1:58 a.m.
URL: https://github.com/SSSD/sssd/pull/578
Author: amitkumar50
Title: #578: proxy: proxy_child hardening
Action: opened
PR body:
"""
proxy_child will call chdir("/"), umask(022)
and reset the environment with clearenv().
The --domain argument to be sanitized.
Resolves: https://pagure.io/SSSD/sssd/issue/2689
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/578/head:pr578
git checkout pr578
1:58 a.m.
New subject: [sssd PR#578][comment] proxy: proxy_child hardening
URL: https://github.com/SSSD/sssd/pull/578
Title: #578: proxy: proxy_child hardening
centos-ci commented:
"""
Can one of the admins verify this patch?
"""
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-391241247
1:58 a.m.
New subject: [sssd PR#578][comment] proxy: proxy_child hardening
URL: https://github.com/SSSD/sssd/pull/578
Title: #578: proxy: proxy_child hardening
centos-ci commented:
"""
Can one of the admins verify this patch?
"""
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-391241246
2 a.m.
New subject: [sssd PR#578][comment] proxy: proxy_child hardening
URL: https://github.com/SSSD/sssd/pull/578
Title: #578: proxy: proxy_child hardening
amitkumar50 commented:
"""
sanitizing --domain argument is to be worked upon. your thoughts on this.
"""
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-391241786
10:05 a.m.
New subject: [sssd PR#578][comment] proxy: proxy_child hardening
URL: https://github.com/SSSD/sssd/pull/578
Title: #578: proxy: proxy_child hardening
jhrozek commented:
"""
ok to test
"""
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-391381622
10:06 a.m.
New subject: [sssd PR#578][comment] proxy: proxy_child hardening
URL: https://github.com/SSSD/sssd/pull/578
Title: #578: proxy: proxy_child hardening
jhrozek commented:
"""
@mzidek-rh do we already have some code that checks the name of the domain is valid? The
man page says that only alphanumerical characters, dashes and underscores are allowed, but
I can't find any code that would enforce this.
"""
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-391382082
5:21 a.m.
New subject: [sssd PR#578][comment] proxy: proxy_child hardening
URL: https://github.com/SSSD/sssd/pull/578
Title: #578: proxy: proxy_child hardening
mzidek-rh commented:
"""
@jhrozek Hi, sorry missed the question before (thanks @fidencio for the notice). AFAIK we
do not sanitize the domain name nor do we check if it is a valid domain name.
Slightly related: We have some sssctl config-check rules for the domain section name (but
I think they were problematic in some way, I think the rules are too benevolent and allow
also invalid domain names because we did not wanted to be too restricted in domain names,
but I would have to check the config-check code again if this was the case)
"""
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-404465219
7:45 a.m.
New subject: [sssd PR#578][comment] proxy: proxy_child hardening
URL: https://github.com/SSSD/sssd/pull/578
Title: #578: proxy: proxy_child hardening
alexey-tikhonov commented:
"""
Hi @amitkumar50,
I am not sure if you are still interested in this PR.
But if so:
1) please see comments I have left inline
2) don't you mind to update commit message please? It would be nice to have there
explanation why those changes are needed. Also I do not understand "The --domain
argument to be sanitized." part -- patch doesn't perform any arguments
check...
"""
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-541049225
7:52 a.m.
New subject: [sssd PR#578][comment] proxy: proxy_child hardening
URL: https://github.com/SSSD/sssd/pull/578
Title: #578: proxy: proxy_child hardening
alexey-tikhonov commented:
"""
Hi @amitkumar50,
I am not sure if you are still interested in this PR.
But if so:
1) please see comments I have left inline
2) don't you mind to update commit message please? It would be nice to have there
explanation why those changes are needed. Also I do not understand "The --domain
argument to be sanitized." part -- patch doesn't perform any arguments
check...
3) rebase on the latest master please
"""
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-541049225
5:45 a.m.
New subject: [sssd PR#578][+Changes requested] proxy: proxy_child hardening
URL: https://github.com/SSSD/sssd/pull/578
Title: #578: proxy: proxy_child hardening
Label: +Changes requested
9:15 a.m.
New subject: [sssd PR#578][comment] proxy: proxy_child hardening
URL: https://github.com/SSSD/sssd/pull/578
Title: #578: proxy: proxy_child hardening
centos-ci commented:
"""
Can one of the admins verify this patch?
"""
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-391241247
12:58 p.m.
New subject: [sssd PR#578][+superseded] proxy: proxy_child hardening
URL: https://github.com/SSSD/sssd/pull/578
Title: #578: proxy: proxy_child hardening
Label: +superseded
12:58 p.m.
New subject: [sssd PR#578][-Changes requested] proxy: proxy_child hardening
URL: https://github.com/SSSD/sssd/pull/578
Title: #578: proxy: proxy_child hardening
Label: -Changes requested
12:59 p.m.
New subject: [sssd PR#578][comment] proxy: proxy_child hardening
URL: https://github.com/SSSD/sssd/pull/578
Title: #578: proxy: proxy_child hardening
alexey-tikhonov commented:
"""
Superseded by https://github.com/SSSD/sssd/pull/5268
"""
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-671501355
12:59 p.m.
New subject: [sssd PR#578][closed] proxy: proxy_child hardening
URL: https://github.com/SSSD/sssd/pull/578
Author: amitkumar50
Title: #578: proxy: proxy_child hardening
Action: closed
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/578/head:pr578
git checkout pr578
1352
days inactive
2162
days old
sssd-devel@lists.fedorahosted.org
14 comments
5 participants
participants (5)
-
alexey-tikhonov -
amitkumar50
-
centos-ci
-
jhrozek
-
mzidek-rh