March 2021 - sssd-devel - Fedora mailing-lists

[sssd PR#5226][comment] python/pysss_nss_idmap: check return from functions
by alexey-tikhonov 15 May '25

15 May '25

URL: https://github.com/SSSD/sssd/pull/5226 Title: #5226: python/pysss_nss_idmap: check return from functions alexey-tikhonov commented: """ Thank you for the updated version. Please see a couple of comments inline. """ See the full comment at https://github.com/SSSD/sssd/pull/5226#issuecomment-693396748

2 1

[sssd PR#175][opened] Add module for starting services
by lslebodn 22 Nov '21

22 Nov '21

URL: https://github.com/SSSD/sssd/pull/175 Author: lslebodn Title: #175: Add module for starting services Action: opened PR body: """ This is a WIP version of reducing code duplication in our cwrap integration tests. I am still not sure whether we should also reuse function `create_sssd_fixture`. And if yes; then probably in different nodule then `services` And comments are welcome. BTW I wrote patches few weeks ago; therefore new tests are not converted. I am just sending patches to get some feedback. Site effect of this patches is that tests are cca 20% faster (IIRC) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/175/head:pr175 git checkout pr175

5 5

[sssd PR#5434][opened] Adding multihost tests for ad_allow_remote_domain_local_groups, bz1883488 bz1756240
by sidecontrol 13 Oct '21

13 Oct '21

URL: https://github.com/SSSD/sssd/pull/5434 Author: sidecontrol Title: #5434: Adding multihost tests for ad_allow_remote_domain_local_groups, bz1883488 bz1756240 Action: opened PR body: """ This is the first multihost test that requires more than one AD server, it requires a root, child and tree domain and users created from the playbooks in CI. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5434/head:pr5434 git checkout pr5434

4 15

[sssd PR#5473][opened] Tests: alltests: Check default debug level of sssd and corresponding logs
by madhuriupadhye 05 Oct '21

05 Oct '21

URL: https://github.com/SSSD/sssd/pull/5473 Author: madhuriupadhye Title: #5473: Tests: alltests: Check default debug level of sssd and corresponding logs Action: opened PR body: """ Check default debug level of sssd and corresponding logs It consists of four test cases: 1. Check the default debug level by authenticating the user 2. Check default level as 0 and 1 3. Check default level as 2 4. Check SBUS code triggers failure message during modules startup Verifies: Issues: #5422 #5425 Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1893159 https://bugzilla.redhat.com/show_bug.cgi?id=1915319 Signed-off-by: Madhuri Upadhye <mupadhye(a)redhat.com> """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5473/head:pr5473 git checkout pr5473

4 17

[sssd PR#844][opened] sssd-ad and gpo_child: GPO apply fixes during reading fails
by mastersin 03 Aug '21

03 Aug '21

URL: https://github.com/SSSD/sssd/pull/844 Author: mastersin Title: #844: sssd-ad and gpo_child: GPO apply fixes during reading fails Action: opened PR body: """ Ignore AD GPO errors: - if SecEdit/GptTmpl.inf is missing or - if reading sysvol_gpt_version fails and cached_gpt_version already exists """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/844/head:pr844 git checkout pr844

7 16

[sssd PR#5552][opened] files: split update into batches
by sumit-bose 09 Jul '21

09 Jul '21

URL: https://github.com/SSSD/sssd/pull/5552 Author: sumit-bose Title: #5552: files: split update into batches Action: opened PR body: """ If the files managed by the files provider contain many users or groups processing them might take a considerable amount of time. To keep the backend responsive this patch splits the update into multiple steps running one after the other but returning to the main loop in between. This avoids issues during startup because the watchdog timer state is reset properly. Additionally SBUS messages are process and as a result the domain can be marked inconsistent in the frontends properly. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5552/head:pr5552 git checkout pr5552

4 128

[sssd PR#5419][opened] Adding tests to cover ad discovery improvements using cldap
by sidecontrol 17 Jun '21

17 Jun '21

URL: https://github.com/SSSD/sssd/pull/5419 Author: sidecontrol Title: #5419: Adding tests to cover ad discovery improvements using cldap Action: opened PR body: """ * This test requires a primary and secondary domain controller so AD can be moved between sites * Currently contains four test cases ** Two DCs in one site no restrictions. ** Two DCs in one site, traffic blocked to the other DC ** DCs in seperate sites no restrictions ** DCs in seperate sites, traffic blocked to the other DC Signed-off-by: Dan Lavu <dlavu(a)redhat.com> SSSD-2497 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5419/head:pr5419 git checkout pr5419

4 10

[sssd PR#5442][opened] Adding multihost test for supporting asymmetric nsupdate auth
by sidecontrol 17 Jun '21

17 Jun '21

URL: https://github.com/SSSD/sssd/pull/5442 Author: sidecontrol Title: #5442: Adding multihost test for supporting asymmetric nsupdate auth Action: opened PR body: """ * https://bugzilla.redhat.com/show_bug.cgi?id=1884301 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5442/head:pr5442 git checkout pr5442

4 10

[sssd PR#5548][opened] Add support to verify authentication indicators in pam_sss_gss
by aborah-sudo 13 May '21

13 May '21

URL: https://github.com/SSSD/sssd/pull/5548 Author: aborah-sudo Title: #5548: Add support to verify authentication indicators in pam_sss_gss Action: opened PR body: """ Error code of '[pam_cmd_gssapi_sec_ctx] (0x0400): Check if acquired service ticket has req. indicators:'. '2' is 'not applied' (ENOENT), """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5548/head:pr5548 git checkout pr5548

4 22

[sssd PR#5550][opened] Translations update from Weblate
by weblate 10 May '21

10 May '21

URL: https://github.com/SSSD/sssd/pull/5550 Author: weblate Title: #5550: Translations update from Weblate Action: opened PR body: """ Translations update from [Weblate](https://translate.fedoraproject.org/projects/sssd/sssd-master/) for SSSD/sssd. Current translation status: ![Weblate translation status](https://translate.fedoraproject.org/widgets/sssd/-/sssd-master/hori… """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5550/head:pr5550 git checkout pr5550

2 3

[sssd PR#5450][opened] kcm: add support for kerberos tgt renewals
by justin-stephenson 10 May '21

10 May '21

URL: https://github.com/SSSD/sssd/pull/5450 Author: justin-stephenson Title: #5450: kcm: add support for kerberos tgt renewals Action: opened PR body: """ This allows configuration of KCM to attempt renewals for renew-applicable kerberos tickets stored in kcm, such as a TGT retrieved with `kinit` on the command-line. krb5* renewal and lifetime options are configurable in the [kcm] section, if they do not exist in the [kcm] section then we check and fallback to using the first `auth_provider=krb5` domain in sssd.conf. This support is only added to the secdb ccache backend. The overall high-level logic used here is similar to the existing pam_sss krb5 renewal code, adding necessary changes to unmarshal and retrieve ticket information from KCM secrets db. Renewal is only attempted after half of the tgt lifetime has been reached. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5450/head:pr5450 git checkout pr5450

5 93

[sssd PR#5481][opened] Tests: 'getent group ldapgroupname' doesn't show
by aborah-sudo 07 May '21

07 May '21

URL: https://github.com/SSSD/sssd/pull/5481 Author: aborah-sudo Title: #5481: Tests: 'getent group ldapgroupname' doesn't show Action: opened PR body: """ any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD Verifies: https://github.com/SSSD/sssd/issues/5311 Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1817122 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5481/head:pr5481 git checkout pr5481

4 25

[sssd PR#5478][opened] Tests: alltests: fetch autofs maps after coming online
by shridhargadekar 26 Apr '21

26 Apr '21

URL: https://github.com/SSSD/sssd/pull/5478 Author: shridhargadekar Title: #5478: Tests: alltests: fetch autofs maps after coming online Action: opened PR body: """ SSSD should fetch autofs maps from server when coming online from offline state, without existing cache. SSSD is started in offline mode with no existing. cache. While coming online, SSSD should fetch autofs maps from server without restarting SSSSD service. #Verifies: Issues: https://github.com/SSSD/sssd/issues/3413 Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1113639 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5478/head:pr5478 git checkout pr5478

2 21

[sssd PR#5544][opened] TEST: Modify subsystem to sst_idm_sssd
by sgoveas 26 Apr '21

26 Apr '21

URL: https://github.com/SSSD/sssd/pull/5544 Author: sgoveas Title: #5544: TEST: Modify subsystem to sst_idm_sssd Action: opened PR body: """ idm sst were sub divided in team specific sst and is now implemented in polarion """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5544/head:pr5544 git checkout pr5544

5 10

[sssd PR#5541][opened] nss client: make innetgr() thread safe
by sumit-bose 21 Apr '21

21 Apr '21

URL: https://github.com/SSSD/sssd/pull/5541 Author: sumit-bose Title: #5541: nss client: make innetgr() thread safe Action: opened PR body: """ The innetgr() call is expected to be thread safe but SSSD's the current implementation isn't. In glibc innetgr() is implementend by calling the setnetgrent(), getnetgrent(), endgrent() sequence with a private context (struct __netgrent) with provides a member where NSS modules can store data between the calls. With this patch setnetgrent() will read all required data from the NSS responder and store it in the data member of the __netgrent struct. Upcoming getnetgrent() calls will only operate on the stored data and not connect to the NSS responder anymore. endgrent() will free the data. Since the netgroup data is read in a single request to the NSS responder protected by a mutex and stored in private context of innetgr() this call is now thread-safe. Resolves: https://github.com/SSSD/sssd/issues/5540 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5541/head:pr5541 git checkout pr5541

3 21

[sssd PR#5435][opened] whitespace_test: fix exclusion of debian directory
by deastoe 21 Apr '21

21 Apr '21

URL: https://github.com/SSSD/sssd/pull/5435 Author: deastoe Title: #5435: whitespace_test: fix exclusion of debian directory Action: opened PR body: """ These tests are supposed to ignore trailing whitespace in files in the debian directory. However this is not the case with the current exclude pattern and usage of `git grep`. Use --full-name with `git grep` to ensure its output is always relative to the repository root, rather than the current directory. Additionally remove the leading slash from the exclude pattern as this will never match the output. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5435/head:pr5435 git checkout pr5435

3 12

[sssd PR#5542][opened] nss client: make innetgr() thread safe
by sumit-bose 21 Apr '21

21 Apr '21

URL: https://github.com/SSSD/sssd/pull/5542 Author: sumit-bose Title: #5542: nss client: make innetgr() thread safe Action: opened PR body: """ The innetgr() call is expected to be thread safe but SSSD's the current implementation isn't. In glibc innetgr() is implementend by calling the setnetgrent(), getnetgrent(), endgrent() sequence with a private context (struct __netgrent) with provides a member where NSS modules can store data between the calls. With this patch setnetgrent() will open a new connection to the NSS responder and stores the file descriptor in the data member of __netgrent struct so that the following getnetgrent() and endgrent() will use the same connection. Since the NSS responder stores the netgroup lookups related data in a per connection context and a new thread will open a new connection the implementation is thread safe. Resolves: https://github.com/SSSD/sssd/issues/5540 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5542/head:pr5542 git checkout pr5542

3 9

[sssd PR#5532][opened] Handle ldap_install_tls() configuration and retrial
by ikerexxe 20 Apr '21

20 Apr '21

URL: https://github.com/SSSD/sssd/pull/5532 Author: ikerexxe Title: #5532: Handle ldap_install_tls() configuration and retrial Action: opened PR body: """ Configure socket options when calling ldap_install_tls() to avoid hitting EINTR during connect. Set the communication to asynchronous. This configuration can't be applied for the connection part, which has to be always blocking. On top of that set the network timeout to ldap_opt_timeout option, to decrease the possibility of triggering a timeout error when polling. If the call to ldap_install_tls() fails with EINTR, retry it again. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5532/head:pr5532 git checkout pr5532

4 59

[sssd PR#5529][opened] AD: read trusted domains from local domain as well
by sumit-bose 16 Apr '21

16 Apr '21

URL: https://github.com/SSSD/sssd/pull/5529 Author: sumit-bose Title: #5529: AD: read trusted domains from local domain as well Action: opened PR body: """ Currently SSSD only uses information stored in a domain controller of the forest root domain to get the names of other trusted domains in the forest. Depending on how the forest was created the forest root might not have LDAP objects for all domains in the forest. It looks like a typical case are child domains of other domains in the forest. As a start SSSD can now include trusted domains stored in the LDAP tree of a local domain controller as well. In a long run it would make sense to allow SSSD to explicitly search for domain by looking up DNS entries and checking a potential domain controller with a CLDAP ping. Resolves: https://github.com/SSSD/sssd/issues/5528 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5529/head:pr5529 git checkout pr5529

3 32

[sssd PR#5549][opened] data_provider: Configure backend probing interval
by elkoniu 15 Apr '21

15 Apr '21

URL: https://github.com/SSSD/sssd/pull/5549 Author: elkoniu Title: #5549: data_provider: Configure backend probing interval Action: opened PR body: """ When be_ptask is created to monitor backend when SSSD is in offline mode checks are happening in specified intervals: delay = delay + (sss_rand() % task->random_offset); New configuration option is introduced in this commit: * refresh_max_random_offset Using this option allows end client to decide what should be the size of random offset when new interval for probing backend is calculated. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1925608 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5549/head:pr5549 git checkout pr5549

4 31

[sssd PR#5539][opened] [WIP] NSS: Clear negative cache when SIGHUP received
by elkoniu 13 Apr '21

13 Apr '21

URL: https://github.com/SSSD/sssd/pull/5539 Author: elkoniu Title: #5539: [WIP] NSS: Clear negative cache when SIGHUP received Action: opened PR body: """ When NSS receives SIGHUP signal it clears memory cache. As a part of signal handling procedure negative cache should be also cleared. Resolves: https://github.com/SSSD/sssd/issues/4973 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5539/head:pr5539 git checkout pr5539

3 44

[sssd PR#5537][opened] negcache: use right domain in nss_protocol_fill_initgr()
by sumit-bose 13 Apr '21

13 Apr '21

URL: https://github.com/SSSD/sssd/pull/5537 Author: sumit-bose Title: #5537: negcache: use right domain in nss_protocol_fill_initgr() Action: opened PR body: """ When checking if a group returned by an initgroups request is filtered in the negative cache the domain of the user was used. This does not work reliable if the user can be a member of groups from multiple domains. With this patch th domain the group belongs to is determined and used while checking the negative cache. Resolves: https://github.com/SSSD/sssd/issues/5534 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5537/head:pr5537 git checkout pr5537

3 25

[sssd PR#5560][opened] pam_sss: fixed potential mem leak
by alexey-tikhonov 13 Apr '21

13 Apr '21

URL: https://github.com/SSSD/sssd/pull/5560 Author: alexey-tikhonov Title: #5560: pam_sss: fixed potential mem leak Action: opened PR body: """ Fixes following covscan issue: ``` Error: RESOURCE_LEAK (CWE-772): [#def1] src/sss_client/pam_sss.c:1714: alloc_arg: "asprintf" allocates memory that is stored into "prompt". src/sss_client/pam_sss.c:1765: leaked_storage: Variable "prompt" going out of scope leaks the storage it points to. # 1763| free(response); # 1764| # 1765|-> return ret; # 1766| #else # 1767| return ENOTSUP; ``` https://bugzilla.redhat.com/show_bug.cgi?id=1938876 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5560/head:pr5560 git checkout pr5560

2 11

[sssd PR#5562][opened] AD GPO: respect ad_gpo_implicit_deny if no GPO is present
by sumit-bose 13 Apr '21

13 Apr '21

URL: https://github.com/SSSD/sssd/pull/5562 Author: sumit-bose Title: #5562: AD GPO: respect ad_gpo_implicit_deny if no GPO is present Action: opened PR body: """ Currently ad_gpo_implicit_deny=True is not applied if there is no GPO at all for the given client. With this patch this case is handled as expected as well. Resolves: https://github.com/SSSD/sssd/issues/5561 :fixes: respect ad_gpo_implicit_deny if no GPO is present """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5562/head:pr5562 git checkout pr5562

3 12

[sssd PR#5558][opened] p11_child: Add partial verification support
by 3v1n0 12 Apr '21

12 Apr '21

URL: https://github.com/SSSD/sssd/pull/5558 Author: 3v1n0 Title: #5558: p11_child: Add partial verification support Action: opened PR body: """ From the main commit: <blockquote> As per the switch to libcrypto by default, the CA certificates DB needs to contain the whole certificates key-chain in order to verify a leaf certificate. This means that if an intermediate CA authority signed a leaf certificate the CA DB we provide to SSSD needs to contain the whole key-chain, up to the root CA cert in order to verify the leaf one. Now, while this is indeed more secure, it may break previous configurations that were based on an NSS database that contained only trusted intermediate CA certificates. To allow such setups to continue working (once the NSS db is migrated) we need to permit a "weaker" setup where an x509 certificate is verified when the CA database we test against contains only the intermediate CA certificate that was used to sign it. As per this, support `partial_chain` value to be used as `certification_verification` parameter that will add the `X509_V_FLAG_PARTIAL_CHAIN` verify param flag to the store, as the openssl's verify `-partial-chain` parameter works. This setup can still be considered secure as it's still needed to have configured the SSSD ca db to contain the trusted certs. Add tests to check that we can verify a leaf certificate against its parent (only) when using such option. </blockquote> In particular in Ubuntu we [switched to use libcrypto by default in our current LTS](https://bugs.launchpad.net/ubuntu/focal/+source/sssd/+bug/1905790), even if we never supported properly the usage of NSS system DB, it was possible to setup one and so we did a [simple migration tool](https://github.com/3v1n0/nss-database-pem-exporter) to export all the trusted NSS certificates to the SSSD's `ca_db`. However, there are still some custom setups in which [may break when using openssl based implementation](https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1919563), because their NSS db was only containing the issuing CA certificates (and no their parent certs) and so it's not possible to verify their certificate. So using `pam_cert_verification = partial_chain` on upgrades (only and only if migrated) we can ensure that no such system will be broken. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5558/head:pr5558 git checkout pr5558

3 31

[sssd PR#5495][opened] Fix python headers detection with recent autoconf (Fixes #5336)
by mtorromeo 08 Apr '21

08 Apr '21

URL: https://github.com/SSSD/sssd/pull/5495 Author: mtorromeo Title: #5495: Fix python headers detection with recent autoconf (Fixes #5336) Action: opened PR body: """ See details in issue report #5336. This is causing issues on Arch Linux which is using autoconf-2.71 at the moment. This only addresses the specific issue with python headers detection and not the whole use of if statements in autoconf files. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5495/head:pr5495 git checkout pr5495

4 17

[sssd PR#5535][opened] A set of patches to sanitize logger code a little bit.
by alexey-tikhonov 06 Apr '21

06 Apr '21

URL: https://github.com/SSSD/sssd/pull/5535 Author: alexey-tikhonov Title: #5535: A set of patches to sanitize logger code a little bit. Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5535/head:pr5535 git checkout pr5535

5 25

[sssd PR#5546][opened] kcm: add GET_CRED_LIST for faster iteration
by pbrezina 06 Apr '21

06 Apr '21

URL: https://github.com/SSSD/sssd/pull/5546 Author: pbrezina Title: #5546: kcm: add GET_CRED_LIST for faster iteration Action: opened PR body: """ For large caches, one IPC operation per credential dominates the cost of iteration. Instead transfer the whole list of credentials to the client in one IPC operation. Resolves: https://github.com/SSSD/sssd/issues/5545 This is a continuation of https://github.com/SSSD/sssd/pull/5375. The first pull requests addressed bottlenecks in sssd-kcm and reduced the test case run time from 30 minutes to 2 minutes, this new operation takes it down to 9 seconds. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5546/head:pr5546 git checkout pr5546

2 14

[sssd PR#5564][opened] DEBUG: Error is printed when everything is ok
by thalman 01 Apr '21

01 Apr '21

URL: https://github.com/SSSD/sssd/pull/5564 Author: thalman Title: #5564: DEBUG: Error is printed when everything is ok Action: opened PR body: """ Due to invalid condition error message that config file does not exist is printed when there is actually no problem. This update fixes the condition. Thanks @alexey-tikhonov for pointing this out. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5564/head:pr5564 git checkout pr5564

3 8

[sssd PR#5559][opened] CI: Use builtin command for pycodestyle check
by justin-stephenson 31 Mar '21

31 Mar '21

URL: https://github.com/SSSD/sssd/pull/5559 Author: justin-stephenson Title: #5559: CI: Use builtin command for pycodestyle check Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5559/head:pr5559 git checkout pr5559

2 8

[sssd PR#5524][opened] Fix setXYent(): rewind always
by HeikoSchlittermann 25 Mar '21

25 Mar '21

URL: https://github.com/SSSD/sssd/pull/5524 Author: HeikoSchlittermann Title: #5524: Fix setXYent(): rewind always Action: opened PR body: """ This compensates for "forgotten" endXYent() calls during the same session, as observed with Dovecot authd. Patch co-authored by Sumit Bose. XY: setpwent(), setgrent(), setsvcent() This would fix https://github.com/SSSD/sssd/issues/5523 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5524/head:pr5524 git checkout pr5524

4 29

[sssd PR#5547][opened] systemd configs: add CAP_DAC_OVERRIDE for ifp in certain case
by alexey-tikhonov 25 Mar '21

25 Mar '21

URL: https://github.com/SSSD/sssd/pull/5547 Author: alexey-tikhonov Title: #5547: systemd configs: add CAP_DAC_OVERRIDE for ifp in certain case Action: opened PR body: """ Commit fd7ce7b3de9647eb6de75c3dd3974b44d860078e missed ifp. This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1937654 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5547/head:pr5547 git checkout pr5547

3 11

[sssd PR#5516][opened] fix selinux warnings
by pbrezina 22 Mar '21

22 Mar '21

URL: https://github.com/SSSD/sssd/pull/5516 Author: pbrezina Title: #5516: fix selinux warnings Action: opened PR body: """ selinux: fix warning ‘matchpathcon’ is deprecated ``` src/util/selinux.c: In function ‘selinux_file_context’: src/util/selinux.c:50:9: error: ‘matchpathcon’ is deprecated: Use selabel_lookup instead [-Werror=deprecated-declarations] 50 | if (matchpathcon(dst_name, 0, &scontext) < 0) { ``` selinux: fix warning ‘security_context_t’ is deprecated The type is now deprecated, char * should be used instead https://github.com/SELinuxProject/selinux/commit/9eb9c9327563014ad6a807814e… """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5516/head:pr5516 git checkout pr5516

3 24

[sssd PR#5538][opened] SPEC: added 'BuildRequires: po4a'
by alexey-tikhonov 22 Mar '21

22 Mar '21

URL: https://github.com/SSSD/sssd/pull/5538 Author: alexey-tikhonov Title: #5538: SPEC: added 'BuildRequires: po4a' Action: opened PR body: """ 'po4a' is needed when building from srpm made from upstream sources, i.e. without prepared translations. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5538/head:pr5538 git checkout pr5538

3 10

[sssd PR#5517][opened] Translations update from Weblate
by weblate 18 Mar '21

18 Mar '21

URL: https://github.com/SSSD/sssd/pull/5517 Author: weblate Title: #5517: Translations update from Weblate Action: opened PR body: """ Translations update from [Weblate](https://translate.fedoraproject.org/projects/sssd/sssd-master/) for SSSD/sssd. Current translation status: ![Weblate translation status](https://translate.fedoraproject.org/widgets/sssd/-/sssd-master/hori… """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5517/head:pr5517 git checkout pr5517

2 6

[sssd PR#5511][opened] TEST: Update test docstrings to enable auto polarion updates
by sgoveas 16 Mar '21

16 Mar '21

URL: https://github.com/SSSD/sssd/pull/5511 Author: sgoveas Title: #5511: TEST: Update test docstrings to enable auto polarion updates Action: opened PR body: """ These docstring updates are a requirement to enable automatic updates into polarion using betelguese tool. It will help to add/update test cases and import test results from CI. Each test case must have 'id' to make it unique. The tool will use it to update the respective case and will avoid adding duplicate test case in polarion. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5511/head:pr5511 git checkout pr5511

4 11

[sssd PR#5527][opened] TEST: missing multihost in service_ctrl
by sgoveas 16 Mar '21

16 Mar '21

URL: https://github.com/SSSD/sssd/pull/5527 Author: sgoveas Title: #5527: TEST: missing multihost in service_ctrl Action: opened PR body: """ This update will fix the method and make it usable """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5527/head:pr5527 git checkout pr5527

4 9

[sssd PR#5530][opened] p11_child: fixed mistype in a debug message
by alexey-tikhonov 16 Mar '21

16 Mar '21

URL: https://github.com/SSSD/sssd/pull/5530 Author: alexey-tikhonov Title: #5530: p11_child: fixed mistype in a debug message Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5530/head:pr5530 git checkout pr5530

4 9

[sssd PR#5245][opened] RESOLV: Avoid DNS search to improve fail-over reaction
by thalman 16 Mar '21

16 Mar '21

URL: https://github.com/SSSD/sssd/pull/5245 Author: thalman Title: #5245: RESOLV: Avoid DNS search to improve fail-over reaction Action: opened PR body: """ In case of unreachable DNS server or invalid hostname sssd/c-ares tries to search in multiple domains based on the search directive in resolv.conf But the hostnames in config file are fully qualified and this just extends the time spent with DNS resolution. This patch set the c-ares library flags to avoid DNS search Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1608496 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5245/head:pr5245 git checkout pr5245

5 31

p11_child and removable devices
by Vladimir Vakhlamov 09 Mar '21

09 Mar '21

Hello Guys could anybody clarify why p11_child handles only first found removable device? Why wouldn't it handle all removable slots?

3 4

[sssd PR#5498][opened] Covscan fixes
by abbra 08 Mar '21

08 Mar '21

URL: https://github.com/SSSD/sssd/pull/5498 Author: abbra Title: #5498: Covscan fixes Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5498/head:pr5498 git checkout pr5498

2 7

[sssd PR#5513][opened] TESTS: test socket path when systemd activation
by ikerexxe 05 Mar '21

05 Mar '21

URL: https://github.com/SSSD/sssd/pull/5513 Author: ikerexxe Title: #5513: TESTS: test socket path when systemd activation Action: opened PR body: """ Test socket path when sssd-kcm is activated by systemd. If socket in systemd unit and sssd.conf is defined in different locations then print a warning. Verifies: https://github.com/SSSD/sssd/issues/5406 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5513/head:pr5513 git checkout pr5513

3 23

[sssd PR#5522][opened] spec: do not use systemd to restart services with RefuseManualStart=true
by pbrezina 05 Mar '21

05 Mar '21

URL: https://github.com/SSSD/sssd/pull/5522 Author: pbrezina Title: #5522: spec: do not use systemd to restart services with RefuseManualStart=true Action: opened PR body: """ These service unit files have RefuseManualStart=true, therefore they can be controlled only as a dependency via the main sssd.service or socket activation. Resolves: https://github.com/SSSD/sssd/issues/5521 :fixes: SSSD spec file `%postun` no longer tries to restart services that can not be restarted directly to stop produce systemd warnings """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5522/head:pr5522 git checkout pr5522

2 11

[sssd PR#5525][opened] Log performance improvements.
by alexey-tikhonov 05 Mar '21

05 Mar '21

URL: https://github.com/SSSD/sssd/pull/5525 Author: alexey-tikhonov Title: #5525: Log performance improvements. Action: opened PR body: """ A set of patches intended to improve log performance. As a result, time spent in a trivial test: ``` for (c = 0; c < 10000000; ++c) { DEBUG(SSSDBG_OP_FAILURE, "Message %d\n", c); } ``` with "--debug-timestamps=1 --debug-microseconds=0" is reduced on my machine from ~34 to ~14 seconds (i.e. ~55% faster). """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5525/head:pr5525 git checkout pr5525

3 16

[sssd PR#5526][opened] Covscan fixes
by alexey-tikhonov 05 Mar '21

05 Mar '21

URL: https://github.com/SSSD/sssd/pull/5526 Author: alexey-tikhonov Title: #5526: Covscan fixes Action: opened PR body: """ This is overtake of PR #5498 (based on https://github.com/SSSD/sssd/pull/5498#issuecomment-789576996 comment) Two patches were taken "as is". Patch "symlink() expects non-NULL second argument" was slightly amended (different error code used). One patch was skipped as I either don't understand it or it's not entirely correct. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5526/head:pr5526 git checkout pr5526

2 11

How are security issues related to sssd reported
by Gordon Messmer 02 Mar '21

02 Mar '21

What is the best way to contact sssd developers to discuss security issues privately, in the event that a flaw is discovered?

2 1

sssd nss: issues with applications not using endpwent()
by Heiko Schlittermann 01 Mar '21

01 Mar '21

Hello, I'm using Dovecot with its "passwd" userdb, which effectivly uses NSS. NSS services are provided by the files and by the sss "plugins". The `doveadm user *` command enumerates the list of users. Repeating the command doesn't enumerate the users provided by sssd again. Analyzing this issue reveals: Dovecot uses a long living process talking to NSS. For user enumeration it uses setpwent() while (…) { getpwent(); } and then misses the call to endpwent(). This bug is already confirmed by the Dovecot developers. I'm not sure about the semantics of setpwent()/endpwend(), especially about calling sequences like setpwent() while (…) { getpwent(); } setpwent() while (…) { getpwent(); } According to setpwent(3) it should rewind to the beginning. Calling endpwent() seems to be for curtesy only (to have resources freed) I suggest calling a preventive endpwent() before using setpwent() again in nss_cmd.c. Attached you'll find my patch. I'd be happy about integration into upstream. Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -

2 3

[sssd PR#5519][opened] First smart refresh query contains modifyTimestamp even if the modify…
by aborah-sudo 01 Mar '21

01 Mar '21

URL: https://github.com/SSSD/sssd/pull/5519 Author: aborah-sudo Title: #5519: First smart refresh query contains modifyTimestamp even if the modify… Action: opened PR body: """ …Timestamp is 0 Starting from sssd-1.16.5-10.el7_9, the first query performed with smart refresh contais modifyTimestamp attribute even if the modifyTimestamp is 0. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5519/head:pr5519 git checkout pr5519

3 13

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel March 2021