Resolves: rhbz#2011224 - Rebase SSSD for RHEL 9.0-GA
Resolves: rhbz#1966201 - sssd: incorrect checks on length values during packet decoding in unpack_authtok() Resolves: rhbz#977803 - incorrect checks of `strto*()` string to number convertion functions Resolves: rhbz#1992432 - Add client certificate validation D-Bus API Resolves: rhbz#1992973 - Lookup with fully-qualified name does not work with 'cache_first = True' Resolves: rhbz#1996151 - Add support for CKM_RSA_PKCS in smart card authentication. Resolves: rhbz#1998459 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest) Resolves: rhbz#2000476 - disabled root ad domain causes subdomains to be marked offline Resolves: rhbz#2014249 - Consistency in defaults between OpenSSH and SSSD Resolves: rhbz#2029419 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
This commit is contained in:
Alexey Tikhonov
parent
4fc9503558
commit
5309d21cac
|
|
@ -93,3 +93,4 @@ sssd-1.2.91.tar.gz
|
|||
/sssd-2.4.2.tar.gz
|
||||
/sssd-2.5.1.tar.gz
|
||||
/sssd-2.5.2.tar.gz
|
||||
/sssd-2.6.1.tar.gz
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,284 +0,0 @@
|
|||
From 7ab83f97e1cbefb78ece17232185bdd2985f0bbe Mon Sep 17 00:00:00 2001
|
||||
From: Alexey Tikhonov <atikhono@redhat.com>
|
||||
Date: Fri, 18 Jun 2021 13:17:19 +0200
|
||||
Subject: [PATCH] TOOLS: replace system() with execvp() to avoid execution of
|
||||
user supplied command
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
:relnote: A flaw was found in SSSD, where the sssctl command was
|
||||
vulnerable to shell command injection via the logs-fetch and
|
||||
cache-expire subcommands. This flaw allows an attacker to trick
|
||||
the root user into running a specially crafted sssctl command,
|
||||
such as via sudo, to gain root access. The highest threat from this
|
||||
vulnerability is to confidentiality, integrity, as well as system
|
||||
availability.
|
||||
This patch fixes a flaw by replacing system() with execvp().
|
||||
|
||||
:fixes: CVE-2021-3621
|
||||
|
||||
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
|
||||
---
|
||||
src/tools/sssctl/sssctl.c | 39 ++++++++++++++++-------
|
||||
src/tools/sssctl/sssctl.h | 2 +-
|
||||
src/tools/sssctl/sssctl_data.c | 57 +++++++++++-----------------------
|
||||
src/tools/sssctl/sssctl_logs.c | 32 +++++++++++++++----
|
||||
4 files changed, 73 insertions(+), 57 deletions(-)
|
||||
|
||||
diff --git a/src/tools/sssctl/sssctl.c b/src/tools/sssctl/sssctl.c
|
||||
index 2997dbf96..8adaf3091 100644
|
||||
--- a/src/tools/sssctl/sssctl.c
|
||||
+++ b/src/tools/sssctl/sssctl.c
|
||||
@@ -97,22 +97,36 @@ sssctl_prompt(const char *message,
|
||||
return SSSCTL_PROMPT_ERROR;
|
||||
}
|
||||
|
||||
-errno_t sssctl_run_command(const char *command)
|
||||
+errno_t sssctl_run_command(const char *const argv[])
|
||||
{
|
||||
int ret;
|
||||
+ int wstatus;
|
||||
|
||||
- DEBUG(SSSDBG_TRACE_FUNC, "Running %s\n", command);
|
||||
+ DEBUG(SSSDBG_TRACE_FUNC, "Running '%s'\n", argv[0]);
|
||||
|
||||
- ret = system(command);
|
||||
+ ret = fork();
|
||||
if (ret == -1) {
|
||||
- DEBUG(SSSDBG_CRIT_FAILURE, "Unable to execute %s\n", command);
|
||||
ERROR("Error while executing external command\n");
|
||||
return EFAULT;
|
||||
- } else if (WEXITSTATUS(ret) != 0) {
|
||||
- DEBUG(SSSDBG_CRIT_FAILURE, "Command %s failed with [%d]\n",
|
||||
- command, WEXITSTATUS(ret));
|
||||
+ }
|
||||
+
|
||||
+ if (ret == 0) {
|
||||
+ /* cast is safe - see
|
||||
+ https://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html
|
||||
+ "The statement about argv[] and envp[] being constants ... "
|
||||
+ */
|
||||
+ execvp(argv[0], discard_const_p(char * const, argv));
|
||||
ERROR("Error while executing external command\n");
|
||||
- return EIO;
|
||||
+ _exit(1);
|
||||
+ } else {
|
||||
+ if (waitpid(ret, &wstatus, 0) == -1) {
|
||||
+ ERROR("Error while executing external command '%s'\n", argv[0]);
|
||||
+ return EFAULT;
|
||||
+ } else if (WEXITSTATUS(wstatus) != 0) {
|
||||
+ ERROR("Command '%s' failed with [%d]\n",
|
||||
+ argv[0], WEXITSTATUS(wstatus));
|
||||
+ return EIO;
|
||||
+ }
|
||||
}
|
||||
|
||||
return EOK;
|
||||
@@ -132,11 +146,14 @@ static errno_t sssctl_manage_service(enum sssctl_svc_action action)
|
||||
#elif defined(HAVE_SERVICE)
|
||||
switch (action) {
|
||||
case SSSCTL_SVC_START:
|
||||
- return sssctl_run_command(SERVICE_PATH" sssd start");
|
||||
+ return sssctl_run_command(
|
||||
+ (const char *[]){SERVICE_PATH, "sssd", "start", NULL});
|
||||
case SSSCTL_SVC_STOP:
|
||||
- return sssctl_run_command(SERVICE_PATH" sssd stop");
|
||||
+ return sssctl_run_command(
|
||||
+ (const char *[]){SERVICE_PATH, "sssd", "stop", NULL});
|
||||
case SSSCTL_SVC_RESTART:
|
||||
- return sssctl_run_command(SERVICE_PATH" sssd restart");
|
||||
+ return sssctl_run_command(
|
||||
+ (const char *[]){SERVICE_PATH, "sssd", "restart", NULL});
|
||||
}
|
||||
#endif
|
||||
|
||||
diff --git a/src/tools/sssctl/sssctl.h b/src/tools/sssctl/sssctl.h
|
||||
index 0115b2457..599ef6519 100644
|
||||
--- a/src/tools/sssctl/sssctl.h
|
||||
+++ b/src/tools/sssctl/sssctl.h
|
||||
@@ -47,7 +47,7 @@ enum sssctl_prompt_result
|
||||
sssctl_prompt(const char *message,
|
||||
enum sssctl_prompt_result defval);
|
||||
|
||||
-errno_t sssctl_run_command(const char *command);
|
||||
+errno_t sssctl_run_command(const char *const argv[]); /* argv[0] - command */
|
||||
bool sssctl_start_sssd(bool force);
|
||||
bool sssctl_stop_sssd(bool force);
|
||||
bool sssctl_restart_sssd(bool force);
|
||||
diff --git a/src/tools/sssctl/sssctl_data.c b/src/tools/sssctl/sssctl_data.c
|
||||
index 8d79b977f..bf2291341 100644
|
||||
--- a/src/tools/sssctl/sssctl_data.c
|
||||
+++ b/src/tools/sssctl/sssctl_data.c
|
||||
@@ -105,15 +105,15 @@ static errno_t sssctl_backup(bool force)
|
||||
}
|
||||
}
|
||||
|
||||
- ret = sssctl_run_command("sss_override user-export "
|
||||
- SSS_BACKUP_USER_OVERRIDES);
|
||||
+ ret = sssctl_run_command((const char *[]){"sss_override", "user-export",
|
||||
+ SSS_BACKUP_USER_OVERRIDES, NULL});
|
||||
if (ret != EOK) {
|
||||
ERROR("Unable to export user overrides\n");
|
||||
return ret;
|
||||
}
|
||||
|
||||
- ret = sssctl_run_command("sss_override group-export "
|
||||
- SSS_BACKUP_GROUP_OVERRIDES);
|
||||
+ ret = sssctl_run_command((const char *[]){"sss_override", "group-export",
|
||||
+ SSS_BACKUP_GROUP_OVERRIDES, NULL});
|
||||
if (ret != EOK) {
|
||||
ERROR("Unable to export group overrides\n");
|
||||
return ret;
|
||||
@@ -158,8 +158,8 @@ static errno_t sssctl_restore(bool force_start, bool force_restart)
|
||||
}
|
||||
|
||||
if (sssctl_backup_file_exists(SSS_BACKUP_USER_OVERRIDES)) {
|
||||
- ret = sssctl_run_command("sss_override user-import "
|
||||
- SSS_BACKUP_USER_OVERRIDES);
|
||||
+ ret = sssctl_run_command((const char *[]){"sss_override", "user-import",
|
||||
+ SSS_BACKUP_USER_OVERRIDES, NULL});
|
||||
if (ret != EOK) {
|
||||
ERROR("Unable to import user overrides\n");
|
||||
return ret;
|
||||
@@ -167,8 +167,8 @@ static errno_t sssctl_restore(bool force_start, bool force_restart)
|
||||
}
|
||||
|
||||
if (sssctl_backup_file_exists(SSS_BACKUP_USER_OVERRIDES)) {
|
||||
- ret = sssctl_run_command("sss_override group-import "
|
||||
- SSS_BACKUP_GROUP_OVERRIDES);
|
||||
+ ret = sssctl_run_command((const char *[]){"sss_override", "group-import",
|
||||
+ SSS_BACKUP_GROUP_OVERRIDES, NULL});
|
||||
if (ret != EOK) {
|
||||
ERROR("Unable to import group overrides\n");
|
||||
return ret;
|
||||
@@ -296,40 +296,19 @@ errno_t sssctl_cache_expire(struct sss_cmdline *cmdline,
|
||||
void *pvt)
|
||||
{
|
||||
errno_t ret;
|
||||
- char *cmd_args = NULL;
|
||||
- const char *cachecmd = SSS_CACHE;
|
||||
- char *cmd = NULL;
|
||||
- int i;
|
||||
-
|
||||
- if (cmdline->argc == 0) {
|
||||
- ret = sssctl_run_command(cachecmd);
|
||||
- goto done;
|
||||
- }
|
||||
|
||||
- cmd_args = talloc_strdup(tool_ctx, "");
|
||||
- if (cmd_args == NULL) {
|
||||
- ret = ENOMEM;
|
||||
- goto done;
|
||||
+ const char **args = talloc_array_size(tool_ctx,
|
||||
+ sizeof(char *),
|
||||
+ cmdline->argc + 2);
|
||||
+ if (!args) {
|
||||
+ return ENOMEM;
|
||||
}
|
||||
+ memcpy(&args[1], cmdline->argv, sizeof(char *) * cmdline->argc);
|
||||
+ args[0] = SSS_CACHE;
|
||||
+ args[cmdline->argc + 1] = NULL;
|
||||
|
||||
- for (i = 0; i < cmdline->argc; i++) {
|
||||
- cmd_args = talloc_strdup_append(cmd_args, cmdline->argv[i]);
|
||||
- if (i != cmdline->argc - 1) {
|
||||
- cmd_args = talloc_strdup_append(cmd_args, " ");
|
||||
- }
|
||||
- }
|
||||
-
|
||||
- cmd = talloc_asprintf(tool_ctx, "%s %s", cachecmd, cmd_args);
|
||||
- if (cmd == NULL) {
|
||||
- ret = ENOMEM;
|
||||
- goto done;
|
||||
- }
|
||||
-
|
||||
- ret = sssctl_run_command(cmd);
|
||||
-
|
||||
-done:
|
||||
- talloc_free(cmd_args);
|
||||
- talloc_free(cmd);
|
||||
+ ret = sssctl_run_command(args);
|
||||
|
||||
+ talloc_free(args);
|
||||
return ret;
|
||||
}
|
||||
diff --git a/src/tools/sssctl/sssctl_logs.c b/src/tools/sssctl/sssctl_logs.c
|
||||
index 9ff2be05b..ebb2c4571 100644
|
||||
--- a/src/tools/sssctl/sssctl_logs.c
|
||||
+++ b/src/tools/sssctl/sssctl_logs.c
|
||||
@@ -31,6 +31,7 @@
|
||||
#include <ldb.h>
|
||||
#include <popt.h>
|
||||
#include <stdio.h>
|
||||
+#include <glob.h>
|
||||
|
||||
#include "util/util.h"
|
||||
#include "tools/common/sss_process.h"
|
||||
@@ -230,6 +231,7 @@ errno_t sssctl_logs_remove(struct sss_cmdline *cmdline,
|
||||
{
|
||||
struct sssctl_logs_opts opts = {0};
|
||||
errno_t ret;
|
||||
+ glob_t globbuf;
|
||||
|
||||
/* Parse command line. */
|
||||
struct poptOption options[] = {
|
||||
@@ -253,8 +255,20 @@ errno_t sssctl_logs_remove(struct sss_cmdline *cmdline,
|
||||
|
||||
sss_signal(SIGHUP);
|
||||
} else {
|
||||
+ globbuf.gl_offs = 4;
|
||||
+ ret = glob(LOG_PATH"/*.log", GLOB_ERR|GLOB_DOOFFS, NULL, &globbuf);
|
||||
+ if (ret != 0) {
|
||||
+ DEBUG(SSSDBG_CRIT_FAILURE, "Unable to expand log files list\n");
|
||||
+ return ret;
|
||||
+ }
|
||||
+ globbuf.gl_pathv[0] = discard_const_p(char, "truncate");
|
||||
+ globbuf.gl_pathv[1] = discard_const_p(char, "--no-create");
|
||||
+ globbuf.gl_pathv[2] = discard_const_p(char, "--size");
|
||||
+ globbuf.gl_pathv[3] = discard_const_p(char, "0");
|
||||
+
|
||||
PRINT("Truncating log files...\n");
|
||||
- ret = sssctl_run_command("truncate --no-create --size 0 " LOG_FILES);
|
||||
+ ret = sssctl_run_command((const char * const*)globbuf.gl_pathv);
|
||||
+ globfree(&globbuf);
|
||||
if (ret != EOK) {
|
||||
ERROR("Unable to truncate log files\n");
|
||||
return ret;
|
||||
@@ -269,8 +283,8 @@ errno_t sssctl_logs_fetch(struct sss_cmdline *cmdline,
|
||||
void *pvt)
|
||||
{
|
||||
const char *file;
|
||||
- const char *cmd;
|
||||
errno_t ret;
|
||||
+ glob_t globbuf;
|
||||
|
||||
/* Parse command line. */
|
||||
ret = sss_tool_popt_ex(cmdline, NULL, SSS_TOOL_OPT_OPTIONAL, NULL, NULL,
|
||||
@@ -280,13 +294,19 @@ errno_t sssctl_logs_fetch(struct sss_cmdline *cmdline,
|
||||
return ret;
|
||||
}
|
||||
|
||||
- cmd = talloc_asprintf(tool_ctx, "tar -czf %s %s", file, LOG_FILES);
|
||||
- if (cmd == NULL) {
|
||||
- ERROR("Out of memory!");
|
||||
+ globbuf.gl_offs = 3;
|
||||
+ ret = glob(LOG_PATH"/*.log", GLOB_ERR|GLOB_DOOFFS, NULL, &globbuf);
|
||||
+ if (ret != 0) {
|
||||
+ DEBUG(SSSDBG_CRIT_FAILURE, "Unable to expand log files list\n");
|
||||
+ return ret;
|
||||
}
|
||||
+ globbuf.gl_pathv[0] = discard_const_p(char, "tar");
|
||||
+ globbuf.gl_pathv[1] = discard_const_p(char, "-czf");
|
||||
+ globbuf.gl_pathv[2] = discard_const_p(char, file);
|
||||
|
||||
PRINT("Archiving log files into %s...\n", file);
|
||||
- ret = sssctl_run_command(cmd);
|
||||
+ ret = sssctl_run_command((const char * const*)globbuf.gl_pathv);
|
||||
+ globfree(&globbuf);
|
||||
if (ret != EOK) {
|
||||
ERROR("Unable to archive log files\n");
|
||||
return ret;
|
||||
--
|
||||
2.26.3
|
||||
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
From 365cd676c9fbeed8246c4e0c017dcac0c72a2526 Mon Sep 17 00:00:00 2001
|
||||
From: Alexey Tikhonov <atikhono@redhat.com>
|
||||
Date: Tue, 10 Aug 2021 18:21:56 +0200
|
||||
Subject: [PATCH] NSS: don't treat absent 'CLEAR_MC_FLAG' as an error (This is
|
||||
expected in case of SIGHUP sent for log rotation.)
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
|
||||
---
|
||||
src/responder/nss/nsssrv.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/responder/nss/nsssrv.c b/src/responder/nss/nsssrv.c
|
||||
index 9c5907d86..526d97b08 100644
|
||||
--- a/src/responder/nss/nsssrv.c
|
||||
+++ b/src/responder/nss/nsssrv.c
|
||||
@@ -63,7 +63,7 @@ nss_clear_memcache(TALLOC_CTX *mem_ctx,
|
||||
if (ret == ENOENT) {
|
||||
DEBUG(SSSDBG_TRACE_FUNC,
|
||||
"CLEAR_MC_FLAG not found. Nothing to do.\n");
|
||||
- return ret;
|
||||
+ return EOK; /* Most probably log rotation SIGHUP to monitor */
|
||||
} else {
|
||||
DEBUG(SSSDBG_CRIT_FAILURE,
|
||||
"Failed to check existence of "CLEAR_MC_FLAG": %s.\n",
|
||||
--
|
||||
2.26.3
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
2
sources
2
sources
|
|
@ -1 +1 @@
|
|||
SHA512 (sssd-2.5.2.tar.gz) = a9bac7b2cc23022dce3bcda314c9c26a0a0914c448f6d5a51c5ba18670f04c1fd1a94cb20173235b6285df1dcc9251cb6b3f3e71a220037b4eb66668e6f33c48
|
||||
SHA512 (sssd-2.6.1.tar.gz) = 5b35a66c37593de738f52d5ad2f7860067af4061bd11b2f5c4b701177ef1bc3091d3c3df573d751339e9c9bb07476988b0b030b91b6a33adcb663df16be80d81
|
||||
|
|
|
|||
45
sssd.spec
45
sssd.spec
|
|
@ -26,18 +26,15 @@
|
|||
%global samba_package_version %(rpm -q samba-devel --queryformat %{version}-%{release})
|
||||
|
||||
Name: sssd
|
||||
Version: 2.5.2
|
||||
Release: 5%{?dist}
|
||||
Version: 2.6.1
|
||||
Release: 1%{?dist}
|
||||
Summary: System Security Services Daemon
|
||||
License: GPLv3+
|
||||
URL: https://github.com/SSSD/sssd/
|
||||
Source0: https://github.com/SSSD/sssd/releases/download/2.5.2/sssd-2.5.2.tar.gz
|
||||
Source0: https://github.com/SSSD/sssd/releases/download/%{version}/sssd-%{version}.tar.gz
|
||||
|
||||
### Patches ###
|
||||
Patch0001: 0001-Basics-of-subid-ranges-support-for-IPA-provider.patch
|
||||
Patch0002: 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch
|
||||
Patch0003: 0003-NSS-don-t-treat-absent-CLEAR_MC_FLAG-as-an-error-Thi.patch
|
||||
Patch0004: 0004-po-update-translations.patch
|
||||
#Patch0001:
|
||||
|
||||
### Dependencies ###
|
||||
|
||||
|
|
@ -46,8 +43,8 @@ Requires: sssd-common = %{version}-%{release}
|
|||
Requires: sssd-ipa = %{version}-%{release}
|
||||
Requires: sssd-krb5 = %{version}-%{release}
|
||||
Requires: sssd-ldap = %{version}-%{release}
|
||||
Recommends: sssd-proxy = %{version}-%{release}
|
||||
Recommends: logrotate
|
||||
Suggests: sssd-proxy = %{version}-%{release}
|
||||
Suggests: logrotate
|
||||
Suggests: python3-sssdconfig = %{version}-%{release}
|
||||
Suggests: sssd-dbus = %{version}-%{release}
|
||||
|
||||
|
|
@ -77,10 +74,8 @@ BuildRequires: findutils
|
|||
BuildRequires: gcc
|
||||
BuildRequires: gdm-pam-extensions-devel
|
||||
BuildRequires: gettext-devel
|
||||
BuildRequires: glib2-devel
|
||||
# required for p11_child smartcard tests
|
||||
BuildRequires: gnutls-utils
|
||||
BuildRequires: jansson-devel
|
||||
BuildRequires: keyutils-libs-devel
|
||||
BuildRequires: krb5-devel
|
||||
BuildRequires: libcmocka-devel >= 1.0.0
|
||||
|
|
@ -109,7 +104,7 @@ BuildRequires: openssl-devel
|
|||
BuildRequires: p11-kit-devel
|
||||
BuildRequires: pam_wrapper
|
||||
BuildRequires: pam-devel
|
||||
BuildRequires: pcre-devel
|
||||
BuildRequires: pcre2-devel
|
||||
BuildRequires: pkgconfig
|
||||
BuildRequires: popt-devel
|
||||
BuildRequires: python3-devel
|
||||
|
|
@ -123,6 +118,7 @@ BuildRequires: systemd-devel
|
|||
BuildRequires: systemtap-sdt-devel
|
||||
BuildRequires: uid_wrapper
|
||||
BuildRequires: po4a
|
||||
BuildRequires: libunistring-devel
|
||||
BuildRequires: shadow-utils-subid-devel
|
||||
|
||||
%description
|
||||
|
|
@ -142,9 +138,9 @@ License: GPLv3+
|
|||
# due to ABI changes in 1.1.30/1.2.0
|
||||
Requires: libldb >= %{ldb_version}
|
||||
Requires: sssd-client%{?_isa} = %{version}-%{release}
|
||||
Recommends: libsss_sudo = %{version}-%{release}
|
||||
Recommends: libsss_autofs%{?_isa} = %{version}-%{release}
|
||||
Recommends: sssd-nfs-idmap = %{version}-%{release}
|
||||
Requires: (libsss_sudo = %{version}-%{release} if sudo)
|
||||
Requires: (libsss_autofs%{?_isa} = %{version}-%{release} if autofs)
|
||||
Requires: (sssd-nfs-idmap = %{version}-%{release} if libnfsidmap)
|
||||
Requires: libsss_idmap = %{version}-%{release}
|
||||
Requires: libsss_certmap = %{version}-%{release}
|
||||
%if 0%{?rhel}
|
||||
|
|
@ -198,7 +194,8 @@ Requires: sssd-common = %{version}-%{release}
|
|||
Requires: python3-sss = %{version}-%{release}
|
||||
Requires: python3-sssdconfig = %{version}-%{release}
|
||||
Requires: libsss_certmap = %{version}-%{release}
|
||||
Recommends: sssd-dbus
|
||||
Requires: python3-systemd
|
||||
Suggests: sssd-dbus
|
||||
|
||||
%description tools
|
||||
Provides userspace tools for manipulating users, groups, and nested groups in
|
||||
|
|
@ -523,6 +520,8 @@ unset CK_TIMEOUT_MULTIPLIER
|
|||
|
||||
%install
|
||||
|
||||
%py3_shebang_fix src/tools/analyzer/sss_analyze.py
|
||||
|
||||
%make_install
|
||||
|
||||
# Prepare language files
|
||||
|
|
@ -844,6 +843,7 @@ done
|
|||
%{_sbindir}/sss_debuglevel
|
||||
%{_sbindir}/sss_seed
|
||||
%{_sbindir}/sssctl
|
||||
%{python3_sitelib}/sssd/
|
||||
%{_mandir}/man8/sss_obfuscate.8*
|
||||
%{_mandir}/man8/sss_override.8*
|
||||
%{_mandir}/man8/sss_debuglevel.8*
|
||||
|
|
@ -929,7 +929,6 @@ done
|
|||
%{_unitdir}/sssd-kcm.socket
|
||||
%{_unitdir}/sssd-kcm.service
|
||||
%{_mandir}/man8/sssd-kcm.8*
|
||||
%{_libdir}/%{name}/libsss_secrets.so
|
||||
|
||||
%if 0%{?rhel}
|
||||
%pre common
|
||||
|
|
@ -1020,6 +1019,18 @@ fi
|
|||
%systemd_postun_with_restart sssd.service
|
||||
|
||||
%changelog
|
||||
* Mon Dec 06 2021 Alexey Tikhonov <atikhono@redhat.com> - 2.6.1-1
|
||||
- Resolves: rhbz#2011224 - Rebase SSSD for RHEL 9.0-GA
|
||||
- Resolves: rhbz#1966201 - sssd: incorrect checks on length values during packet decoding in unpack_authtok()
|
||||
- Resolves: rhbz#977803 - incorrect checks of `strto*()` string to number convertion functions
|
||||
- Resolves: rhbz#1992432 - Add client certificate validation D-Bus API
|
||||
- Resolves: rhbz#1992973 - Lookup with fully-qualified name does not work with 'cache_first = True'
|
||||
- Resolves: rhbz#1996151 - Add support for CKM_RSA_PKCS in smart card authentication.
|
||||
- Resolves: rhbz#1998459 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
|
||||
- Resolves: rhbz#2000476 - disabled root ad domain causes subdomains to be marked offline
|
||||
- Resolves: rhbz#2014249 - Consistency in defaults between OpenSSH and SSSD
|
||||
- Resolves: rhbz#2029419 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
|
||||
|
||||
* Mon Aug 16 2021 Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-5
|
||||
- Resolves: rhbz#1909755 - Suppress log message "[sssd] [service_signal_done] (0x0010): Unable to signal service [2]: No such file or directory" during logrote
|
||||
- Resolves: rhbz#1962123 - [sssd] RHEL 9.0 Beta Tier 0 Localization
|
||||
|
|
|
|||
Loading…
Reference in New Issue