URL: https://github.com/SSSD/sssd/pull/578 Author: amitkumar50 Title: #578: proxy: proxy_child hardening Action: opened
PR body: """ proxy_child will call chdir("/"), umask(022) and reset the environment with clearenv().
The --domain argument to be sanitized.
Resolves: https://pagure.io/SSSD/sssd/issue/2689 """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/578/head:pr578 git checkout pr578
URL: https://github.com/SSSD/sssd/pull/578 Title: #578: proxy: proxy_child hardening
centos-ci commented: """ Can one of the admins verify this patch? """
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-391241247
URL: https://github.com/SSSD/sssd/pull/578 Title: #578: proxy: proxy_child hardening
centos-ci commented: """ Can one of the admins verify this patch? """
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-391241246
URL: https://github.com/SSSD/sssd/pull/578 Title: #578: proxy: proxy_child hardening
amitkumar50 commented: """ sanitizing --domain argument is to be worked upon. your thoughts on this. """
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-391241786
URL: https://github.com/SSSD/sssd/pull/578 Title: #578: proxy: proxy_child hardening
jhrozek commented: """ ok to test """
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-391381622
URL: https://github.com/SSSD/sssd/pull/578 Title: #578: proxy: proxy_child hardening
jhrozek commented: """ @mzidek-rh do we already have some code that checks the name of the domain is valid? The man page says that only alphanumerical characters, dashes and underscores are allowed, but I can't find any code that would enforce this. """
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-391382082
URL: https://github.com/SSSD/sssd/pull/578 Title: #578: proxy: proxy_child hardening
mzidek-rh commented: """ @jhrozek Hi, sorry missed the question before (thanks @fidencio for the notice). AFAIK we do not sanitize the domain name nor do we check if it is a valid domain name.
Slightly related: We have some sssctl config-check rules for the domain section name (but I think they were problematic in some way, I think the rules are too benevolent and allow also invalid domain names because we did not wanted to be too restricted in domain names, but I would have to check the config-check code again if this was the case) """
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-404465219
URL: https://github.com/SSSD/sssd/pull/578 Title: #578: proxy: proxy_child hardening
alexey-tikhonov commented: """ Hi @amitkumar50,
I am not sure if you are still interested in this PR.
But if so: 1) please see comments I have left inline 2) don't you mind to update commit message please? It would be nice to have there explanation why those changes are needed. Also I do not understand "The --domain argument to be sanitized." part -- patch doesn't perform any arguments check... """
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-541049225
URL: https://github.com/SSSD/sssd/pull/578 Title: #578: proxy: proxy_child hardening
alexey-tikhonov commented: """ Hi @amitkumar50,
I am not sure if you are still interested in this PR.
But if so: 1) please see comments I have left inline 2) don't you mind to update commit message please? It would be nice to have there explanation why those changes are needed. Also I do not understand "The --domain argument to be sanitized." part -- patch doesn't perform any arguments check... 3) rebase on the latest master please """
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-541049225
URL: https://github.com/SSSD/sssd/pull/578 Title: #578: proxy: proxy_child hardening
Label: +Changes requested
URL: https://github.com/SSSD/sssd/pull/578 Title: #578: proxy: proxy_child hardening
centos-ci commented: """ Can one of the admins verify this patch? """
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-391241247
URL: https://github.com/SSSD/sssd/pull/578 Title: #578: proxy: proxy_child hardening
Label: +superseded
URL: https://github.com/SSSD/sssd/pull/578 Title: #578: proxy: proxy_child hardening
Label: -Changes requested
URL: https://github.com/SSSD/sssd/pull/578 Title: #578: proxy: proxy_child hardening
alexey-tikhonov commented: """ Superseded by https://github.com/SSSD/sssd/pull/5268 """
See the full comment at https://github.com/SSSD/sssd/pull/578#issuecomment-671501355
URL: https://github.com/SSSD/sssd/pull/578 Author: amitkumar50 Title: #578: proxy: proxy_child hardening Action: closed
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/578/head:pr578 git checkout pr578
sssd-devel@lists.fedorahosted.org
-
alexey-tikhonov -
amitkumar50
-
centos-ci
-
jhrozek
-
mzidek-rh