Re: [Freeipa-devel] [PATCH 0011] Make sure selinuxusemap behaves consistently to HBAC rule

2012-09-11 Thread Martin Kosek
On 09/06/2012 01:13 PM, Tomas Babej wrote: On 09/05/2012 01:56 PM, Martin Kosek wrote: On 09/03/2012 05:12 PM, Tomas Babej wrote: Hi, Both selinuxusermap-add and selinuxusermap-mod commands now behave consistently in not allowing user/host category or user/host members and HBAC rule being

Re: [Freeipa-devel] [PATCH] Patch to allow IPA to work with dogtag 10 on f18

2012-09-11 Thread Petr Viktorin
On 09/11/2012 04:04 AM, Ade Lee wrote: On Mon, 2012-09-10 at 16:58 -0400, Rob Crittenden wrote: Petr Viktorin wrote: Attaching rebased and squashed patches. I've done some testing with them but please test some more. Most of these aren't IPA issues, but dogtag issues. I'll try to split them

Re: [Freeipa-devel] [PATCH] Patch to allow IPA to work with dogtag 10 on f18

2012-09-11 Thread Rob Crittenden
Petr Viktorin wrote: On 09/11/2012 04:04 AM, Ade Lee wrote: On Mon, 2012-09-10 at 16:58 -0400, Rob Crittenden wrote: Petr Viktorin wrote: Attaching rebased and squashed patches. I've done some testing with them but please test some more. Most of these aren't IPA issues, but dogtag issues.

Re: [Freeipa-devel] [PATCH] Patch to allow IPA to work with dogtag 10 on f18

2012-09-11 Thread Ade Lee
On Tue, 2012-09-11 at 08:59 -0400, Rob Crittenden wrote: Petr Viktorin wrote: On 09/11/2012 04:04 AM, Ade Lee wrote: On Mon, 2012-09-10 at 16:58 -0400, Rob Crittenden wrote: Petr Viktorin wrote: Attaching rebased and squashed patches. I've done some testing with them but please test

Re: [Freeipa-devel] [PATCH] Patch to allow IPA to work with dogtag 10 on f18

2012-09-11 Thread Rob Crittenden
Ade Lee wrote: On Tue, 2012-09-11 at 08:59 -0400, Rob Crittenden wrote: Petr Viktorin wrote: On 09/11/2012 04:04 AM, Ade Lee wrote: On Mon, 2012-09-10 at 16:58 -0400, Rob Crittenden wrote: Petr Viktorin wrote: Attaching rebased and squashed patches. I've done some testing with them but

[Freeipa-devel] [PATCH] 212 Fix integer validation when boundary value is empty string

2012-09-11 Thread Petr Vobornik
There was an error in number validation check. If boundary value was an empty string, validation of a number always failed. This patch fixes the problem by not performing the check in these cases. Basic unit tests for IPA.metadata_validator created. -- Petr Vobornik From

[Freeipa-devel] [PATCH] 213 JSON serialization of long type

2012-09-11 Thread Petr Vobornik
Numbers of long type were incorrectly serialized to JSON as empty strings when using json_serialize function. It caused problem in serialization of metadata for Web UI. This patch is fixing it. Discovered after Cast DNS SOA serial maximum boundary to long -- Petr Vobornik From

Re: [Freeipa-devel] [PATCH] 304 Allow localhost in zone ACIs

2012-09-11 Thread Petr Vobornik
On 09/10/2012 09:12 PM, Endi Sukma Dewata wrote: On 9/6/2012 7:00 AM, Martin Kosek wrote: On 09/06/2012 01:35 PM, Petr Vobornik wrote: On 09/06/2012 11:51 AM, Martin Kosek wrote: Loopback address, localhost and localnets ACIs are no longer an issue for bind-dyndb-ldap. Allow them in our

Re: [Freeipa-devel] [PATCH] 1054 new default SELinux user map user

2012-09-11 Thread Rob Crittenden
Jakub Hrozek wrote: On Mon, Sep 10, 2012 at 05:38:47PM -0400, Rob Crittenden wrote: We've decided to change the default SELinux user map user to the OS default which is unconfined_u. It would be too drastic to go from one extreme to another. rob How does one set an empty default that the

Re: [Freeipa-devel] Ticket #2866 - referential integrity in IPA

2012-09-11 Thread Martin Kosek
On 09/04/2012 04:40 PM, Rich Megginson wrote: On 09/03/2012 08:42 AM, Martin Kosek wrote: On 08/27/2012 06:29 PM, Rich Megginson wrote: ... This is the plan I plan to take: 1) Add pres,eq indexes for all un-indexed attributes that we want to check: sourcehost memberservice managedby

Re: [Freeipa-devel] [PATCH] Patch to allow IPA to work with dogtag 10 on f18

2012-09-11 Thread Rob Crittenden
Petr Viktorin wrote: On 09/11/2012 04:38 PM, Rob Crittenden wrote: Ade Lee wrote: On Tue, 2012-09-11 at 08:59 -0400, Rob Crittenden wrote: Petr Viktorin wrote: On 09/11/2012 04:04 AM, Ade Lee wrote: On Mon, 2012-09-10 at 16:58 -0400, Rob Crittenden wrote: Petr Viktorin wrote: Attaching

Re: [Freeipa-devel] [PATCH] Patch to allow IPA to work with dogtag 10 on f18

2012-09-11 Thread Rob Crittenden
Rob Crittenden wrote: Petr Viktorin wrote: On 09/11/2012 04:38 PM, Rob Crittenden wrote: Ade Lee wrote: On Tue, 2012-09-11 at 08:59 -0400, Rob Crittenden wrote: Petr Viktorin wrote: On 09/11/2012 04:04 AM, Ade Lee wrote: On Mon, 2012-09-10 at 16:58 -0400, Rob Crittenden wrote: Petr

Re: [Freeipa-devel] [PATCH] Patch to allow IPA to work with dogtag 10 on f18

2012-09-11 Thread Rob Crittenden
Rob Crittenden wrote: Petr Viktorin wrote: On 09/11/2012 04:38 PM, Rob Crittenden wrote: Ade Lee wrote: On Tue, 2012-09-11 at 08:59 -0400, Rob Crittenden wrote: Petr Viktorin wrote: On 09/11/2012 04:04 AM, Ade Lee wrote: On Mon, 2012-09-10 at 16:58 -0400, Rob Crittenden wrote: Petr

Re: [Freeipa-devel] [PATCH] Patch to allow IPA to work with dogtag 10 on f18

2012-09-11 Thread Rob Crittenden
Rob Crittenden wrote: Rob Crittenden wrote: Petr Viktorin wrote: On 09/11/2012 04:38 PM, Rob Crittenden wrote: Ade Lee wrote: On Tue, 2012-09-11 at 08:59 -0400, Rob Crittenden wrote: Petr Viktorin wrote: On 09/11/2012 04:04 AM, Ade Lee wrote: On Mon, 2012-09-10 at 16:58 -0400, Rob

Re: [Freeipa-devel] Ticket #2866 - referential integrity in IPA

2012-09-11 Thread Rich Megginson
On 09/11/2012 10:51 AM, Martin Kosek wrote: On 09/04/2012 04:40 PM, Rich Megginson wrote: On 09/03/2012 08:42 AM, Martin Kosek wrote: On 08/27/2012 06:29 PM, Rich Megginson wrote: ... This is the plan I plan to take: 1) Add pres,eq indexes for all un-indexed attributes that we want to check:

Re: [Freeipa-devel] [PATCH] 0078 ipa-client-install: Obtain host TGT from one specific KDC

2012-09-11 Thread Rob Crittenden
Petr Viktorin wrote: When installing the client, we need to take extra case to only contact the one server we're installing against. Otherwise, in the real world, we might hit a server that hasn't replicated info about the client yet. This patch fixes a bug where kinit attempted to contact a

Re: [Freeipa-devel] [PATCH] 0077 Check direct/reverse hostname/address resolution in ipa-replica-install

2012-09-11 Thread Rob Crittenden
Petr Viktorin wrote: On 09/04/2012 07:44 PM, Rob Crittenden wrote: Petr Viktorin wrote: https://fedorahosted.org/freeipa/ticket/2845 Shouldn't this also call verify_fqdn() on the local hostname and not just the master? I think this would eventually fail in the conncheck but what if that was

Re: [Freeipa-devel] slow response

2012-09-11 Thread Stephen Ingram
On Tue, Aug 7, 2012 at 1:53 PM, Simo Sorce s...@redhat.com wrote: On Tue, 2012-08-07 at 13:30 -0700, Stephen Ingram wrote: On Thu, Aug 2, 2012 at 1:04 PM, Simo Sorce s...@redhat.com wrote: Quick heads up in this thread, apparently we have isolated the issue to libkrb5 and its selinux

Re: [Freeipa-devel] slow response

2012-09-11 Thread Rob Crittenden
Stephen Ingram wrote: On Tue, Aug 7, 2012 at 1:53 PM, Simo Sorce s...@redhat.com wrote: On Tue, 2012-08-07 at 13:30 -0700, Stephen Ingram wrote: On Thu, Aug 2, 2012 at 1:04 PM, Simo Sorce s...@redhat.com wrote: Quick heads up in this thread, apparently we have isolated the issue to libkrb5

Re: [Freeipa-devel] [PATCH] Patch to allow IPA to work with dogtag 10 on f18

2012-09-11 Thread Ade Lee
On Tue, 2012-09-11 at 14:45 -0400, Rob Crittenden wrote: Petr Viktorin wrote: On 09/11/2012 04:38 PM, Rob Crittenden wrote: Ade Lee wrote: On Tue, 2012-09-11 at 08:59 -0400, Rob Crittenden wrote: Petr Viktorin wrote: On 09/11/2012 04:04 AM, Ade Lee wrote: On Mon, 2012-09-10 at 16:58

Re: [Freeipa-devel] slow response

2012-09-11 Thread Stephen Ingram
On Tue, Sep 11, 2012 at 7:31 PM, Rob Crittenden rcrit...@redhat.com wrote: Stephen Ingram wrote: On Tue, Aug 7, 2012 at 1:53 PM, Simo Sorce s...@redhat.com wrote: On Tue, 2012-08-07 at 13:30 -0700, Stephen Ingram wrote: On Thu, Aug 2, 2012 at 1:04 PM, Simo Sorce s...@redhat.com wrote: