Re: [Freeipa-devel] [PATCH] 85 Add --no-ssh option to ipa-client-install to disable OpenSSH client configuration

2012-09-13 Thread Jan Cholasta
Dne 12.9.2012 15:53, Jan Cholasta napsal(a): Hi, this patch fixes https://fedorahosted.org/freeipa/ticket/3070. If both --no-ssh and --no-sshd are specified, do not configure the SSH service in SSSD. Honza Note: This patch can be only applied on top of

Re: [Freeipa-devel] [PATCH] 1054 new default SELinux user map user

2012-09-13 Thread Martin Kosek
On 09/13/2012 12:28 PM, Jakub Hrozek wrote: On Tue, Sep 11, 2012 at 11:19:59AM -0400, Rob Crittenden wrote: Jakub Hrozek wrote: On Mon, Sep 10, 2012 at 05:38:47PM -0400, Rob Crittenden wrote: We've decided to change the default SELinux user map user to the OS default which is unconfined_u. It

Re: [Freeipa-devel] [PATCH] 0078 ipa-client-install: Obtain host TGT from one specific KDC

2012-09-13 Thread Martin Kosek
On 09/12/2012 06:02 PM, Petr Viktorin wrote: On 09/12/2012 04:04 PM, Martin Kosek wrote: On 09/12/2012 02:58 PM, Jan Cholasta wrote: Dne 12.9.2012 14:09, Petr Viktorin napsal(a): On 09/12/2012 01:20 PM, Petr Viktorin wrote: On 09/11/2012 10:39 PM, Rob Crittenden wrote: Petr Viktorin wrote:

Re: [Freeipa-devel] [PATCH] 84 Add the SSH service to SSSD config file before trying to activate it

2012-09-13 Thread Martin Kosek
On 09/12/2012 03:09 PM, Jan Cholasta wrote: Hi, this patch fixes https://fedorahosted.org/freeipa/ticket/3069. Users no longer have to configure SSH in sssd.conf manually if the file exists prior to running ipa-client-install. Honza ACK. Pushed to master, ipa-3-0. Martin

Re: [Freeipa-devel] [PATCH] 85 Add --no-ssh option to ipa-client-install to disable OpenSSH client configuration

2012-09-13 Thread Martin Kosek
On 09/12/2012 03:53 PM, Jan Cholasta wrote: Hi, this patch fixes https://fedorahosted.org/freeipa/ticket/3070. If both --no-ssh and --no-sshd are specified, do not configure the SSH service in SSSD. Honza ACK. Pushed to master, ipa-3-0. Martin

[Freeipa-devel] [PATCH 0061] Add missing DNS view attach/detach to LDAP instance management code

2012-09-13 Thread Petr Spacek
Hello, Add missing DNS view attach/detach to LDAP instance management code. This fixes race condition in BIND shutdown after SIGINT: - failing assert caused by use-after-free in dns_zt_find(): (((zt) != ((void *)0)) (((const isc__magic_t *)(zt))-magic == ((('Z') 24 | ('T')

[Freeipa-devel] [PATCH 0060] Fix zone delete in ldap_zone_delete2()

2012-09-13 Thread Petr Spacek
Hello, Fix zone delete in ldap_zone_delete2(). This fixes two race conditions during BIND reload: - failing assert in destroy_ldap_connection() DESTROYLOCK: ((pthread_mutex_destroy(ldap_conn-lock) == 0) ? 0 : 34) == 0 - use-after-free in call:

Re: [Freeipa-devel] [PATCH] 302 Stricter IP network validator in dnszone-add command

2012-09-13 Thread Martin Kosek
On 09/05/2012 01:02 PM, Jan Cholasta wrote: Dne 5.9.2012 12:48, Martin Kosek napsal(a): On 09/05/2012 12:36 PM, Jan Cholasta wrote: Dne 5.9.2012 12:22, Petr Spacek napsal(a): On 09/05/2012 11:30 AM, Jan Cholasta wrote: Dne 5.9.2012 10:04, Martin Kosek napsal(a): We allowed IP addresses

[Freeipa-devel] [PATCH] 309 Fix addattr internal error

2012-09-13 Thread Martin Kosek
When ADD command is being executed and a single-value object attribute is being set with both option and addattr IPA ends up in an internal error. Make better value sanitizing job in this case and let IPA throw a user-friendly error. Unit test exercising this situation is added.

Re: [Freeipa-devel] [PATCH] 213 JSON serialization of long type

2012-09-13 Thread Martin Kosek
On 09/11/2012 05:11 PM, Petr Vobornik wrote: Numbers of long type were incorrectly serialized to JSON as empty strings when using json_serialize function. It caused problem in serialization of metadata for Web UI. This patch is fixing it. Discovered after Cast DNS SOA serial maximum boundary

Re: [Freeipa-devel] [PATCH] 305-308 Expand Referential Integrity checks

2012-09-13 Thread Rob Crittenden
Martin Kosek wrote: To test, add sudo commands, hosts or users to a sudo rule or hbac rule and then rename or delete the linked object. After the update, the links should be amended. - Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked

[Freeipa-devel] [PATCH] 1056 sudorule cn uniqueness

2012-09-13 Thread Rob Crittenden
A sudorule dn uses ipaUniqueId as the cn so we have to do a search to ensure uniqueness. This leaves us vulnerable to a race. Configure the uniqueness plugin to ensure no dups. rob From 7f9250d6efe73a56f364173ce730bcddb112aac2 Mon Sep 17 00:00:00 2001 From: Rob Crittenden rcrit...@redhat.com

Re: [Freeipa-devel] [PATCH] 0079 Update the pot file (translation source)

2012-09-13 Thread Rob Crittenden
Petr Viktorin wrote: Transifex is watching our repository, so pushing this patch will update the translations on the site. ACK, pushed to master and ipa-3-0 rob ___ Freeipa-devel mailing list Freeipa-devel@redhat.com

Re: [Freeipa-devel] [PATCH] 0077 Check direct/reverse hostname/address resolution in ipa-replica-install

2012-09-13 Thread Rob Crittenden
Petr Viktorin wrote: On 09/11/2012 11:05 PM, Rob Crittenden wrote: Petr Viktorin wrote: On 09/04/2012 07:44 PM, Rob Crittenden wrote: Petr Viktorin wrote: https://fedorahosted.org/freeipa/ticket/2845 Shouldn't this also call verify_fqdn() on the local hostname and not just the master? I