sssd 2.10.0 (part 2)

sssd 2.10.0
Filelist changes needed for upcoming libldb.pc from samba-4.21
2024-10-16 17:05:53 +02:00 · 2024-10-15 15:33:24 +02:00 · 2024-10-01 12:24:38 +02:00 · 2024-09-25 22:30:26 +02:00 · 2024-09-25 22:30:16 +02:00 · 2024-07-17 11:57:47 +02:00
8 changed files with 254 additions and 90 deletions
--- a/0001-sssd-always-print-path-when-config-object-is-rejecte.patch
+++ b/0001-sssd-always-print-path-when-config-object-is-rejecte.patch
@@ -0,0 +1,88 @@
+From 338638cd5f374e0699d7b7495a5fa8f25511fa55 Mon Sep 17 00:00:00 2001
+From: Jan Engelhardt <jengelh@inai.de>
+Date: Wed, 16 Oct 2024 09:55:50 +0200
+Subject: [PATCH] sssd: always print path when config object is rejected
+References: https://github.com/SSSD/sssd/pull/7649
+
+Observed:
+
+```
+Oct 16 09:44:04 a4 sssd[28717]: [sssd] [sss_ini_read_sssd_conf] (0x0020): Permission check on config file failed.
+Oct 16 09:44:04 a4 sssd[28717]: Can't read config: 'File ownership and permissions check failed'
+Oct 16 09:44:04 a4 sssd[28717]: Failed to read configuration: 'File ownership and permissions check failed'
+```
+
+Expected:
+
+_Well yes, but **which one**_!?
+---
+ src/monitor/monitor.c |  4 ++--
+ src/util/sss_ini.c    | 14 ++++++++------
+ 2 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
+index e17b0e416..f67e4446f 100644
+--- a/src/monitor/monitor.c
+++ b/src/monitor/monitor.c
+@@ -1931,9 +1931,9 @@ int main(int argc, const char *argv[])
+     ret = confdb_read_ini(tmp_ctx, config_file, CONFDB_DEFAULT_CONFIG_DIR, false,
+                           &config);
+     if (ret != EOK) {
+-        ERROR("Can't read config: '%s'\n", sss_strerror(ret));
+        ERROR("Cannot read config %s: '%s'\n", config_file, sss_strerror(ret));
+         sss_log(SSS_LOG_ALERT,
+-                "Failed to read configuration: '%s'", sss_strerror(ret));
+                "Failed to read configuration %s: '%s'", config_file, sss_strerror(ret));
+         ret = 3;
+         goto out;
+     }
+diff --git a/src/util/sss_ini.c b/src/util/sss_ini.c
+index 7f9824d88..2a611eb8c 100644
+--- a/src/util/sss_ini.c
+++ b/src/util/sss_ini.c
+@@ -888,7 +888,7 @@ int sss_ini_read_sssd_conf(struct sss_ini *self,
+     ret = sss_ini_open(self, config_file, "[sssd]\n");
+     if (ret != EOK) {
+         DEBUG(SSSDBG_CRIT_FAILURE,
+-              "The sss_ini_open failed %s: %d\n",
+              "sss_ini_open on %s failed: %d\n",
+               config_file,
+               ret);
+         return ERR_INI_OPEN_FAILED;
+@@ -898,26 +898,28 @@ int sss_ini_read_sssd_conf(struct sss_ini *self,
+         ret = sss_ini_access_check(self);
+         if (ret != EOK) {
+             DEBUG(SSSDBG_CRIT_FAILURE,
+-                  "Permission check on config file failed.\n");
+                  "Permission check on config file %s failed: %d\n",
+                  config_file, ret);
+             return ERR_INI_INVALID_PERMISSION;
+         }
+     } else {
+         DEBUG(SSSDBG_CONF_SETTINGS,
+-              "File %1$s does not exist.\n",
+-              (config_file ? config_file : "NULL"));
+              "File %s does not exist.\n", config_file);
+     }
+ 
+     ret = sss_ini_parse(self);
+     if (ret != EOK) {
+         sss_ini_config_print_errors(self->error_list);
+-        DEBUG(SSSDBG_FATAL_FAILURE, "Failed to parse configuration.\n");
+        DEBUG(SSSDBG_FATAL_FAILURE, "Failed to parse configuration file %s: %d\n",
+              config_file, ret);
+         return ERR_INI_PARSE_FAILED;
+     }
+ 
+     ret = sss_ini_add_snippets(self, config_dir);
+     if (ret != EOK) {
+         DEBUG(SSSDBG_FATAL_FAILURE,
+-              "Error while reading configuration directory.\n");
+              "Error while reading configuration directory %s: %d\n",
+              config_dir, ret);
+         return ERR_INI_ADD_SNIPPETS_FAILED;
+     }
+ 
+-- 
+2.47.0
+
--- a/harden_sssd-kcm.service.patch
+++ b/harden_sssd-kcm.service.patch
@@ -1,7 +1,11 @@
-Index: sssd-2.5.2/src/sysv/systemd/sssd-kcm.service.in
+---
+ src/sysv/systemd/sssd-kcm.service.in |   13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+Index: sssd-2.10.0/src/sysv/systemd/sssd-kcm.service.in
 ===================================================================
--- sssd-2.5.2.orig/src/sysv/systemd/sssd-kcm.service.in
-+++ sssd-2.5.2/src/sysv/systemd/sssd-kcm.service.in
+--- sssd-2.10.0.orig/src/sysv/systemd/sssd-kcm.service.in
+++ sssd-2.10.0/src/sysv/systemd/sssd-kcm.service.in
@@ -8,6 +8,19 @@ After=sssd-kcm.socket
 Also=sssd-kcm.socket
 
@@ -20,5 +24,5 @@ Index: sssd-2.5.2/src/sysv/systemd/sssd-kcm.service.in
 +RestrictRealtime=true
 +# end of automatic additions 
 Environment=DEBUG_LOGGER=--logger=files
- ExecStartPre=-@sbindir@/sssd --genconf-section=kcm
- ExecStart=@libexecdir@/sssd/sssd_kcm --uid 0 --gid 0 ${DEBUG_LOGGER}
+ ExecStartPre=+-/bin/chown -f @SSSD_USER@:@SSSD_USER@ @sssdconfdir@
+ ExecStartPre=+-/bin/chown -f @SSSD_USER@:@SSSD_USER@ @sssdconfdir@/sssd.conf
--- a/sssd-2.10.0.tar.gz
+++ b/sssd-2.10.0.tar.gz
--- a/sssd-2.10.0.tar.gz.asc
+++ b/sssd-2.10.0.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEEwTzQf/stsUCORXo809IbKRDPZ1kFAmcOPUoACgkQ09IbKRDP
+Z1myuA//anDvdZcQp0EUia2NsiWt2MFE8esmsEIN6QmEYjUxvEeXI9q4YJQimMi8
+wdt0zqZE1PLrTcroWaeGcgt2+CJWUbVanZtNn3oo7lUVYrLKemrUzavM7dXTaA43
+cdKAFyEO+nHJQ2yBNUt6sRXc3tM0H27yZs0iL+CcYu6YshUTbMnZuwdpz7DqDTN8
+nbG+LWa+U0en5mI3waP8Ionwmdv9AJAuCHQZLlZDpM0+YfGumcIUJdbxU/I8pqP8
+MQaulPv3e+BNwdbUiLlk0cXRjuEfSd0bmMa3MqB4IqMvvjACU0GuSgK3FDhutZJe
+HfmzYSo/Zntmr7F/eYLz6zy/GU3VewEilOyRV08oz+EVJRbGyo2t4k6PUYbn+I4V
+kJ/maed5jnBzIZGf6o+P1r+3mavJg7k2LDV4s48MsZ4Y5ED4X0c+boT1L5FZbquW
+gp99Di0RG4VoWiYOfVfszLzeDWOLbOrKMyA6PTqlmjGYAdV9SBwZP5WEdwXyPovo
+D7uual7Eqdd+Y/lt+8O4Wd+Y+a9xI2kwVFo8KYmHc8PhgLpPIKTWbBTEI+0nw3fJ
+qqyyA7JWA81bt4WKVuJaeS87S/9F4yn8ps2dzSgHjZ2Tzr7Eu1a3RWLjKYsjKZrT
+PPd2d/02rQAZPwLYHN5qM3Xjh0DD7IiXav1QuIPxmUQA9z8ZiuA=
+=mJVY
+-----END PGP SIGNATURE-----
--- a/sssd-2.9.5.tar.gz
+++ b/sssd-2.9.5.tar.gz
--- a/sssd-2.9.5.tar.gz.asc
+++ b/sssd-2.9.5.tar.gz.asc
@@ -1,16 +0,0 @@
-----BEGIN PGP SIGNATURE-----
-
-iQIzBAABCAAdFiEEwTzQf/stsUCORXo809IbKRDPZ1kFAmZF8CMACgkQ09IbKRDP
-Z1lSVQ/9EPVvWUX1z/pHfbvDjRpfD+LDbDceYB4YBh0caYpMVFm/2wHhFIjTYEpf
-SmIR+SQp50NkRSK6tE/u+Swu+YUkiCqnEWv2y9wd4Uh2NKiukyiqBC1k2cn9URNu
-oRreBM1KIRvTkdoyZwteELJ7vMLVr0UT2iIXZQFIIZX+LM3FNZJ5vFcj5fF0Hz1f
-v8zR0VTB7xY/6U+4KikvMyM3fOPeTOJvEtMp4xDWyquRjCADjZasOQcKRQzXp1er
-zs/qLcQ8eCODXhKelGqmppVIElW+72f1FNbMpBnlQ7VtFn6pn4sPazO0Hr7eNfZJ
-Vc6GXN8zZ/oF5U4x7XSMVqeOHLQoLeb2HxgUzS+1Ig19FHOs6Xoj0dO5l/TOEFav
-l61qytYnj3DNZjrMVLsMvOx3qGYK7PmyaWNoIJlLO2GbWKMP/8yBm35Ugd0jybSi
-T7VWX+isQHfVhSZ9wD4/yYOBAU3lABORAjXkCWQp/vMR/KiHbfaajCAbl56KiijQ
-eKYaq57EH3N+qKd1sqCrPfSw3HSqm3rngG1CsMasBQgLFs2aW+Mwo3UvQ1U/ykED
-mOo2D9uhOQluv4AUSpKK6E8EXoPSxDFZI4WX37depO2VGXDO90JNfVamJXjy1+bH
-d/RnoZfC7h7Vb1P1bPgGdsAFQBOP0FinbEjehpw0P0U2xAZQWek=
-=pY7t
-----END PGP SIGNATURE-----
--- a/sssd.changes
+++ b/sssd.changes
@@ -1,3 +1,44 @@
+-------------------------------------------------------------------
+Tue Oct 15 12:59:51 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 2.10.0
+  * The ``sssctl cache-upgrade`` command was removed. SSSD
+    performs automatic upgrades at startup when needed.
+  * Support of ``enumeration`` feature (i.e. ability to list all
+    users/groups using ``getent passwd/group`` without argument)
+    for AD/IPA providers is deprecated and might be removed in
+    further releases.
+  * The new tool ``sss_ssh_knownhosts`` can be used with ssh's
+    ``KnownHostsCommand`` configuration option to retrieve the
+    host's public keys from a remote server (FreeIPA, LDAP,
+    etc.). It replaces ```sss_ssh_knownhostsproxy``.
+  * The default value for ``ldap_id_use_start_tls`` changed from
+    false to true for improved security.
+  * https://github.com/SSSD/sssd/releases/tag/2.10.0
+- Add 0001-sssd-always-print-path-when-config-object-is-rejecte.patch
+
+-------------------------------------------------------------------
+Tue Oct  1 10:15:07 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
+
+- Update filelists involving memberof.so and idmap/sss.so to
+  avoid gobbling up one file into multiple sssd subpackages.
+  (Between samba-4.20 and 4.21, %ldbdir changes from
+  /usr/lib64/ldb2/modules/ldb to /usr/lib64/samba/ldb, so now
+  `%_libdir/samba` is a bit too broad.)
+
+-------------------------------------------------------------------
+Wed Jul 17 09:19:20 UTC 2024 - Samuel Cabrero <scabrero@suse.de>
+
+- Fix spec file for openSUSE ALP and SUSE SLFO, where the
+  python3_fix_shebang_path RPM macro is not available
+
+-------------------------------------------------------------------
+Thu Jul 11 09:41:21 UTC 2024 - Samuel Cabrero <scabrero@suse.de>
+
+- Revert the change dropping the default configuration file. If
+  /usr/etc exists will be installed there, otherwise in /etc.
+  (bsc#1226157);
+
 -------------------------------------------------------------------
 Thu May 16 12:13:02 UTC 2024 - Jan Engelhardt <jengelh@inai.de>

--- a/sssd.spec
+++ b/sssd.spec
@@ -17,7 +17,7 @@


 Name:           sssd
-Version:        2.9.5
+Version:        2.10.0
 Release:        0
 Summary:        System Security Services Daemon
 License:        GPL-3.0-or-later AND LGPL-3.0-or-later
@@ -32,6 +32,7 @@ Patch1:         krb-noversion.diff
 Patch2:         harden_sssd-ifp.service.patch
 Patch3:         harden_sssd-kcm.service.patch
 Patch4:         symvers.patch
+Patch5:         0001-sssd-always-print-path-when-config-object-is-rejecte.patch
 BuildRequires:  autoconf >= 2.59
 BuildRequires:  automake
 BuildRequires:  bind-utils
@@ -53,18 +54,22 @@ BuildRequires:  nss_wrapper
 BuildRequires:  openldap2-devel
 BuildRequires:  pam-devel
 BuildRequires:  pkg-config >= 0.21
+BuildRequires:  python3-wheel
+BuildRequires:  python3-setuptools
 BuildRequires:  systemd-rpm-macros
+BuildRequires:  sysuser-tools
 BuildRequires:  uid_wrapper
 BuildRequires:  pkgconfig(augeas) >= 1.0.0
 BuildRequires:  pkgconfig(collection) >= 0.5.1
 BuildRequires:  pkgconfig(dbus-1) >= 1.0.0
 BuildRequires:  pkgconfig(dhash) >= 0.4.2
 BuildRequires:  pkgconfig(glib-2.0)
-BuildRequires:  pkgconfig(ini_config) >= 1.1.0
+BuildRequires:  pkgconfig(ini_config) >= 1.3
 BuildRequires:  pkgconfig(jansson)
 BuildRequires:  pkgconfig(ldb) >= 0.9.2
+BuildRequires:  pkgconfig(libcap)
 BuildRequires:  pkgconfig(libcares)
-BuildRequires:  pkgconfig(libcrypto)
+BuildRequires:  pkgconfig(libcrypto) >= 1.0.1
 %if 0%{?suse_version} >= 1600
 BuildRequires:  pkgconfig(libcurl)
 %endif
@@ -86,6 +91,14 @@ BuildRequires:  pkgconfig(talloc)
 BuildRequires:  pkgconfig(tdb) >= 1.1.3
 BuildRequires:  pkgconfig(tevent)
 BuildRequires:  pkgconfig(uuid)
+%if 0%{?suse_version} && 0%{?suse_version} < 1600
+# samba-client-devel pulls samba-client-libs pulls libldap-2_4-2 wants libldap-data(-2.4);
+# this conflicts with
+# openldap2-devel pulls libldap2 wants libldap-data(-2.6)
+# Package contains just config files, not needed for build.
+#!BuildIgnore: libldap-data
+%endif
+%sysusers_requires
 %{?systemd_ordering}
 Requires:       sssd-ldap = %version-%release
 Requires(postun): pam-config
@@ -104,7 +117,7 @@ Obsoletes:      sssd-common < %version-%release
 %define ldbdir %(pkg-config ldb --variable=modulesdir)

 # Both SSSD and cifs-utils provide an idmap plugin for cifs.ko
-# %_sysconfdir/cifs-utils/idmap-plugin should be a symlink to one of the 2 idmap plugins
+# %%_sysconfdir/cifs-utils/idmap-plugin should be a symlink to one of the 2 idmap plugins
 # * cifs-utils one is the default (priority 20)
 # * installing SSSD should NOT switch to SSSD plugin (priority 10)
 %define cifs_idmap_plugin       %_sysconfdir/cifs-utils/idmap-plugin
@@ -115,11 +128,11 @@ Requires(post): update-alternatives
 Requires(postun): update-alternatives

 %description
-Provides a set of daemons to manage access to remote directories and
-authentication mechanisms. It provides an NSS and PAM interface toward
-the system and a pluggable backend system to connect to multiple different
-account sources. It is also the basis to provide client auditing and policy
-services for projects like FreeIPA.
+A set of daemons to manage access to remote directories and
+authentication mechanisms. sssd provides an NSS and PAM interfaces
+toward the system and a pluggable backend system to connect to
+multiple different account sources. It is also the basis to provide
+client auditing and policy services for projects like FreeIPA.

 %package ad
 Summary:        The ActiveDirectory backend plugin for sssd
@@ -129,9 +142,8 @@ Requires:       %name-krb5-common = %version-%release
 Requires:       adcli

 %description ad
-Provides the Active Directory back end that the SSSD can utilize to
-fetch identity data from and authenticate against an Active Directory
-server.
+A back-end provider that the SSSD can utilize to fetch identity data
+from, and authenticate with, an Active Directory server.

 %package dbus
 Summary:        The D-Bus responder of sssd
@@ -140,7 +152,7 @@ Group:          System/Base
 Requires:       %name = %version

 %description dbus
-Provides the D-Bus responder of sssd, called InfoPipe, which allows
+D-Bus responder of sssd, called InfoPipe, which allows
 information from sssd to be transmitted over the system bus.

 %package ipa
@@ -154,8 +166,8 @@ Obsoletes:      %name-ipa-provider < %version-%release
 Provides:       %name-ipa-provider = %version-%release

 %description ipa
-Provides the IPA back end that the SSSD can utilize to fetch identity
-data from and authenticate against an IPA server.
+A back-end provider that the SSSD can utilize to fetch identity data
+from, and authenticate with, an IPA server.

 %package kcm
 Summary:        SSSD's Kerberos cache manager
@@ -174,8 +186,8 @@ Group:          System/Daemons
 Requires:       %name-krb5-common = %version-%release

 %description krb5
-Provides the Kerberos back end that the SSSD can utilize authenticate
-against a Kerberos server.
+A back-end provider that the SSSD can utilize to authenticate against
+a Kerberos server.

 %package krb5-common
 Summary:        SSSD helpers needed for Kerberos and GSSAPI authentication
@@ -194,8 +206,8 @@ Group:          System/Daemons
 Requires:       %name-krb5-common = %version-%release

 %description ldap
-Provides the LDAP back end that the SSSD can utilize to fetch
-identity data from and authenticate against an LDAP server.
+A back-end provider that the SSSD can utilize to fetch identity data
+from, and authenticate with, an LDAP server.

 %package proxy
 Summary:        The proxy backend plugin for sssd
@@ -203,8 +215,8 @@ License:        GPL-3.0-or-later
 Group:          System/Daemons

 %description proxy
-Provides the proxy back end which can be used to wrap an existing NSS
-and/or PAM modules to leverage SSSD caching.
+A back-end provider which can be used to wrap existing NSS and/or PAM
+modules to leverage SSSD caching. (This can replace nscd.)

 %package tools
 Summary:        Commandline tools for sssd
@@ -214,7 +226,7 @@ Requires:       python3-sssd-config = %version-%release
 Requires:       sssd = %version

 %description tools
-The packages contains commandline tools for managing users and groups using
+The packages contains command-line tools for managing users and groups using
 the "local" id provider of the System Security Services Daemon (sssd).

 %package winbind-idmap
@@ -231,7 +243,7 @@ License:        LGPL-3.0-or-later
 Group:          System/Libraries

 %description -n libsss_certmap0
-A utility library for FreeIPA to map certs.
+A utility library for FreeIPA to map certificates.

 %package -n libsss_certmap-devel
 Summary:        Development files for the FreeIPA certmap library
@@ -240,7 +252,7 @@ Group:          Development/Libraries/C and C++
 Requires:       libsss_certmap0 = %version

 %description -n libsss_certmap-devel
-A utility library for FreeIPA to map certs.
+A utility library for FreeIPA to map certificates.

 %package -n libipa_hbac0
 Summary:        FreeIPA HBAC Evaluator library
@@ -304,7 +316,6 @@ Requires:       libsss_nss_idmap0 = %version
 %description -n libsss_nss_idmap-devel
 A utility library for FreeIPA to map Windows SIDs to Unix user/group IDs.

-%if 0%{?suse_version} < 1600
 %package -n libsss_simpleifp0
 Summary:        The SSSD D-Bus responder helper library
 License:        GPL-3.0-or-later
@@ -327,7 +338,6 @@ Requires:       libsss_simpleifp0 = %version
 This subpackage provides the development files for sssd's simpleifp,
 a library that simplifies the D-Bus API for the SSSD InfoPipe
 responder.
-%endif

 %package -n libsss_sudo
 Summary:        A library to allow communication between sudo and SSSD
@@ -407,19 +417,25 @@ autoreconf -fiv
 	--with-subid
 %else
 	--with-selinux=no \
-	--with-semanage=no \
 	--with-libsifp \
 	--with-files-provider
 %endif
 %make_build all

 %install
-# sss_obfuscate is compatible with both python 2 and 3
+# sss_obfuscate is compatible with both Python 2 and 3
 perl -i -lpe 's{%_bindir/python\b}{%_bindir/python3}' src/tools/sss_obfuscate
 %make_install dbuspolicydir=%_datadir/dbus-1/system.d
 b="%buildroot"

 # Copy some defaults
+%if "%{?_distconfdir}" != ""
+install -D -p -m 0600 src/examples/sssd-example.conf "$b/%_distconfdir/sssd/sssd.conf"
+install -d -m 0755 "$b/%_distconfdir/sssd/conf.d"
+%else
+install -D -p -m 0600 src/examples/sssd-example.conf "$b/%_sysconfdir/sssd/sssd.conf"
+install -d -m 0755 "$b/%_sysconfdir/sssd/conf.d"
+%endif
 install -d "$b/%_unitdir"
 %if 0%{?suse_version} > 1500
 install -d "$b/%_distconfdir/logrotate.d"
@@ -441,23 +457,33 @@ find "$b" -type f -name "*.la" -print -delete
 %find_lang %name --all-name

 # dummy target for cifs-idmap-plugin
-mkdir -pv %buildroot/%_sysconfdir/alternatives %buildroot/%_sysconfdir/cifs-utils
-ln -sfv %_sysconfdir/alternatives/%cifs_idmap_name %buildroot/%cifs_idmap_plugin
+mkdir -pv "$b/%_sysconfdir/alternatives" "$b/%_sysconfdir/cifs-utils"
+ln -sfv "%_sysconfdir/alternatives/%cifs_idmap_name" "$b/%cifs_idmap_plugin"
 %python3_fix_shebang
-%if %{suse_version} >= 1600
-%python3_fix_shebang_path %{buildroot}/%{_libexecdir}/%{name}/
+%if 0%{?suse_version} > 1600
+%python3_fix_shebang_path %buildroot/%_libexecdir/%name/
+%elif 0%{?suse_version} == 1600
+# python3_fix_shebang_path macro does not exist in < 1600, was added in python-rom-macros 20231204
+sed -i '1s@#!.*python.*@#!%_bindir/python3.11@' "$b/%_libexecdir/%name/sss_analyze"
 %endif

+echo 'u sssd - "System Security Services Daemon" /run/sssd /sbin/nologin' >system-user-sssd.conf
+mkdir -p "$b/%_sysusersdir"
+cp -a system-user-sssd.conf "$b/%_sysusersdir/"
+%sysusers_generate_pre system-user-sssd.conf random system-user-sssd.conf
+
 %check
 # sss_config-tests fails
 %make_build check || :

-%pre
+%pre -f random.pre
 %service_add_pre sssd.service
+%if "%{?_distconfdir}" != ""
 # Prepare for migration to /usr/etc; save any old .rpmsave
 for i in sssd/sssd.conf pam.d/sssd-shadowutils logrotate.d/sssd ; do
-	test -f %{_sysconfdir}/${i}.rpmsave && mv -v %{_sysconfdir}/${i}.rpmsave %{_sysconfdir}/${i}.rpmsave.old ||:
+	test -f "%_sysconfdir/$i.rpmsave" && mv -v "%_sysconfdir/$i.rpmsave" "%_sysconfdir/$i.rpmsave.old" || :
 done
+%endif

 %post
 /sbin/ldconfig
@@ -475,7 +501,7 @@ update-alternatives --install %cifs_idmap_plugin %cifs_idmap_name %cifs_idmap_li

 %postun
 /sbin/ldconfig
-if [ "$1" = "0" -a -x "%_sbindir/pam-config" ]; then
+if [ "$1" = "0" ] && [ -x "%_sbindir/pam-config" ]; then
 	"%_sbindir/pam-config" -d --sss || :
 fi
 # del_postun includes a try-restart
@@ -485,18 +511,11 @@ if [ ! -f "%cifs_idmap_lib" ]; then
 	update-alternatives --remove %cifs_idmap_name %cifs_idmap_lib
 fi

-%post   -n libsss_certmap0 -p /sbin/ldconfig
-%postun -n libsss_certmap0 -p /sbin/ldconfig
-%post   -n libipa_hbac0 -p /sbin/ldconfig
-%postun -n libipa_hbac0 -p /sbin/ldconfig
-%post   -n libsss_idmap0 -p /sbin/ldconfig
-%postun -n libsss_idmap0 -p /sbin/ldconfig
-%post   -n libsss_nss_idmap0 -p /sbin/ldconfig
-%postun -n libsss_nss_idmap0 -p /sbin/ldconfig
-%if 0%{?suse_version} < 1600
-%post   -n libsss_simpleifp0 -p /sbin/ldconfig
-%postun -n libsss_simpleifp0 -p /sbin/ldconfig
-%endif
+%ldconfig_scriptlets -n libsss_certmap0
+%ldconfig_scriptlets -n libipa_hbac0
+%ldconfig_scriptlets -n libsss_idmap0
+%ldconfig_scriptlets -n libsss_nss_idmap0
+%ldconfig_scriptlets -n libsss_simpleifp0

 %triggerun -- %name < %version-%release
 # sssd takes care of upgrading the database but it doesn't handle downgrades.
@@ -535,36 +554,38 @@ fi
 # Migrate sssd.service from sssd-common to sssd
 systemctl is-enabled sssd.service > /dev/null
 if [ $? -eq 0 ]; then
-mkdir -p /run/systemd/rpm/
-touch /run/systemd/rpm/sssd-was-enabled
+	mkdir -p /run/systemd/rpm/
+	touch /run/systemd/rpm/sssd-was-enabled
 fi
 systemctl is-active sssd.service > /dev/null
 if [ $? -eq 0 ]; then
-mkdir -p /run/systemd/rpm/
-touch /run/systemd/rpm/sssd-was-active
+	mkdir -p /run/systemd/rpm/
+	touch /run/systemd/rpm/sssd-was-active
 fi

 %posttrans
+%if "%{?_distconfdir}" != ""
 # Migration to /usr/etc, restore just created .rpmsave
 for i in sssd/sssd.conf logrotate.d/sssd pam.d/sssd-shadowutils ; do
-	test -f %{_sysconfdir}/${i}.rpmsave && mv -v %{_sysconfdir}/${i}.rpmsave %{_sysconfdir}/${i} ||:
+	test -f "%_sysconfdir/$i.rpmsave" && mv -v "%_sysconfdir/$i.rpmsave" "%_sysconfdir/$i" || :
 done
+%endif
 # Migrate sssd.service from sssd-common to sssd
 if [ -e /run/systemd/rpm/sssd-was-enabled ]; then
-systemctl is-enabled sssd.service > /dev/null
-if [ $? -ne 0 ]; then
-    echo "Migrating sssd.service, was enabled"
-    systemctl enable sssd.service
-fi
-rm /run/systemd/rpm/sssd-was-enabled
+	systemctl is-enabled sssd.service >/dev/null
+	if [ $? -ne 0 ]; then
+		echo "Migrating sssd.service, was enabled"
+		systemctl enable sssd.service
+	fi
+	rm /run/systemd/rpm/sssd-was-enabled
 fi
 if [ -e /run/systemd/rpm/sssd-was-active ]; then
-systemctl is-active sssd.service > /dev/null
-if [ $? -ne 0 ]; then
-    echo "Migrating sssd.service, was active"
-    systemctl start sssd.service
-fi
-rm /run/systemd/rpm/sssd-was-active
+	systemctl is-active sssd.service >/dev/null
+	if [ $? -ne 0 ]; then
+		echo "Migrating sssd.service, was active"
+		systemctl start sssd.service
+	fi
+	rm /run/systemd/rpm/sssd-was-active
 fi

 %files -f sssd.lang
@@ -577,12 +598,12 @@ fi
 %_unitdir/sssd-pac.socket
 %_unitdir/sssd-pac.service
 %_unitdir/sssd-pam.socket
-%_unitdir/sssd-pam-priv.socket
 %_unitdir/sssd-pam.service
 %_unitdir/sssd-ssh.socket
 %_unitdir/sssd-ssh.service
 %_unitdir/sssd-sudo.socket
 %_unitdir/sssd-sudo.service
+%_sysusersdir/*sssd*
 %_bindir/sss_ssh_*
 %_sbindir/sssd
 %if 0%{?suse_version} < 1600
@@ -657,6 +678,15 @@ fi
 %attr(755,root,root) %dir %sssdstatedir/mc/
 %attr(700,root,root) %dir %sssdstatedir/keytabs/
 %attr(750,root,root) %dir %_localstatedir/log/%name/
+%if "%{?_distconfdir}" != ""
+%dir %_distconfdir/sssd/
+%%dir %_distconfdir/sssd/conf.d
+%config(noreplace) %_distconfdir/sssd/sssd.conf
+%else
+%dir %_sysconfdir/sssd/
+%%dir %_sysconfdir/sssd/conf.d
+%config(noreplace) %_sysconfdir/sssd/sssd.conf
+%endif
 %if 0%{?suse_version} > 1500
 %_distconfdir/logrotate.d/sssd
 %_pam_vendordir/sssd-shadowutils
@@ -802,7 +832,8 @@ fi
 %python3_sitelib/sssd/

 %files winbind-idmap
-%_libdir/samba/
+%dir %_libdir/samba/
+%_libdir/samba/idmap/
 %_mandir/man8/idmap_sss.8*

 %files -n libipa_hbac0
Author	SHA256	Message	Date
Jan Engelhardt	d236d87ed8	sssd 2.10.0 (part 2)	2024-10-16 17:05:53 +02:00
Jan Engelhardt	03cfa0ca67	sssd 2.10.0	2024-10-15 15:33:24 +02:00
Jan Engelhardt	3a2bee3ebf	Filelist changes needed for upcoming libldb.pc from samba-4.21	2024-10-01 12:24:38 +02:00
Jan Engelhardt	73fb2a82f6	%{?_distconfdir:1} somehow fails to work on 15.X	2024-09-25 22:30:26 +02:00
Jan Engelhardt	93d212c167	Ignore libldap-data during 15.X build	2024-09-25 22:30:16 +02:00
Samuel Cabrero	bf358d8fff	Fix building for openSUSE ALP and SUSE SLFO The python3_fix_shebang_path rpm macro is not available in < 1600 Signed-off-by: Samuel Cabrero <scabrero@suse.de>	2024-07-17 11:57:47 +02:00
Jan Engelhardt	747483e617	feed through formatter, use more widely used ?expr:1	2024-07-16 13:14:12 +02:00
Jan Engelhardt	8b1778e6ae	Revert the change dropping the default configuration file. If usr/etc exists will be installed there, otherwise in /etc. (bsc#1226157);	2024-07-16 13:12:59 +02:00