[sssd PR#908][opened] ifp: implement connection-wide access check

[pbrezina]

   URL: https://github.com/SSSD/sssd/pull/908
Author: pbrezina
 Title: #908: ifp: implement connection-wide access check
Action: opened

PR body:
"""
Currently only a small subset of infopipe methods performed access check.
This change makes sure that we do this check global for everything.

Steps to reproduce:
1. Call an infopipe method as a user not-listed in [ifp] allowed_uids
2. Without the patch the access is granted

E.g.
```
$ dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe
/org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.FindByName
string:user-1
```

Resolves:
https://pagure.io/SSSD/sssd/issue/4105
"""

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/908/head:pr908
git checkout pr908

[sssd PR#908][synchronized] ifp: implement connection-wide access check

[pbrezina]

   URL: https://github.com/SSSD/sssd/pull/908
Author: pbrezina
 Title: #908: ifp: implement connection-wide access check
Action: synchronized

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/908/head:pr908
git checkout pr908

[sssd PR#908][synchronized] ifp: implement connection-wide access check

[pbrezina]

   URL: https://github.com/SSSD/sssd/pull/908
Author: pbrezina
 Title: #908: ifp: implement connection-wide access check
Action: synchronized

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/908/head:pr908
git checkout pr908

[sssd PR#908][comment] ifp: implement connection-wide access check

[mzidek-rh]

  URL: https://github.com/SSSD/sssd/pull/908
Title: #908: ifp: implement connection-wide access check

mzidek-rh commented:
"""
I will review this tomorrow or on Friday.
"""

See the full comment at https://github.com/SSSD/sssd/pull/908#issuecomment-545504674

[sssd PR#908][+Rejected] ifp: implement connection-wide access check

[pbrezina]

  URL: https://github.com/SSSD/sssd/pull/908
Title: #908: ifp: implement connection-wide access check

Label: +Rejected

[sssd PR#908][comment] ifp: implement connection-wide access check

[pbrezina]

  URL: https://github.com/SSSD/sssd/pull/908
Title: #908: ifp: implement connection-wide access check

pbrezina commented:
"""
This is fixed since 2.0. The security impact is low (by default only posix attributes are
available) and we could break users applications that relies on the fact that the data is
available to everyone therefore we should not fix it in 1.16 where such change is
unacceptable.
"""

See the full comment at https://github.com/SSSD/sssd/pull/908#issuecomment-547362873

[sssd PR#908][closed] ifp: implement connection-wide access check

[pbrezina]

   URL: https://github.com/SSSD/sssd/pull/908
Author: pbrezina
 Title: #908: ifp: implement connection-wide access check
Action: closed

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/908/head:pr908
git checkout pr908