[sssd PR#5745][opened] cache_req: cache_first fix for fully-qualified names
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/5745
Author: sumit-bose
Title: #5745: cache_req: cache_first fix for fully-qualified names
Action: opened
PR body:
"""
With commit b572871236a7f9059d375a5ab1bff8cbfd519956 "cache_req:
introduce cache_behavior enumeration" the processing of cache and
backend lookups was refactored. Unfortunately this introduce an issue
when looking up users or groups with a fully-qualified name and the
'cache_first = True' option is set.
In the old code the case when a domain name is available was handle
before the cache_first first option was evaluated and cache_req was
instructed to first look in the cache and then call the backend if the
object is not available or expired, i.e. the default behavior. Since
only a single domain is involved this is in agreement with 'cache_first
= True' and only a single iteration is needed.
In the new code the cache_first option is evaluated before the presence
of a domain name is checked and as a result even for single domain
searches the first cache_req iteration is only looking at the cache and
will not call the backend. This means the now for searches with a
fully-qualified name a second iteration is needed if the object was not
found in the cache.
Unfortunately the old exit condition that if a domain name is present
only a single iteration is needed is still present in the new code which
effectively makes requests with fully-qualified named only search the
cache and never call the backends. This patch removes the exit condition
and does a second iteration for fully-qualified names as well if
'cache_first = True' is set.
Resolves: https://github.com/SSSD/sssd/issues/5744
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5745/head:pr5745
git checkout pr5745
2 years, 8 months
[sssd PR#5748][opened] TOOLS: replace system() with execvp()
by alexey-tikhonov
URL: https://github.com/SSSD/sssd/pull/5748
Author: alexey-tikhonov
Title: #5748: TOOLS: replace system() with execvp()
Action: opened
PR body:
"""
to avoid execution of user supplied command
A flaw was found in SSSD, where the sssctl command was vulnerable
to shell command injection via the logs-fetch and cache-expire
subcommands. This flaw allows an attacker to trick the root user
into running a specially crafted sssctl command, such as via sudo,
to gain root access. The highest threat from this vulnerability is
to confidentiality, integrity, as well as system availability.
:fixes: CVE-2021-3621
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5748/head:pr5748
git checkout pr5748
2 years, 8 months
[sssd PR#5749][opened] 1.16: TOOLS: replace system() with execvp()
by alexey-tikhonov
URL: https://github.com/SSSD/sssd/pull/5749
Author: alexey-tikhonov
Title: #5749: 1.16: TOOLS: replace system() with execvp()
Action: opened
PR body:
"""
to avoid execution of user supplied command
A flaw was found in SSSD, where the sssctl command was vulnerable
to shell command injection via the logs-fetch and cache-expire
subcommands. This flaw allows an attacker to trick the root user
into running a specially crafted sssctl command, such as via sudo,
to gain root access. The highest threat from this vulnerability is
to confidentiality, integrity, as well as system availability.
:fixes: CVE-2021-3621
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5749/head:pr5749
git checkout pr5749
2 years, 8 months