Commit graph

9 commits

Author SHA1 Message Date
Mark Dietzer 4987cd7394
Merge 998e56d648 into d79188559f 2025-04-07 14:41:12 +00:00
Firstyear b88b6923eb
20250313 unixd system cache ()
The implementation of the unixd cache relies on inotify to detect changes to files in /etc so that we know when to reload the data for nss/passwd. However, the way that groupadd/del and other tools work is they copy the file, change it, and then move it into place. It turns out that william of the past didn't realise that inotify works on inodes not paths like other tools do (auditctl for example).

As a result, when something modified /etc/group or another related file, the removal was seen, but this breaks notifications on any future change until you reload unixd.

To resolve this we need to recursively watch /etc with inotify - yep, that's correct. We have to watch everything in /etc for changes because it's the only way to pick up on the add/remove of files. But because we have to watch everything, we need permissions to watch everything.

This forces us to move the parsing of the etc passwd/group/shadow files to the unixd tasks daemon - arguably, this is the correct place to read these anyway since that is a high priv (and locked down) daemon. Because of this, we actually end up solving the missing "shadow" group on debian issue, and probably similar on the BSD's in future.

In order to make my life easier while testing I also threw in a makefile that symlinks the files to needed locations for testing. It has plenty of warnings as it should.

Fixes 
Fixes 
Fixes 
2025-03-14 13:46:26 +10:00
Doridian 685746796e Add and implement basic NssGroupsByMember call 2024-12-29 21:29:28 -08:00
Firstyear c96e9772c7
Resolve pam services not always having a tty () 2024-11-05 00:49:33 +00:00
Firstyear ea1fcf59e5
Resolve incorrect handling of rhost in pam () 2024-11-03 00:13:26 +00:00
James Hodgkinson 68119e1067
more errors for the people () 2024-10-18 23:51:45 +00:00
Firstyear cf63c6b98b
Complete the implementation of the posix account cache ()
Allow caching and checking of shadow entries (passwords)
    Cache and serve system id's
    improve some security warnings
    prepare for multi-resolver
    Allow the kanidm provider to be not configured
    Allow group extension
2024-10-02 02:12:13 +00:00
Firstyear b1099dfa3b
Foundations of pam/nss multi resolver
This starts the support for multi-resolver operation as well as a system level nss resolver.

In future we'll add the remaining support to auth system users with pam too.
2024-08-15 23:54:35 +00:00
Firstyear 0ce333ff5a
Allow providers to be box dyn ()
* Allow providers to be box dyn in kanidm_unixd
* Massive refactor
2024-06-16 22:21:25 +00:00
Renamed from unix_integration/src/unix_proto.rs (Browse further)