[sssd PR#702][opened] NSS: Avoid changing the memory cache ownership away from the SSSD user
by jhrozek
URL: https://github.com/SSSD/sssd/pull/702
Author: jhrozek
Title: #702: NSS: Avoid changing the memory cache ownership away from the SSSD user
Action: opened
PR body:
"""
Resolves: https://pagure.io/SSSD/sssd/issue/3890
In case SSSD is compiled --with-sssd-user but run as root (which is the
default on RHEL and derivatives), then the memory cache will be owned by
the user that sssd_nss runs as, so root.
This conflicts with the packaging which specifies sssd.sssd as the owner.
And in turn, this means that users can't reliably assess the package
integrity using rpm -V.
This patch makes sure that the memory cache files are chowned to sssd.sssd
even if the nss responder runs as root.
Also, this patch changes the sssd_nss responder so that is becomes a member
of the supplementary sssd group. Even though in traditional UNIX sense, a
process running as root could write to a file owned by sssd:sssd, with
SELinux enforcing mode this becomes problematic as SELinux emits an error
such as:
type=AVC msg=audit(1543524888.125:1495): avc: denied { fsetid } for
pid=7706 comm="sssd_nss" capability=4 scontext=system_u:system_r:sssd_t:s0
tcontext=system_u:system_r:sssd_t:s0 tclass=capability
To make it possible for the sssd_nss process to write to the files, the
files are also made group-writable. The 'others' permission is still set to
read only.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/702/head:pr702
git checkout pr702
4 years, 5 months
[sssd PR#713][opened] krb5_child: fix permissions during SC auth
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/713
Author: sumit-bose
Title: #713: krb5_child: fix permissions during SC auth
Action: opened
PR body:
"""
For PKINIT we might need access to the pcscd socket which by default is
only allowed for authenticated users. Since PKINIT is part of the
authentication and the user is not authenticated yet, we have to use
different privileges and can only drop it only after the TGT is
received. The fast_uid and fast_gid are the IDs the backend is running
with. This can be either root or the 'sssd' user. Root is allowed by
default and the 'sssd' user is allowed with the help of the
sssd-pcsc.rules policy-kit rule. So those IDs are a suitable choice. We
can only call switch_creds() because after the TGT is returned we have
to switch to the IDs of the user to store the TGT.
The final change to the IDs of the user is not only important for KCM
type credential caches but for file based ccache types like FILE or DIR
as well.
Related to https://pagure.io/SSSD/sssd/issue/3376
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/713/head:pr713
git checkout pr713
4 years, 5 months
[sssd PR#711][opened] ipa: use only the global catalog service of the forest root
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/711
Author: sumit-bose
Title: #711: ipa: use only the global catalog service of the forest root
Action: opened
PR body:
"""
While creating the domains and sub-domains each domain gets a global
catalog services assigned but only one should be used because the global
catalog is by definition responsible for the whole forest so it does not
make sense to use a global catalog service for each domain and in the worst
case connect to the same GC multiple times.
In the AD provider this is simple because the GC service of the configured
domain AD_GC_SERVICE_NAME ("AD_GC") can be used. In the IPA case all
domains from the trusted forest are on the level of sub-domains so we have
to pick one. Since the forest root is linked from all domain of the same
forest it will be the most straight forward choice.
This would also be the proper fix for https://pagure.io/SSSD/sssd/issue/3015 so
the original fix for this ticket is reverted because it would cause other issues.
Related to https://pagure.io/SSSD/sssd/issue/3902
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/711/head:pr711
git checkout pr711
4 years, 5 months
[sssd PR#707][opened] build: remove hardcoded samba include path
by gmccollister
URL: https://github.com/SSSD/sssd/pull/707
Author: gmccollister
Title: #707: build: remove hardcoded samba include path
Action: opened
PR body:
"""
SMBCLIENT_FLAGS already provides the samba-4.0 include path. Remove the
hardcoded samba include path which causes cross-compilation warnings
such as:
cc1: warning: include location "/usr/include/samba-4.0" is unsafe for
cross-compilation [-Wpoison-system-directories]
These warnings are treated as errors on build systems such as
OpenEmbedded.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/707/head:pr707
git checkout pr707
4 years, 5 months
[sssd PR#701][opened] ci: add ability to run tests in jenkins
by pbrezina
URL: https://github.com/SSSD/sssd/pull/701
Author: pbrezina
Title: #701: ci: add ability to run tests in jenkins
Action: opened
PR body:
"""
Jenkins master polls github for new branches and pull requests. When it discovers new pull request or branch or changes to existing pull request or branch it will allocate a jenkins agent and executes pipeline defined in `./Jenkinsfile` (in SSSD source) on this agent.
The pipeline executes `./contrib/test-suite/run.sh` and archives logs when testing is finished. Script `./contrib/test-suite/run.sh` prepares sssd-test-suite, starts the vagrant machines and copy SSSD source code to the client machine. Then it calls `./contrib/test-suite/run-client.sh` on the client machine which runs continuous integration tests.
### Extending current tests
To extend current testing capabilities, modify `./contrib/test-suite/run.sh` and `./contrib/test-suite/run-client.sh` to new requirements. These files can be modified by anyone but are considered untrusted from contributor that is not an administrator of SSSD repository. This means that if a public contributor submits a pull request that changes those files, Jenkins will refuse to run tests.
### Adding additional distribution to test on
You need to modify `./Jenkinsfile`. Simply copy, paste and amend existing Fedora 28 stage. This file is also considered untrusted so only administrators can modify it within a pull request.
You also need to extend `sssd-test-suite` and prepare vagrant boxes for this distro.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/701/head:pr701
git checkout pr701
4 years, 5 months