[PATCH] SPEC: Fix typo in Summary
by Lukas Slebodnik
ehlo,
I found a typo when packagein 1.14.1 in fedora.
Actually, It was already fixed. I just forgot to sent patch into upstream.
LS
7 years, 8 months
[PATCH] BUILD: Allow to read private pipes for root
by Lukas Slebodnik
ehlo,
Root can read anything from any directory even with permissions 000.
However SELinux checks discretionary access control (DAC)
and deny access if access is not allowed for root by DAC.
The pam_sss use different unix socket /var/lib/sss/pipes/private/pam
for user with uid 0. Therefore root need to be able read content
of directory with private pipes.
type=AVC msg=audit(08/19/2016 10:58:34.081:3369) : avc: denied
{ dac_read_search } for pid=20257 comm=vsftpd capability=dac_read_search
scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability
type=AVC msg=audit(08/19/2016 10:58:34.081:3369) : avc: denied
{ dac_override } for pid=20257 comm=vsftpd capability=dac_override
scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability
LS
7 years, 8 months
[PATCH] IPA: Parse qualified names when guessing AD user principal
by Jakub Hrozek
The attached patch fixes issues with logging in as users without an
explicit UPN in a trust scenario. The simplest reproducer is to log in
as Administrator or configure sssd to not look up the principal
attribute by adding this to the server's sssd.conf
subdomain_inherit = ldap_user_principal
ldap_user_principal = nosuchatt
Please see the commit message for more details.
7 years, 8 months
[PATCH] watchdog: cope with time shift
by Pavel Březina
scratch build was tested and fix confirmed. I think we should also
reschedule all existing tevent timers, we don't have an infrastructure
to do it though.
7 years, 8 months
[PATCH SET] WIP: INTG: Tests for ldap nested netgroups
by Petr Cech
Hello list,
there is attached patch set for intg. testing of ldap nested netgroups.
I used last version of Lukas patch 'sssd_netgroup.py: Resolve nested
netgroups'. I don't know if it is on list.
It is still WIP. It is in state that it is possible to run it.
But there are comments in code what is needed to fix.
If I remove some netgroups (in test), it is updated on LDAP and in
cache, but sssd_netgroup.get_sssd_netgroups() returns nothing.
Please, see test_reproducer_t2841() in the second patch
for more details. I debug it with run_shell() and there are some
notes from LDAP server and LDB cache attached [1].
[1] ldap_ldb_content.txt
Regards
--
Petr^4 Čech
7 years, 8 months