February 2021 - sssd-devel - Fedora Mailing-Lists

[sssd PR#5512][opened] TEST: Add function to control services

by sgoveas

URL: https://github.com/SSSD/sssd/pull/5512 Author: sgoveas Title: #5512: TEST: Add function to control services Action: opened PR body: """ We can use this function to start stop or restart any service """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5512/head:pr5512 git checkout pr5512

3 years, 2 months

3
14
0 / 0

[SSSD-users] Announcing SSSD 2.4.2

by Pavel Březina

# SSSD 2.4.2 The SSSD team is proud to announce the release of version 2.4.2 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.4.2 See the full release notes at: https://sssd.io/docs/users/relnotes/notes_2_4_2 RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### General information * Default value of 'user' config option was fixed into accordance with man page, i.e. default is 'root' * Example systemd service configs now makes use of CapabilityBoundingSet option as a security hardening measure. ### New features * `pam_sss_gss` now support authentication indicators to further harden the authentication ### Configuration changes * Added `pam_gssapi_indicators_map` to configure authentication indicators requirements

3 years, 2 months

1
0
0 / 0

[sssd PR#5515][opened] responder: fix warning in activate_unix_sockets

by pbrezina

URL: https://github.com/SSSD/sssd/pull/5515 Author: pbrezina Title: #5515: responder: fix warning in activate_unix_sockets Action: opened PR body: """ The warning is with systemd disabled. ``` src/responder/common/responder_common.c: In function ‘activate_unix_sockets’: src/responder/common/responder_common.c:1005:15: error: unused variable ‘sockaddr_len’ [-Werror=unused-variable] 1005 | socklen_t sockaddr_len = sizeof(sockaddr); ``` """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5515/head:pr5515 git checkout pr5515

3 years, 2 months

2
8
0 / 0

[sssd PR#5407][opened] kcm: check socket path loaded from configuration

by ikerexxe

URL: https://github.com/SSSD/sssd/pull/5407 Author: ikerexxe Title: #5407: kcm: check socket path loaded from configuration Action: opened PR body: """ There are three major execution flows for this change: 1. If kcm socket path is not defined in sssd configuration, then log it and fall back to the default location. 2. If kcm socket path is defined in sssd configuration but the location is invalid, then log it and fall back to the default location. 3. If kcm socket path is defined in sssd configuration and the location is valid, then use it. Apart from that some unit-tests have been implement to check that the changes work as expected. I wonder if the changes included in confdb_get_string() should be ported to all confdb_get_*() methods. Resolves: https://github.com/SSSD/sssd/issues/5406 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5407/head:pr5407 git checkout pr5407

3 years, 2 months

4
49
0 / 0

[sssd PR#5493][opened] Backport of a number of ndr related patches to fix build issues

by alexey-tikhonov

URL: https://github.com/SSSD/sssd/pull/5493 Author: alexey-tikhonov Title: #5493: Backport of a number of ndr related patches to fix build issues Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5493/head:pr5493 git checkout pr5493

3 years, 2 months

2
22
0 / 0

[sssd PR#5504][opened] systemd configs: limit process capabilities

by alexey-tikhonov

URL: https://github.com/SSSD/sssd/pull/5504 Author: alexey-tikhonov Title: #5504: systemd configs: limit process capabilities Action: opened PR body: """ This is to upstream https://src.fedoraproject.org/rpms/sssd/blob/f34/f/0502-SYSTEMD-Use-capab... Additionally even more limited CapabilityBoundingSet is applied to ifp and kcm services (CAP_KILL CAP_NET_ADMIN CAP_SYS_NICE CAP_SYS_ADMIN CAP_SYS_RESOURCE CAP_BLOCK_SUSPEND are excluded as compared to main sssd service) :relnote: Example systemd service configs now makes use of CapabilityBoundingSet option as a security hardening measure. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5504/head:pr5504 git checkout pr5504

3 years, 2 months

3
15
0 / 0

[sssd PR#5509][opened] spec file: don't enable implicit files domain on RHEL

by alexey-tikhonov

URL: https://github.com/SSSD/sssd/pull/5509 Author: alexey-tikhonov Title: #5509: spec file: don't enable implicit files domain on RHEL Action: opened PR body: """ Corresponding code is built and users can enable files domain on a as-needed basis. But there is little value running it on RHEL "as is" by default. (As a reminder, as a comment in this file says, this is a "SSSD SPEC file for Fedora 34+ and RHEL-9+") Originally it was opened as https://src.fedoraproject.org/rpms/sssd/pull-request/8 but @pbrezina asked to move it upstream. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5509/head:pr5509 git checkout pr5509

3 years, 2 months

3
18
0 / 0

[sssd PR#5510][opened] spec: remove setuid bit from child helpers if sssd user is root

by pbrezina

URL: https://github.com/SSSD/sssd/pull/5510 Author: pbrezina Title: #5510: spec: remove setuid bit from child helpers if sssd user is root Action: opened PR body: """ The setuid bit is only needed if sssd runs as non-root user. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5510/head:pr5510 git checkout pr5510

3 years, 2 months

2
8
0 / 0

[sssd PR#5503][opened] pam_sss: Don't fail on deskprofiles phase for AD users

by stanislavlevin

URL: https://github.com/SSSD/sssd/pull/5503 Author: stanislavlevin Title: #5503: pam_sss: Don't fail on deskprofiles phase for AD users Action: opened PR body: """ By default (if session_provider is not none) during session setup pam_sss attempts to fetch desktop rules and profiles for user from IPA domain. As part of this job, the data provider looks for the user info(uid and gid) in IPA domain but fails to do that for AD user from a trusted domain returning PAM_SESSION_ERR. The requested target domain has been already found in `dp_req_new` and may be referenced as `params->domain`. This change doesn't introduce the possibility to fetch deskprofiles for AD users, but at least, to don't break PAM authentication for them. Fixes: https://github.com/SSSD/sssd/issues/5499 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5503/head:pr5503 git checkout pr5503

3 years, 2 months

3
16
0 / 0

[sssd PR#5500][opened] SPEC: don't hard require python3-sssdconfig in a meta package

by alexey-tikhonov

URL: https://github.com/SSSD/sssd/pull/5500 Author: alexey-tikhonov Title: #5500: SPEC: don't hard require python3-sssdconfig in a meta package Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5500/head:pr5500 git checkout pr5500

3 years, 2 months

3
14
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel February 2021