BUS_PATH, - 0, data->name.name, data->alias, -- cr->rctx->client_id_num); -+ sss_chain_id_get()); - } - - static bool -diff --git a/src/responder/common/responder.h b/src/responder/common/responder.h -index 5cb79e3e6..259b3ff13 100644 ---- a/src/responder/common/responder.h -+++ b/src/responder/common/responder.h -@@ -165,13 +165,13 @@ struct cli_ctx { - - struct cli_creds *creds; - char *cmd_line; -- uint64_t old_chain_id; - - void *protocol_ctx; - void *state_ctx; - - struct tevent_timer *idle; - time_t last_request_time; -+ uint32_t client_id_num; - }; - - struct sss_cmd_table { -diff --git a/src/responder/common/responder_common.c b/src/responder/common/responder_common.c -index 6e3b61ef0..a4ba8ea71 100644 ---- a/src/responder/common/responder_common.c -+++ b/src/responder/common/responder_common.c -@@ -87,8 +87,6 @@ static void client_close_fn(struct tevent_context *ev, - "Failed to close fd [%d]: [%s]\n", - ctx->cfd, strerror(ret)); - } -- /* Restore the original chain id */ -- sss_chain_id_set(ctx->old_chain_id); - - DEBUG(SSSDBG_TRACE_INTERNAL, - "Terminated client [%p][%d]\n", -@@ -526,7 +524,6 @@ static void accept_fd_handler(struct tevent_context *ev, - int fd = accept_ctx->is_private ? rctx->priv_lfd : rctx->lfd; - - rctx->client_id_num++; -- - if (accept_ctx->is_private) { - ret = stat(rctx->priv_sock_name, &stat_buf); - if (ret == -1) { -@@ -557,6 +554,8 @@ static void accept_fd_handler(struct tevent_context *ev, - - talloc_set_destructor(cctx, cli_ctx_destructor); - -+ cctx->client_id_num = rctx->client_id_num; -+ - len = sizeof(cctx->addr); - cctx->cfd = accept(fd, (struct sockaddr *)&cctx->addr, &len); - if (cctx->cfd == -1) { -@@ -645,7 +644,7 @@ static void accept_fd_handler(struct tevent_context *ev, - - DEBUG(SSSDBG_TRACE_FUNC, - "[CID#%u] Client [cmd %s][uid %u][%p][%d] connected%s!\n", -- rctx->client_id_num, cctx->cmd_line, cli_creds_get_uid(cctx->creds), -+ cctx->client_id_num, cctx->cmd_line, cli_creds_get_uid(cctx->creds), - cctx, cctx->cfd, accept_ctx->is_private ? " to privileged pipe" : ""); - - return; -@@ -1090,6 +1089,7 @@ void sss_client_fd_handler(void *ptr, - uint16_t flags) - { - errno_t ret; -+ uint64_t old_chain_id; - struct cli_ctx *cctx = talloc_get_type(ptr, struct cli_ctx); - - /* Always reset the responder idle timer on any activity */ -@@ -1105,7 +1105,7 @@ void sss_client_fd_handler(void *ptr, - } - - /* Set the chain id */ -- cctx->old_chain_id = sss_chain_id_set(cctx->rctx->client_id_num); -+ old_chain_id = sss_chain_id_set(cctx->client_id_num); - - if (flags & TEVENT_FD_READ) { - recv_fn(cctx); -@@ -1116,6 +1116,8 @@ void sss_client_fd_handler(void *ptr, - send_fn(cctx); - return; - } -+ /* Restore the original chain id */ -+ sss_chain_id_set(old_chain_id); - } - - int sss_connection_setup(struct cli_ctx *cctx) -diff --git a/src/responder/common/responder_dp.c b/src/responder/common/responder_dp.c -index d549e02d3..4b4770da1 100644 ---- a/src/responder/common/responder_dp.c -+++ b/src/responder/common/responder_dp.c -@@ -23,6 +23,7 @@ - #include - #include - #include "util/util.h" -+#include "util/sss_chain_id.h" - #include "responder/common/responder_packet.h" - #include "responder/common/responder.h" - #include "providers/data_provider.h" -@@ -276,7 +277,7 @@ sss_dp_get_account_send(TALLOC_CTX *mem_ctx, - subreq = sbus_call_dp_dp_getAccountInfo_send(state, be_conn->conn, - be_conn->bus_name, SSS_BUS_PATH, dp_flags, - entry_type, filter, dom->name, extra, -- rctx->client_id_num); -+ sss_chain_id_get()); - if (subreq == NULL) { - DEBUG(SSSDBG_CRIT_FAILURE, "Unable to create subrequest!\n"); - ret = ENOMEM; -@@ -406,7 +407,7 @@ sss_dp_resolver_get_send(TALLOC_CTX *mem_ctx, - SSS_BUS_PATH, - dp_flags, entry_type, - filter_type, filter_value, -- rctx->client_id_num); -+ sss_chain_id_get()); - if (subreq == NULL) { - DEBUG(SSSDBG_CRIT_FAILURE, "Unable to create subrequest!\n"); - ret = ENOMEM; -diff --git a/src/responder/common/responder_get_domains.c b/src/responder/common/responder_get_domains.c -index 918124756..aeff28d73 100644 ---- a/src/responder/common/responder_get_domains.c -+++ b/src/responder/common/responder_get_domains.c -@@ -19,6 +19,7 @@ - */ - - #include "util/util.h" -+#include "util/sss_chain_id.h" - #include "responder/common/responder.h" - #include "providers/data_provider.h" - #include "db/sysdb.h" -@@ -751,7 +752,7 @@ sss_dp_get_account_domain_send(TALLOC_CTX *mem_ctx, - be_conn->bus_name, - SSS_BUS_PATH, dp_flags, - entry_type, filter, -- rctx->client_id_num); -+ sss_chain_id_get()); - if (subreq == NULL) { - DEBUG(SSSDBG_CRIT_FAILURE, "Unable to create subrequest!\n"); - ret = ENOMEM; -diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c -index cb0e1b82f..1695554fc 100644 ---- a/src/responder/pam/pamsrv_cmd.c -+++ b/src/responder/pam/pamsrv_cmd.c -@@ -1492,7 +1492,7 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd) - } - preq->cctx = cctx; - preq->cert_auth_local = false; -- preq->client_id_num = pctx->rctx->client_id_num; -+ preq->client_id_num = cctx->client_id_num; - - preq->pd = create_pam_data(preq); - if (!preq->pd) { -@@ -1513,7 +1513,7 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd) - - pd->cmd = pam_cmd; - pd->priv = cctx->priv; -- pd->client_id_num = pctx->rctx->client_id_num; -+ pd->client_id_num = cctx->client_id_num; - - ret = pam_forwarder_parse_data(cctx, pd); - if (ret == EAGAIN) { --- -2.37.1 - diff --git a/SOURCES/0009-Analyzer-support-parallel-requests-parsing.patch b/SOURCES/0009-Analyzer-support-parallel-requests-parsing.patch deleted file mode 100644 index b2c49e1..0000000 --- a/SOURCES/0009-Analyzer-support-parallel-requests-parsing.patch +++ /dev/null @@ -1,185 +0,0 @@ -From d22ea2df62b6e245eef75d7201b678601bf63e98 Mon Sep 17 00:00:00 2001 -From: Justin Stephenson -Date: Fri, 19 Aug 2022 14:44:11 -0400 -Subject: [PATCH 9/9] Analyzer: support parallel requests parsing -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Analyzer code(primarily the list verbose command) needs -changes to handle parsing the necessary lines from -NSS/PAM log files when multiple intermixed/parallel -client requests are sent to SSSD. - -Resolves: https://github.com/SSSD/sssd/issues/6307 - -Reviewed-by: Alexey Tikhonov -Reviewed-by: Pavel Březina - -Reviewed-by: Alexey Tikhonov ---- - src/tools/analyzer/modules/request.py | 119 +++++++++++++++----------- - 1 file changed, 67 insertions(+), 52 deletions(-) - -diff --git a/src/tools/analyzer/modules/request.py b/src/tools/analyzer/modules/request.py -index 935e13adc..b9fe3caf8 100644 ---- a/src/tools/analyzer/modules/request.py -+++ b/src/tools/analyzer/modules/request.py -@@ -16,7 +16,6 @@ class RequestAnalyzer: - """ - module_parser = None - consumed_logs = [] -- done = "" - list_opts = [ - Option('--verbose', 'Verbose output', bool, '-v'), - Option('--pam', 'Filter only PAM requests', bool), -@@ -149,58 +148,74 @@ class RequestAnalyzer: - print(line) - return found_results - -- def print_formatted(self, line, verbose): -+ def print_formatted_verbose(self, source, patterns): -+ """ -+ Parse line and print formatted verbose list_requests output -+ -+ Args: -+ source (Reader): source Reader object -+ patterns (list): List of regex patterns to use for -+ matching lines -+ """ -+ # Get CID number, and print the basic line first -+ for line in self.matched_line(source, patterns): -+ cid = self.print_formatted(line) -+ -+ # Loop through each line with this CID number to extract and -+ # print the verbose data needed -+ verbose_patterns = ["(cache_req_send|cache_req_process_input|" -+ "cache_req_search_send)"] -+ for cidline in self.matched_line(source, verbose_patterns): -+ plugin = "" -+ name = "" -+ id = "" -+ -+ # skip any lines not pertaining to this CID -+ if f"CID#{cid}]" not in cidline: -+ continue -+ if "refreshed" in cidline: -+ continue -+ # CR Plugin name -+ if re.search("cache_req_send", cidline): -+ plugin = cidline.split('\'')[1] -+ # CR Input name -+ elif re.search("cache_req_process_input", cidline): -+ name = cidline.rsplit('[')[-1] -+ # CR Input id -+ elif re.search("cache_req_search_send", cidline): -+ id = cidline.rsplit()[-1] -+ -+ if plugin: -+ print(" - " + plugin) -+ if name: -+ print(" - " + name[:-2]) -+ if (id and ("UID" in cidline or "GID" in cidline)): -+ print(" - " + id) -+ -+ def print_formatted(self, line): - """ - Parse line and print formatted list_requests output - - Args: - line (str): line to parse -- verbose (bool): If true, enable verbose output -+ Returns: -+ Client ID from printed line, 0 otherwise - """ -- plugin = "" -- name = "" -- id = "" -- - # exclude backtrace logs - if line.startswith(' * '): -- return -- fields = line.split("[") -- cr_field = fields[3][7:] -- cr = cr_field.split(":")[0][4:] -+ return 0 - if "refreshed" in line: -- return -- # CR Plugin name -- if re.search("cache_req_send", line): -- plugin = line.split('\'')[1] -- # CR Input name -- elif re.search("cache_req_process_input", line): -- name = line.rsplit('[')[-1] -- # CR Input id -- elif re.search("cache_req_search_send", line): -- id = line.rsplit()[-1] -- # CID and client process name -- else: -- ts = line.split(")")[0] -- ts = ts[1:] -- fields = line.split("[") -- cid = fields[3][4:-9] -- cmd = fields[4][4:-1] -- uid = fields[5][4:-1] -- if not uid.isnumeric(): -- uid = fields[6][4:-1] -- print(f'{ts}: [uid {uid}] CID #{cid}: {cmd}') -- -- if verbose: -- if plugin: -- print(" - " + plugin) -- if name: -- if cr not in self.done: -- print(" - " + name[:-2]) -- self.done = cr -- if id: -- if cr not in self.done: -- print(" - " + id) -- self.done = cr -+ return 0 -+ ts = line.split(")")[0] -+ ts = ts[1:] -+ fields = line.split("[") -+ cid = fields[3][4:-9] -+ cmd = fields[4][4:-1] -+ uid = fields[5][4:-1] -+ if not uid.isnumeric(): -+ uid = fields[6][4:-1] -+ print(f'{ts}: [uid {uid}] CID #{cid}: {cmd}') -+ return cid - - def list_requests(self, args): - """ -@@ -215,20 +230,20 @@ class RequestAnalyzer: - # Log messages matching the following regex patterns contain - # the useful info we need to produce list output - patterns = [r'\[cmd'] -- patterns.append("(cache_req_send|cache_req_process_input|" -- "cache_req_search_send)") - if args.pam: - component = source.Component.PAM - resp = "pam" - - logger.info(f"******** Listing {resp} client requests ********") - source.set_component(component, False) -- self.done = "" -- for line in self.matched_line(source, patterns): -- if isinstance(source, Journald): -- print(line) -- else: -- self.print_formatted(line, args.verbose) -+ if args.verbose: -+ self.print_formatted_verbose(source, patterns) -+ else: -+ for line in self.matched_line(source, patterns): -+ if isinstance(source, Journald): -+ print(line) -+ else: -+ self.print_formatted(line) - - def track_request(self, args): - """ --- -2.37.1 - diff --git a/SOURCES/0010-CLIENT-fix-client-fd-leak.patch b/SOURCES/0010-CLIENT-fix-client-fd-leak.patch deleted file mode 100644 index 48622c8..0000000 --- a/SOURCES/0010-CLIENT-fix-client-fd-leak.patch +++ /dev/null @@ -1,295 +0,0 @@ -From 1b2e4760c52b9abd0d9b9f35b47ed72e79922ccc Mon Sep 17 00:00:00 2001 -From: Alexey Tikhonov -Date: Thu, 25 Aug 2022 18:10:46 +0200 -Subject: [PATCH] CLIENT: fix client fd leak - - - close client socket at thread exit - - only build lock-free client support if libc has required - functionality for a proper cleanup - - use proper mechanisms to init lock_mode only once - -:relnote:Lock-free client support will be only built if libc -provides `pthread_key_create()` and `pthread_once()`. For glibc -this means version 2.34+ - -Reviewed-by: Justin Stephenson -Reviewed-by: Sumit Bose -(cherry picked from commit 1a6f67c92399ff8e358a6c6cdda43fb2547a5fdb) ---- - configure.ac | 29 +++++++++-- - src/man/Makefile.am | 5 +- - src/man/sssd.8.xml | 2 +- - src/sss_client/common.c | 83 +++++++++++++++++++------------- - src/sss_client/idmap/common_ex.c | 4 ++ - 5 files changed, 84 insertions(+), 39 deletions(-) - -diff --git a/configure.ac b/configure.ac -index 93bd93b85..5a05de41e 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -51,18 +51,39 @@ AC_CHECK_TYPES([errno_t], [], [], [[#include ]]) - m4_include([src/build_macros.m4]) - BUILD_WITH_SHARED_BUILD_DIR - --AC_COMPILE_IFELSE( -+ -+SAVE_LIBS=$LIBS -+LIBS= -+AC_LINK_IFELSE( - [AC_LANG_PROGRAM([[#include ]], - [[pthread_mutex_t m = PTHREAD_MUTEX_INITIALIZER; -- (void) m; /* unused */ -+ pthread_mutex_lock(&m); -+ pthread_mutex_unlock(&m); - ]])], - [AC_DEFINE([HAVE_PTHREAD], [1], [Pthread mutexes available.]) - HAVE_PTHREAD=1 - ], -- [AC_MSG_WARN([Pthread library not found! Clients will not be thread safe...])]) -+ [AC_MSG_WARN([Pthread mutex support not found! Clients will not be thread safe...])]) -+LIBS=$SAVE_LIBS -+AM_CONDITIONAL([HAVE_PTHREAD], [test x"$HAVE_PTHREAD" != "x"]) - - --AM_CONDITIONAL([HAVE_PTHREAD], [test x"$HAVE_PTHREAD" != "x"]) -+SAVE_LIBS=$LIBS -+LIBS= -+AC_LINK_IFELSE( -+ [AC_LANG_PROGRAM([[#include ]], -+ [[static pthread_key_t k; -+ static pthread_once_t f = PTHREAD_ONCE_INIT; -+ pthread_once(&f, NULL); -+ pthread_key_create(&k, NULL); -+ ]])], -+ [AC_DEFINE([HAVE_PTHREAD_EXT], [1], [Extended pthread functionality is available.]) -+ HAVE_PTHREAD_EXT=1 -+ ], -+ [AC_MSG_WARN([Extended pthread functionality is not available. Lock-free client feature will not be built.])]) -+LIBS=$SAVE_LIBS -+AM_CONDITIONAL([BUILD_LOCKFREE_CLIENT], [test x"$HAVE_PTHREAD_EXT" != "x"]) -+ - - # Check library for the timer_create function - SAVE_LIBS=$LIBS -diff --git a/src/man/Makefile.am b/src/man/Makefile.am -index 93dd14819..063ff1bf0 100644 ---- a/src/man/Makefile.am -+++ b/src/man/Makefile.am -@@ -46,9 +46,12 @@ endif - if BUILD_KCM_RENEWAL - KCM_RENEWAL_CONDS = ;enable_kcm_renewal - endif -+if BUILD_LOCKFREE_CLIENT -+LOCKFREE_CLIENT_CONDS = ;enable_lockfree_support -+endif - - --CONDS = with_false$(SUDO_CONDS)$(AUTOFS_CONDS)$(SSH_CONDS)$(PAC_RESPONDER_CONDS)$(IFP_CONDS)$(GPO_CONDS)$(SYSTEMD_CONDS)$(FILES_CONDS)$(KCM_CONDS)$(STAP_CONDS)$(KCM_RENEWAL_CONDS) -+CONDS = with_false$(SUDO_CONDS)$(AUTOFS_CONDS)$(SSH_CONDS)$(PAC_RESPONDER_CONDS)$(IFP_CONDS)$(GPO_CONDS)$(SYSTEMD_CONDS)$(FILES_CONDS)$(KCM_CONDS)$(STAP_CONDS)$(KCM_RENEWAL_CONDS)$(LOCKFREE_CLIENT_CONDS) - - - #Special Rules: -diff --git a/src/man/sssd.8.xml b/src/man/sssd.8.xml -index df07b7f29..5f507c631 100644 ---- a/src/man/sssd.8.xml -+++ b/src/man/sssd.8.xml -@@ -240,7 +240,7 @@ - If the environment variable SSS_NSS_USE_MEMCACHE is set to "NO", - client applications will not use the fast in-memory cache. - -- -+ - If the environment variable SSS_LOCKFREE is set to "NO", requests - from multiple threads of a single application will be serialized. - -diff --git a/src/sss_client/common.c b/src/sss_client/common.c -index 29c751a50..d762dff49 100644 ---- a/src/sss_client/common.c -+++ b/src/sss_client/common.c -@@ -35,7 +35,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -62,8 +61,15 @@ - - /* common functions */ - -+#ifdef HAVE_PTHREAD_EXT -+static pthread_key_t sss_sd_key; -+static pthread_once_t sss_sd_key_initialized = PTHREAD_ONCE_INIT; - static __thread int sss_cli_sd = -1; /* the sss client socket descriptor */ - static __thread struct stat sss_cli_sb; /* the sss client stat buffer */ -+#else -+static int sss_cli_sd = -1; /* the sss client socket descriptor */ -+static struct stat sss_cli_sb; /* the sss client stat buffer */ -+#endif - - #if HAVE_FUNCTION_ATTRIBUTE_DESTRUCTOR - __attribute__((destructor)) -@@ -76,6 +82,18 @@ void sss_cli_close_socket(void) - } - } - -+#ifdef HAVE_PTHREAD_EXT -+static void sss_at_thread_exit(void *v) -+{ -+ sss_cli_close_socket(); -+} -+ -+static void init_sd_key(void) -+{ -+ pthread_key_create(&sss_sd_key, sss_at_thread_exit); -+} -+#endif -+ - /* Requests: - * - * byte 0-3: 32bit unsigned with length (the complete packet length: 0 to X) -@@ -553,6 +571,16 @@ static int sss_cli_open_socket(int *errnop, const char *socket_name, int timeout - return -1; - } - -+#ifdef HAVE_PTHREAD_EXT -+ pthread_once(&sss_sd_key_initialized, init_sd_key); /* once for all threads */ -+ -+ /* It actually doesn't matter what value to set for a key. -+ * The only important thing: key must be non-NULL to ensure -+ * destructor is executed at thread exit. -+ */ -+ pthread_setspecific(sss_sd_key, &sss_cli_sd); -+#endif -+ - /* set as non-blocking, close on exec, and make sure standard - * descriptors are not used */ - sd = make_safe_fd(sd); -@@ -1129,41 +1157,38 @@ errno_t sss_strnlen(const char *str, size_t maxlen, size_t *len) - } - - #if HAVE_PTHREAD --bool sss_is_lockfree_mode(void) -+ -+#ifdef HAVE_PTHREAD_EXT -+static bool sss_lock_free = true; -+static pthread_once_t sss_lock_mode_initialized = PTHREAD_ONCE_INIT; -+ -+static void init_lock_mode(void) - { -- const char *env = NULL; -- enum { -- MODE_UNDEF, -- MODE_LOCKING, -- MODE_LOCKFREE -- }; -- static atomic_int mode = MODE_UNDEF; -- -- if (mode == MODE_UNDEF) { -- env = getenv("SSS_LOCKFREE"); -- if ((env != NULL) && (strcasecmp(env, "NO") == 0)) { -- mode = MODE_LOCKING; -- } else { -- mode = MODE_LOCKFREE; -- } -+ const char *env = getenv("SSS_LOCKFREE"); -+ -+ if ((env != NULL) && (strcasecmp(env, "NO") == 0)) { -+ sss_lock_free = false; - } -+} - -- return (mode == MODE_LOCKFREE); -+bool sss_is_lockfree_mode(void) -+{ -+ pthread_once(&sss_lock_mode_initialized, init_lock_mode); -+ return sss_lock_free; - } -+#endif - - struct sss_mutex sss_nss_mtx = { .mtx = PTHREAD_MUTEX_INITIALIZER }; -- - static struct sss_mutex sss_pam_mtx = { .mtx = PTHREAD_MUTEX_INITIALIZER }; -- --static struct sss_mutex sss_nss_mc_mtx = { .mtx = PTHREAD_MUTEX_INITIALIZER }; -- - static struct sss_mutex sss_pac_mtx = { .mtx = PTHREAD_MUTEX_INITIALIZER }; - - static void sss_mt_lock(struct sss_mutex *m) - { -+#ifdef HAVE_PTHREAD_EXT - if (sss_is_lockfree_mode()) { - return; - } -+#endif - - pthread_mutex_lock(&m->mtx); - pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &m->old_cancel_state); -@@ -1171,9 +1196,11 @@ static void sss_mt_lock(struct sss_mutex *m) - - static void sss_mt_unlock(struct sss_mutex *m) - { -+#ifdef HAVE_PTHREAD_EXT - if (sss_is_lockfree_mode()) { - return; - } -+#endif - - pthread_setcancelstate(m->old_cancel_state, NULL); - pthread_mutex_unlock(&m->mtx); -@@ -1189,7 +1216,7 @@ void sss_nss_unlock(void) - sss_mt_unlock(&sss_nss_mtx); - } - --/* NSS mutex wrappers */ -+/* PAM mutex wrappers */ - void sss_pam_lock(void) - { - sss_mt_lock(&sss_pam_mtx); -@@ -1199,16 +1226,6 @@ void sss_pam_unlock(void) - sss_mt_unlock(&sss_pam_mtx); - } - --/* NSS mutex wrappers */ --void sss_nss_mc_lock(void) --{ -- sss_mt_lock(&sss_nss_mc_mtx); --} --void sss_nss_mc_unlock(void) --{ -- sss_mt_unlock(&sss_nss_mc_mtx); --} -- - /* PAC mutex wrappers */ - void sss_pac_lock(void) - { -diff --git a/src/sss_client/idmap/common_ex.c b/src/sss_client/idmap/common_ex.c -index 4f454cd63..8c4894fd9 100644 ---- a/src/sss_client/idmap/common_ex.c -+++ b/src/sss_client/idmap/common_ex.c -@@ -28,7 +28,9 @@ - #include "common_private.h" - - extern struct sss_mutex sss_nss_mtx; -+#ifdef HAVE_PTHREAD_EXT - bool sss_is_lockfree_mode(void); -+#endif - - #define SEC_FROM_MSEC(ms) ((ms) / 1000) - #define NSEC_FROM_MSEC(ms) (((ms) % 1000) * 1000 * 1000) -@@ -51,9 +53,11 @@ static int sss_mt_timedlock(struct sss_mutex *m, const struct timespec *endtime) - { - int ret; - -+#ifdef HAVE_PTHREAD_EXT - if (sss_is_lockfree_mode()) { - return 0; - } -+#endif - - ret = pthread_mutex_timedlock(&m->mtx, endtime); - if (ret != 0) { --- -2.37.1 - diff --git a/SPECS/sssd.spec b/SPECS/sssd.spec index 9d9cf13..d0be7c3 100644 --- a/SPECS/sssd.spec +++ b/SPECS/sssd.spec @@ -18,8 +18,8 @@ %global enable_systemtap_opt --enable-systemtap Name: sssd -Version: 2.7.3 -Release: 5%{?dist} +Version: 2.8.1 +Release: 1%{?dist} Group: Applications/System Summary: System Security Services Daemon License: GPLv3+ @@ -27,16 +27,7 @@ URL: https://github.com/SSSD/sssd Source0: https://github.com/SSSD/sssd/releases/download/%{version}/sssd-%{version}.tar.gz ### Patches ### -Patch0001: 0001-Makefile-remove-unneeded-dependency.patch -Patch0002: 0002-CLIENT-MC-store-context-mutex-outside-of-context-as-.patch -Patch0003: 0003-CACHE_REQ-Fix-hybrid-lookup-log-spamming.patch -Patch0004: 0004-Analyzer-Fix-escaping-raw-fstring.patch -Patch0005: 0005-CLIENT-MC-1-is-more-appropriate-initial-value-for-fd.patch -Patch0006: 0006-CLIENT-MC-pointer-to-the-context-mutex-shouldn-t-be-.patch -Patch0007: 0007-SSSCTL-Allow-analyzer-to-work-without-SSSD-setup.patch -Patch0008: 0008-RESPONDER-Fix-client-ID-tracking.patch -Patch0009: 0009-Analyzer-support-parallel-requests-parsing.patch -Patch0010: 0010-CLIENT-fix-client-fd-leak.patch +#Patch0001: ### Downstream Patches ### @@ -600,7 +591,6 @@ autoreconf -ivf --with-syslog=journald \ --with-subid \ --enable-sss-default-nss-plugin \ - --enable-files-domain \ --without-python2-bindings \ --with-sssd-user=sssd \ %{?with_cifs_utils_plugin_option} \ @@ -1104,6 +1094,38 @@ getent passwd sssd >/dev/null || useradd -r -g sssd -d / -s /sbin/nologin -c "Us %systemd_post sssd-ssh.socket %systemd_post sssd-sudo.socket +function mod_nss() { + if [ -f "$1" ] ; then + # Change order 'sss <-> files' if default pattern is found + match_pattern="^[[:blank:]]*(passwd|group):(.*)sss[[:blank:]]+files(.*)" + if grep -E -r -q -s "$match_pattern" "$1"; then + sed -i.save_by_rpm -E -e " + s/$match_pattern/\1:\2files sss\3/ + " "$1" &>/dev/null || : + # Remove obsolete comment + sed -i -E -e '/# .sssd. performs its own .files.-based caching, so it should generally/d' "$1" &>/dev/null || : + sed -i -E -e '/# come before .files.\./d' "$1" &>/dev/null || : + fi + fi +} + +if grep -E -r -q -s "[[:blank:]]*id_provider[[:blank:]]*=[[:blank:]]*files" /etc/sssd/ || + grep -E -i -r -q -s "[[:blank:]]*enable_files_domain[[:blank:]]*=[[:blank:]]*true" /etc/sssd ; then + # "files provider" configured explicitly, leave nsswitch.conf intact + : +else + NSSFILE="$(readlink /etc/nsswitch.conf || echo /etc/nsswitch.conf)" + if [ "$NSSFILE" = "/etc/authselect/nsswitch.conf" ] && authselect check &>/dev/null; then + mod_nss "/etc/authselect/user-nsswitch.conf" + authselect apply-changes &> /dev/null || : + else + mod_nss "$NSSFILE" + # also apply the same changes to user-nsswitch.conf to affect + # possible future authselect configuration + mod_nss "/etc/authselect/user-nsswitch.conf" + fi +fi + %preun common %systemd_preun sssd.service %systemd_preun sssd-autofs.socket @@ -1187,6 +1209,14 @@ fi %systemd_postun_with_restart sssd.service %changelog +* Tue Nov 22 2022 Alexey Tikhonov - 2.8.1-1 +- Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8 +- Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr +- Resolves: rhbz#2144579 - sssd timezone issues sudonotafter +- Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file +- Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict) +- Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed + * Mon Oct 31 2022 Alexey Tikhonov - 2.7.3-5 - Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release Rebuild against Samba rebase.