URL: https://github.com/SSSD/sssd/pull/5268 Author: alexey-tikhonov Title: #5268: proxy_child hardening Action: opened
PR body: """ Fixes #3730 """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5268/head:pr5268 git checkout pr5268
URL: https://github.com/SSSD/sssd/pull/5268 Author: alexey-tikhonov Title: #5268: proxy_child hardening Action: edited
Changed field: body Original value: """ Fixes #3730 """
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: proxy_child hardening
Label: +Changes requested
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: proxy_child hardening
alexey-tikhonov commented: """ Hi @elkoniu,
thank you for the review. I replied all the comments inline.
I will keep "changes requested" label to: - check the reason of the fail on rawhide - investigate if DNS impose more strict reqs on the domain name than what is currently stated in the man page (thank @sumit-bose for the hint) """
See the full comment at https://github.com/SSSD/sssd/pull/5268#issuecomment-671818004
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: proxy_child hardening
alexey-tikhonov commented: """
I will keep "changes requested" label to: * check the reason of the fail on rawhide
Well, this has nothing to do with this PR as the same fails are seen in totally different PR https://github.com/SSSD/sssd/pull/5267
But that's weird. Seems something changed in rawhide. """
See the full comment at https://github.com/SSSD/sssd/pull/5268#issuecomment-671898465
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: proxy_child hardening
alexey-tikhonov commented: """
I will keep "changes requested" label to:
- check the reason of the fail on rawhide
Well, this has nothing to do with this PR as the same fails are seen in totally different PR #5267
But that's weird. Seems something changed in rawhide.
I reproduced those locally on rawhide with master branch.
"""
See the full comment at https://github.com/SSSD/sssd/pull/5268#issuecomment-672237529
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: proxy_child hardening
elkoniu commented: """ I intentionally left flags unchanged as I am not sure if you are done with investigating this "DNS more strict regs". If yes ping me on IRC and I will change it to Accepted. """
See the full comment at https://github.com/SSSD/sssd/pull/5268#issuecomment-672280312
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: proxy_child hardening
alexey-tikhonov commented: """ I keep "changes requested" intentionally.
@sumit-bose , do we need to update `sssd/src/config/cfg_rules.ini` in this PR as well? """
See the full comment at https://github.com/SSSD/sssd/pull/5268#issuecomment-672714262
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: proxy_child hardening
sumit-bose commented: """
I keep "changes requested" intentionally.
@sumit-bose , do we need to update `sssd/src/config/cfg_rules.ini` in this PR as well?
Hi,
yes, that sounds like a good idea. Ideal would be a single regular expression which would be used in both places, but currently I can only think of using replacements at configure time to achieve this which would make handling and reading `cfg_rules.ini` more difficult. So treating both separate would be ok imo.
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/5268#issuecomment-672774896
URL: https://github.com/SSSD/sssd/pull/5268 Author: alexey-tikhonov Title: #5268: (WiP) proxy_child hardening Action: edited
Changed field: title Original value: """ proxy_child hardening """
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
Label: +Deferred
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
alexey-tikhonov commented: """
I will keep "changes requested" label to:
...
* investigate if DNS impose more strict reqs on the domain name than what is currently stated in the man page (thank @sumit-bose for the hint)
This is tricky. https://tools.ietf.org/html/rfc1034#section-3.5 "Preferred name syntax" https://tools.ietf.org/html/rfc1123#section-2.1 "Host Names and Numbers" https://tools.ietf.org/html/rfc2181#section-11 "Name syntax"
If I read those ^^ docs correctly, conclusion is very much like: ``` The characters allowed in labels are a subset of the ASCII character set, consisting of characters a through z, A through Z, digits 0 through 9, and hyphen. This rule is known as the LDH rule (letters, digits, hyphen). Domain names are interpreted in case-independent manner. Labels may not start or end with a hyphen. ```
This means 2 additional restrictions to the current statement in SSSD man page: 1) no "underscores" 2) labels may not start or end with a hyphen (and also `dash` in the man page should be replaced with `hyphen`)
I think (2) is fine, but I'm somewhat worried with (1) - this probably might break existing configs.
@sumit-bose , what would you think? """
See the full comment at https://github.com/SSSD/sssd/pull/5268#issuecomment-764848735
URL: https://github.com/SSSD/sssd/pull/5268 Author: alexey-tikhonov Title: #5268: (WiP) proxy_child hardening Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5268/head:pr5268 git checkout pr5268
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
Label: -Changes requested
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
Label: +Waiting for review
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
Label: -Deferred
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
alexey-tikhonov commented: """ I discussed this with Sumit and it seems we actually can't put any restriction on names in `domains` option of `sssd.conf` (because it is not necessary a hostname, but can be any domain, and DNS itself doesn't place much restrictions on names).
So this PR only addresses issue as it was reported originally. """
See the full comment at https://github.com/SSSD/sssd/pull/5268#issuecomment-765473091
URL: https://github.com/SSSD/sssd/pull/5268 Author: alexey-tikhonov Title: #5268: (WiP) proxy_child hardening Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5268/head:pr5268 git checkout pr5268
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
Label: -Waiting for review
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
Label: +Changes requested
URL: https://github.com/SSSD/sssd/pull/5268 Author: alexey-tikhonov Title: #5268: (WiP) proxy_child hardening Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5268/head:pr5268 git checkout pr5268
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
alexey-tikhonov commented: """ Hi @sumit-bose,
I hope I addressed your comment. Please take a look. """
See the full comment at https://github.com/SSSD/sssd/pull/5268#issuecomment-767573132
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
Label: +Waiting for review
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
Label: -Changes requested
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
sumit-bose commented: """ Hi,
thanks for the update, ACK.
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/5268#issuecomment-767723904
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
Label: +Accepted
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
Label: -Waiting for review
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
Label: +Ready to push
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
pbrezina commented: """ Pushed PR: https://github.com/SSSD/sssd/pull/5268
* `master` * b6fc7c0e9a9856914d20578f64e0a2e8b482f90a - Sanitize --domain option to allow safe usage as a part of log file name * 3986deade966353bc6ce0030156b3c3712724452 - PROXY: child process security hardening
"""
See the full comment at https://github.com/SSSD/sssd/pull/5268#issuecomment-769684366
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
Label: +Pushed
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
Label: -Accepted
URL: https://github.com/SSSD/sssd/pull/5268 Title: #5268: (WiP) proxy_child hardening
Label: -Ready to push
URL: https://github.com/SSSD/sssd/pull/5268 Author: alexey-tikhonov Title: #5268: (WiP) proxy_child hardening Action: closed
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5268/head:pr5268 git checkout pr5268
sssd-devel@lists.fedorahosted.org