URL: https://github.com/SSSD/sssd/pull/908 Author: pbrezina Title: #908: ifp: implement connection-wide access check Action: opened
PR body: """ Currently only a small subset of infopipe methods performed access check. This change makes sure that we do this check global for everything.
Steps to reproduce: 1. Call an infopipe method as a user not-listed in [ifp] allowed_uids 2. Without the patch the access is granted
E.g. ``` $ dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.FindByName string:user-1 ```
Resolves: https://pagure.io/SSSD/sssd/issue/4105 """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/908/head:pr908 git checkout pr908
URL: https://github.com/SSSD/sssd/pull/908 Author: pbrezina Title: #908: ifp: implement connection-wide access check Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/908/head:pr908 git checkout pr908
URL: https://github.com/SSSD/sssd/pull/908 Author: pbrezina Title: #908: ifp: implement connection-wide access check Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/908/head:pr908 git checkout pr908
URL: https://github.com/SSSD/sssd/pull/908 Title: #908: ifp: implement connection-wide access check
mzidek-rh commented: """ I will review this tomorrow or on Friday. """
See the full comment at https://github.com/SSSD/sssd/pull/908#issuecomment-545504674
URL: https://github.com/SSSD/sssd/pull/908 Title: #908: ifp: implement connection-wide access check
Label: +Rejected
URL: https://github.com/SSSD/sssd/pull/908 Title: #908: ifp: implement connection-wide access check
pbrezina commented: """ This is fixed since 2.0. The security impact is low (by default only posix attributes are available) and we could break users applications that relies on the fact that the data is available to everyone therefore we should not fix it in 1.16 where such change is unacceptable. """
See the full comment at https://github.com/SSSD/sssd/pull/908#issuecomment-547362873
URL: https://github.com/SSSD/sssd/pull/908 Author: pbrezina Title: #908: ifp: implement connection-wide access check Action: closed
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/908/head:pr908 git checkout pr908
sssd-devel@lists.fedorahosted.org
-
mzidek-rh -
pbrezina