URL: https://github.com/SSSD/sssd/pull/175
Author: lslebodn
Title: #175: Add module for starting services
Action: opened
PR body:
"""
This is a WIP version of reducing code duplication in our cwrap integration tests.
I am still not sure whether we should also reuse function `create_sssd_fixture`.
And if yes; then probably in different nodule then `services`
And comments are welcome.
BTW I wrote patches few weeks ago; therefore new tests are not converted.
I am just sending patches to get some feedback.
Site effect of this patches is that tests are cca 20% faster (IIRC)
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/175/head:pr175
git checkout pr175
URL: https://github.com/SSSD/sssd/pull/844
Author: mastersin
Title: #844: sssd-ad and gpo_child: GPO apply fixes during reading fails
Action: opened
PR body:
"""
Ignore AD GPO errors:
- if SecEdit/GptTmpl.inf is missing
or
- if reading sysvol_gpt_version fails and cached_gpt_version already exists
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/844/head:pr844
git checkout pr844
URL: https://github.com/SSSD/sssd/pull/616
Author: asheplyakov
Title: #616: become_user: add supplementary groups so ad provider can access keytab
Action: opened
PR body:
"""
For security reasons one might want to run providers as a non-privileged
user (say, _sssd). However some providers (in particular ad) might need
an access to restricted (non world-readable) files (for instance,
/etc/krb5.keytab). One of the possible ways to solve the problem is to
- add a special group (for instance, _keytab)
- set the owner:group of the file in question to root:_keytab
- set the permissions of the file in question to 640
- make the _sssd user a member of the _keytab group
For this to work become_user should assign supplementary groups, which
is what this patch does.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/616/head:pr616
git checkout pr616
URL: https://github.com/SSSD/sssd/pull/943
Author: elkoniu
Title: #943: files_ops: Fix cached password remove
Action: opened
PR body:
"""
When SSSD daemon will detect refresh of password (group) file
it will delete all cached users (groups) data.
With this change cached data will be deleted only for non
existing users (groups).
Resolves:
https://pagure.io/SSSD/sssd/issue/3591
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/943/head:pr943
git checkout pr943
URL: https://github.com/SSSD/sssd/pull/269
Author: NWilson
Title: #269: Add support for ActiveDirectory's logonHours restrictions
Action: opened
PR body:
"""
This is a straightforward patch for denying access to a user when the user is not permitted to access their account due to logonHours restrictions.
This matches the default behaviour for domain-joined Windows machines. When outside the logonHours, all types of authentication are denied (password/Kerberos/certificate) - so it is appropriate to put this check inside the PAM "account" rules.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/269/head:pr269
git checkout pr269
URL: https://github.com/SSSD/sssd/pull/837
Author: sumit-bose
Title: #837: p11_child: make OCSP digest configurable
Action: opened
PR body:
"""
Currently sha1 is used to create the certid for an OCSP request. Since sha1
is not recommend for new applications anymore and not FIPS compliant this
patch changes the default to sha256 and makes the digest function
configurable as well.
Related to https://pagure.io/SSSD/sssd/issue/4032
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/837/head:pr837
git checkout pr837
URL: https://github.com/SSSD/sssd/pull/578
Author: amitkumar50
Title: #578: proxy: proxy_child hardening
Action: opened
PR body:
"""
proxy_child will call chdir("/"), umask(022)
and reset the environment with clearenv().
The --domain argument to be sanitized.
Resolves: https://pagure.io/SSSD/sssd/issue/2689
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/578/head:pr578
git checkout pr578
This is a continuation of SSSD migration from Pagure to Github.
We reconsidered our previous decision to keep existing issues in Pagure
and we chose to clone all issues to github instead. As much as we would
like to keep in touch with users on Pagure we are not able to close
remaining tickets in reasonable amount of time and having increased
number of issue trackers would drive us crazy instead of becoming more
efficient.
All existing issues (both open and closed) will be cloned to github this
weekend (May 2-3). Please, disable notifications from our github
repository [1] for this weekend by clicking on "unwatch" button
otherwise you will get several thousand of notifications.
You might have already got some notification from migration test (from
pbrezina/sssd-test repository) if you have the same username in Pagure
and Github and you were @mentioned in the ticket. Please, ignore those.
Issues on Pagure will be marked read only after this weekend and we will
only accept new issues on Github.
Thank you for understanding and I apologize for any inconvenience.
[1] https://github.com/SSSD/sssd
URL: https://github.com/SSSD/sssd/pull/1011
Author: pbrezina
Title: #1011: sysdb: check if the id override belongs to requested domain
Action: opened
PR body:
"""
Steps to reproduce:
1. Setup an id override (administrator(a)ad.vm: uid -> 10001)
2. Request user by name to fill cache
```
$ id Administrator(a)ad.vm
uid=10001(administrator(a)ad.vm) ...
```
3. Request user by id and see that domain part is missing
```
$ id 10001
uid=10001(administrator) ...
```
First, the uid is looked up in IPA domain and the override object is
found when we hit `sysdb_search_override_by_id` because id values are
not qualified. Therefore the origin object (administrator(a)ad.vm) is
returned as part of IPA domain.
We need to check if the original object belongs to the requested domain.
Resolves:
https://pagure.io/SSSD/sssd/issue/4173
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/1011/head:pr1011
git checkout pr1011
URL: https://github.com/SSSD/sssd/pull/1005
Author: sumit-bose
Title: #1005: pam: Use cache for users with existing session
Action: opened
PR body:
"""
Users that have an existing session do the bulk of their authentication to
unlock services that do not make use of initgroups (used only to create a
new login session). Forcing online initgroups calls for these users leads
mostly to delays in providing those services and do not provide any useful
data.
Resolves: https://pagure.io/SSSD/sssd/issue/4098
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/1005/head:pr1005
git checkout pr1005
URL: https://github.com/SSSD/sssd/pull/1026
Author: alexey-tikhonov
Title: #1026: MAN: fixed description of pam_cert_db_path
Action: opened
PR body:
"""
Part about "PKCS#11 modules" only applies to NSS version.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/1026/head:pr1026
git checkout pr1026
URL: https://github.com/SSSD/sssd/pull/999
Author: alexey-tikhonov
Title: #999: Mem-cache fixes/improvements
Action: opened
PR body:
"""
This is set of patches consisting of the following:
(1) fix of https://pagure.io/SSSD/sssd/issue/4160
(2) revival of @mzidek-gh's patch to make size of mem-caches configurable (#390)
(3 & 4) slight improvements of (2)
(5) additional debug&syslog message to signal user that cache is full and may require change of size
This is to address https://github.com/SSSD/sssd/pull/390#issuecomment-371428333 (at least to some extent)
I keep those patches separate to make review easier. But if PR will be accepted then it makes sense to squash (2, 3 & 4) into single patch before merging.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/999/head:pr999
git checkout pr999
URL: https://github.com/SSSD/sssd/pull/1022
Author: elkoniu
Title: #1022: Fix group policy security filtering and download
Action: opened
PR body:
"""
This is just rebase of original Pagure pull request:
https://pagure.io/SSSD/sssd/pull-request/3320#
Some extra testing may be required before merging this.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/1022/head:pr1022
git checkout pr1022
URL: https://github.com/SSSD/sssd/pull/1020
Author: pbrezina
Title: #1020: Move code and issues tracker to Github
Action: opened
PR body:
"""
This changes readme.
I have opened issues tracker on Github. Unfortunately, issues can still be created
on Pagure because there is only option to make issues 'read only' which will disable
'new issue' button but we won't be able to add comments to existing issues.
I will move releases to Github during next week.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/1020/head:pr1020
git checkout pr1020
URL: https://github.com/SSSD/sssd/pull/1019
Author: alexey-tikhonov
Title: #1019: Backport of crashbug fix #737 to 1-16
Action: opened
PR body:
"""
This is backport of patches from #737 (excluding one not strictly required patch) where one of the patches (namely "providers/proxy: fixed erroneous free of orig_grp" ) was amended with fix from PR https://pagure.io/SSSD/sssd/pull-request/4036
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/1019/head:pr1019
git checkout pr1019
On 4/3/20 1:40 PM, Lukas Slebodnik wrote:
> On (03/04/20 13:12), Pavel Březina wrote:
>> SSSD repository is currently spread over multiple places. We use Pagure
>> [1][2] to manage upstream issues and documentation and Github [3] as our main
>> development platform.
>>
>> We chose to move only to a single platform to reduce number of tools we use
>> and to have everything at one place. We decided to move from Pagure to
>> Github.
>>
>> There are several steps that needs to be done in order to achieve this change
>> but the most significant for our users and contributors is: We will no longer
>> accept new issues and pull request in Pagure and we will kindly ask you to
>> use Github instead.
>>
>> I will disable issues and pull request on Pagure and enable issues on Github
>> on Wednesday, April 8.
Issue tracker was opened on github.
Old issues will be kept in Pagure so we can communicate with original
reporters (Github does not support Fedora Account so we can not simply
migrate them). Unfortunately 'New issue' button is still available on
Pagure - there does not seem to be a way how to disable new issues
without making the issues read only. But please, report new issues
against Github.
> Old issues from fdorahosted are still accesible because they are redirected to
> pagure e.g.
> https://fedorahosted.org/sssd/ticket/2846 -> https://pagure.io/SSSD/sssd/issue/2846
>
> And issues from fedorahosted/pagure are available on many places bugzilla/mail
> archive ...
>
> What is a plan with migrating/redirecting issues?
Because Github does not support Fedora Accounts and we would like to be
able to communicate with original reporters old issues will be still
available on Pagure until they are all resolved. So old issues will not
be migrated and the links will keep working.
>
> LS
> _______________________________________________
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.…
>
URL: https://github.com/SSSD/sssd/pull/1015
Author: pbrezina
Title: #1015: proxy: allow proxy provider to start without having proxy_resolver_lib_name set
Action: opened
PR body:
"""
Proxy provider fails to start unless `proxy_resolver_lib_name` is set
since recent hosts resolver addition. This would impact all existing
proxy provider configurations.
This patch makes sure that proxy resolver is disabled if the option
is not set but other functions are not affected.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/1015/head:pr1015
git checkout pr1015
URL: https://github.com/SSSD/sssd/pull/1018
Author: alexey-tikhonov
Title: #1018: mem-cache: sizes of free and data tables were made consistent
Action: opened
PR body:
"""
This is partial backport of #999
Since size of "free table" didn't account for SSS_AVG_*_PAYLOAD factor
only small fraction of "data table" was actually used.
SSS_AVG_*_PAYLOAD differentiation for different payload types only
affected size of hash table and was removed as unjustified.
Resolves: https://pagure.io/SSSD/sssd/issue/4160
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/1018/head:pr1018
git checkout pr1018
URL: https://github.com/SSSD/sssd/pull/992
Author: lfrancke
Title: #992: This changes the default ldap_group_name attribute to sAMAccountName
Action: opened
PR body:
"""
This changes the default ldap_group_name attribute to sAMAccountName when the ad schema is used for the LDAP provider.
This is to make it consistent with the AD provider which was changed in adb148603344a42d6edffdda0786a10af715dacb.
"name" is an optional field for the group class.
See https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… for a short discussion
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/992/head:pr992
git checkout pr992
URL: https://github.com/SSSD/sssd/pull/1009
Author: noelpower
Title: #1009: Use ndr_pull_steal_switch_value for modern samba versions
Action: opened
PR body:
"""
commit bc56b10aea999284458dcc293b54cf65288e325d attempted to
fix the build error resulting from removal of 'ndr_pull_get_switch'
However this just basically leaves the old code in place, the
reason for the change in the samba code was to address a possible
NDR crash from possible illegal large array allocations, please
see https://bugzilla.samba.org/show_bug.cgi?id=13876
This change uses the new replacement method
'ndr_pull_steal_switch_value' if available and otherwise puts
back the old method (which better describes what the code is doing)
Signed-off-by: Noel Power <noel.power(a)suse.com>
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/1009/head:pr1009
git checkout pr1009
SSSD repository is currently spread over multiple places. We use Pagure
[1][2] to manage upstream issues and documentation and Github [3] as our
main development platform.
We chose to move only to a single platform to reduce number of tools we
use and to have everything at one place. We decided to move from Pagure
to Github.
There are several steps that needs to be done in order to achieve this
change but the most significant for our users and contributors is: We
will no longer accept new issues and pull request in Pagure and we will
kindly ask you to use Github instead.
I will disable issues and pull request on Pagure and enable issues on
Github on Wednesday, April 8.
Thank you.
Best regards,
Pavel.
[1] https://pagure.io/SSSD/sssd
[2] https://pagure.io/SSSD/docs
[3] https://github.com/SSSD/sssd
URL: https://github.com/SSSD/sssd/pull/1013
Author: thalman
Title: #1013: SYSDB: override_gid not working for subdomains
Action: opened
PR body:
"""
The override_gid is not propagated to subdomain. This patch
assigns subdomain's override_gid to the value comming from
parent domain.
Resolves:
https://pagure.io/SSSD/sssd/issue/4061
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/1013/head:pr1013
git checkout pr1013
URL: https://github.com/SSSD/sssd/pull/1014
Author: sumit-bose
Title: #1014: sysdb: sanitize certmap rule name before using it in DN
Action: opened
PR body:
"""
The name of a certificate mapping and matching rule might contain
characters which are not allowed in RDNs an must be escaped before if can
be used in the DN of the cached certmap object.
Resolves: https://pagure.io/SSSD/sssd/issue/3721
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/1014/head:pr1014
git checkout pr1014
URL: https://github.com/SSSD/sssd/pull/1000
Title: #1000: Support NSS networks database lookups
pbrezina commented:
"""
Thank you. I see these warnings:
```
CC src/util/libsss_util_la-domain_info_utils.lo
/home/pbrezina/workspace/sssd/src/db/sysdb_ipnetworks.c: In function ‘sysdb_getipnetworkbyname’:
/home/pbrezina/workspace/sssd/src/db/sysdb_ipnetworks.c:85:35: error: passing argument 5 of ‘sysdb_search_ipnetworks’ from incompatible pointer type [-Werror=incompatible-pointer-types]
85 | &res->count, &res->msgs);
| ^~~~~~~~~~~
| |
| unsigned int *
In file included from /home/pbrezina/workspace/sssd/src/db/sysdb_ipnetworks.c:27:
/home/pbrezina/workspace/sssd/src/db/sysdb_ipnetworks.h:81:41: note: expected ‘size_t *’ {aka ‘long unsigned int *’} but argument is of type ‘unsigned int *’
81 | size_t *msgs_count,
| ~~~~~~~~^~~~~~~~~~
/home/pbrezina/workspace/sssd/src/db/sysdb_ipnetworks.c: In function ‘sysdb_getipnetworkbyaddr’:
/home/pbrezina/workspace/sssd/src/db/sysdb_ipnetworks.c:152:35: error: passing argument 5 of ‘sysdb_search_ipnetworks’ from incompatible pointer type [-Werror=incompatible-pointer-types]
152 | &res->count, &res->msgs);
| ^~~~~~~~~~~
| |
| unsigned int *
In file included from /home/pbrezina/workspace/sssd/src/db/sysdb_ipnetworks.c:27:
/home/pbrezina/workspace/sssd/src/db/sysdb_ipnetworks.h:81:41: note: expected ‘size_t *’ {aka ‘long unsigned int *’} but argument is of type ‘unsigned int *’
81 | size_t *msgs_count,
| ~~~~~~~~^~~~~~~~~~
/home/pbrezina/workspace/sssd/src/db/sysdb_ipnetworks.c: In function ‘sysdb_enumnetent’:
/home/pbrezina/workspace/sssd/src/db/sysdb_ipnetworks.c:853:35: error: passing argument 5 of ‘sysdb_search_ipnetworks’ from incompatible pointer type [-Werror=incompatible-pointer-types]
853 | &res->count, &res->msgs);
| ^~~~~~~~~~~
| |
| unsigned int *
/home/pbrezina/workspace/sssd/src/db/sysdb_ipnetworks.c:643:41: note: expected ‘size_t *’ {aka ‘long unsigned int *’} but argument is of type ‘unsigned int *’
643 | size_t *msgs_count,
| ~~~~~~~~^~~~~~~~~~
cc1: all warnings being treated as errors
```
```
$ echo $CFLAGS
-m64 -mtune=generic -fstack-protector-all -Wall -Wextra -Wno-sign-compare -Wshadow -Wunused-variable -Wno-unused-parameter -Wno-error=cpp -O0 -ggdb3 -Werror -Wp,-U_FORTIFY_SOURCE
$ rpm -q gcc
gcc-9.2.1-1.fc31.x86_64
```
"""
See the full comment at https://github.com/SSSD/sssd/pull/1000#issuecomment-607160585
URL: https://github.com/SSSD/sssd/pull/1006
Author: elkoniu
Title: #1006: LDAP: Netgroups refresh in background task
Action: opened
PR body:
"""
refresh_expired_interval config value spawns be_task
responsible for refreshing expired cache entries
in background.
Netgroup related entries are stored in persistent
cache rather than timestamp cache. After sdap_refresh_step()
has been replaced by generic be_refresh_step()
lookup routine was searching for entries only in
timestamp cache. This result in LDAP netgroup entries
not refreshing in background.
Resolves:
https://bugzilla.redhat.com/show_bug.cgi?id=1779486
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/1006/head:pr1006
git checkout pr1006