30 Commits

Author SHA256 Message Date
07ba7dab75 Install file to load sssd generated krb5 config snippets
Signed-off-by: Samuel Cabrero <scabrero@suse.com>
2025-06-11 18:51:36 +02:00
1802fa3261 Stricter syntax adherence for changelog 2025-06-05 18:32:59 +02:00
11708aedcc sssd 2.11.0 2025-06-05 14:46:45 +02:00
ea880556c3 Run mkdir/rm with verbose mode for the build log 2025-03-11 22:35:43 +01:00
Samuel Cabrero
0dd76c3fb1 Add rpmlintrc file for sssd-krb5-common package
Signed-off-by: Samuel Cabrero <scabrero@suse.de>
2025-02-03 10:25:56 +01:00
28a3ba978a sssd 2.10.2 2025-01-30 15:54:21 +01:00
24b0354b14 Merge 'refs/pull/7/head' of ssh://src.opensuse.org/jengelh/sssd 2025-01-22 11:12:54 +01:00
660ade3bb1 Combine disparate idmap plugin descriptions 2025-01-22 11:09:37 +01:00
73ddc33a8e No longer depend on deprecated nscd 2025-01-22 10:23:04 +01:00
Samuel Cabrero
e6e6fdcbb8 Replace u-a with package conflicts
The plugin for cifs.idmap is moved to its own package and conflicts with
the winbind plugin provided by cifs-utils.

Fixes bsc#1235789, bsc#1216739

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
2025-01-22 09:48:53 +01:00
e9bed7037d Align with polkit-1 directory permissions
found conflict of polkit-123-6.7.x86_64 with sssd-2.10.1-1.1.x86_64
  /usr/share/polkit-1/rules.d [mode mismatch: d555 root:root, d755 root:root]
2025-01-10 20:53:16 +01:00
090bf5ef30 Mention 0001-TOOL-Fix-build-parameter-name-omitted.patch 2025-01-09 18:30:40 +01:00
Samuel Cabrero
cd05c14a49 Adjust permissions file location for Tumbleweed and Leap 16
Signed-off-by: Samuel Cabrero <scabrero@suse.de>
2025-01-02 14:33:44 +01:00
Samuel Cabrero
7f9841f325 Fix Leap 15.x builds
Signed-off-by: Samuel Cabrero <scabrero@suse.de>
2025-01-02 14:33:44 +01:00
1507d9a094 Add note about unprivileged mode security review 2024-12-20 09:20:44 +01:00
7a9befa693 sssd 2.10.1 2024-12-11 10:33:24 +01:00
Samuel Cabrero
6e6893108a Unprivileged mode for sssd 2024-11-05 22:15:00 +01:00
Samuel Cabrero
0823836080 Use default nsslibdir 2024-11-05 21:34:50 +01:00
066c89155b Add patches to kill extraneous INI permission checks 2024-11-05 20:41:59 +01:00
64fc4926ab Add 0001-Configuration-make-sure-etc-sssd-and-everything.patch
0001-Configuration-make-sure-etc-sssd-and-everything.patch is
added ahead of the stack because it is an upstream-accepted patch.
harden_sssd-kcm.service.patch then needs a refresh for reasons of
fuzz 2.
2024-11-05 19:09:18 +01:00
Samuel Cabrero
4c1a7e3419 Fix socket activation for responders 2024-11-05 18:56:08 +01:00
0b818bbcb7 Update 0001-sssd-always-print-path-when-config-object-is-rejecte.patch with accepted commit 2024-11-05 18:54:05 +01:00
d236d87ed8 sssd 2.10.0 (part 2) 2024-10-16 17:05:53 +02:00
03cfa0ca67 sssd 2.10.0 2024-10-15 15:33:24 +02:00
3a2bee3ebf Filelist changes needed for upcoming libldb.pc from samba-4.21 2024-10-01 12:24:38 +02:00
73fb2a82f6 %{?_distconfdir:1} somehow fails to work on 15.X 2024-09-25 22:30:26 +02:00
93d212c167 Ignore libldap-data during 15.X build 2024-09-25 22:30:16 +02:00
Samuel Cabrero
bf358d8fff Fix building for openSUSE ALP and SUSE SLFO
The python3_fix_shebang_path rpm macro is not available in < 1600

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
2024-07-17 11:57:47 +02:00
747483e617 feed through formatter, use more widely used ?expr:1 2024-07-16 13:14:12 +02:00
8b1778e6ae Revert the change dropping the default configuration file.
If usr/etc exists will be installed there, otherwise in /etc.
(bsc#1226157);
2024-07-16 13:12:59 +02:00
10 changed files with 35 additions and 93 deletions

View File

@@ -1,4 +0,0 @@
mtime: 1753994117
commit: 0e0d1361c8452d81d3f95f3e2e6ee1170e16356d1e2c4145af472ea204b6b873
url: https://src.opensuse.org/jengelh/sssd
revision: master

View File

@@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:a31e4d0a5d8f6b3d45219c049e9bb6f29dc8d630ca5dbc7f9e4e89be2ae35fa2
size 256

View File

@@ -1,48 +0,0 @@
From: Jan Engelhardt <ej@inai.de>
Date: 2025-07-18 11:02:24.078457348 +0200
References: https://bugzilla.suse.com/show_bug.cgi?id=1246537
References: https://github.com/SSSD/sssd/issues/8041
---
src/examples/logrotate.in | 3 +--
src/sysv/systemd/sssd-kcm.service.in | 1 +
src/sysv/systemd/sssd.service.in | 1 +
3 files changed, 3 insertions(+), 2 deletions(-)
Index: sssd-2.11.1/src/examples/logrotate.in
===================================================================
--- sssd-2.11.1.orig/src/examples/logrotate.in
+++ sssd-2.11.1/src/examples/logrotate.in
@@ -8,7 +8,6 @@
delaycompress
su @SSSD_USER@ @SSSD_USER@
postrotate
- /bin/kill -HUP `cat @pidpath@/sssd.pid 2>/dev/null` 2> /dev/null || true
- /bin/pkill -HUP sssd_kcm 2> /dev/null || true
+ /usr/bin/systemctl try-reload-or-restart sssd sssd_kcm
endscript
}
Index: sssd-2.11.1/src/sysv/systemd/sssd-kcm.service.in
===================================================================
--- sssd-2.11.1.orig/src/sysv/systemd/sssd-kcm.service.in
+++ sssd-2.11.1/src/sysv/systemd/sssd-kcm.service.in
@@ -32,6 +32,7 @@ ExecStartPre=+-/bin/chmod -f g+x @sssdco
ExecStartPre=+-/bin/sh -c "/bin/chown -f -h @SSSD_USER@:@SSSD_USER@ @secdbpath@/*.ldb"
ExecStartPre=+-/bin/sh -c "/bin/chown -f -h @SSSD_USER@:@SSSD_USER@ @logpath@/sssd_kcm.log*"
ExecStart=@libexecdir@/sssd/sssd_kcm ${DEBUG_LOGGER}
+ExecReload=kill -HUP $MAINPID
CapabilityBoundingSet= CAP_DAC_READ_SEARCH CAP_SETGID CAP_SETUID
SecureBits=noroot noroot-locked
User=@SSSD_USER@
Index: sssd-2.11.1/src/sysv/systemd/sssd.service.in
===================================================================
--- sssd-2.11.1.orig/src/sysv/systemd/sssd.service.in
+++ sssd-2.11.1/src/sysv/systemd/sssd.service.in
@@ -21,6 +21,7 @@ ExecStartPre=+-/bin/sh -c "/bin/chown -f
ExecStartPre=+-/bin/chown -f -R -h @SSSD_USER@:@SSSD_USER@ @gpocachepath@
ExecStartPre=+-/bin/sh -c "/bin/chown -f -h @SSSD_USER@:@SSSD_USER@ @logpath@/*.log*"
ExecStart=@sbindir@/sssd -i ${DEBUG_LOGGER}
+ExecReload=kill -HUP $MAINPID
Type=notify
NotifyAccess=main
Restart=on-abnormal

BIN
sssd-2.11.0.tar.gz (Stored with Git LFS) Normal file

Binary file not shown.

16
sssd-2.11.0.tar.gz.asc Normal file
View File

@@ -0,0 +1,16 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEwTzQf/stsUCORXo809IbKRDPZ1kFAmhBWQkACgkQ09IbKRDP
Z1nnrg//ZyIWtg+Qp5bVW6MQS99kuATk0hvAQnm4tTjO8HzphWFl0Hta7h9QOsM3
QhVs4liW13eb9yZDnHfFh44o0F+QEYzHouMikZaA6riIxzYO0Im5Rglq/jkcZGn9
IrR4w0of45wmL9huZAsXnYosw9RtDuF5FEDB6yypcPqSyXxr+jyW3U52hEXpjaQ/
M3XXmoeQVMeb1RmQkcMWt+7/gjOoWSjONtOOFoUlGxn3GgeIroPIzUViYqJDJZi2
zIkBhoGw1EdKPVFV/8YTNH4u5RA3PmN92tmey9uWA5mfxH//njPUNv5sKO8RKkaU
BD2ftTK3Vv8QzLpKEuANnJ5/P/bh5LWGjn3J6kJBn5w2Zedy0AecZfo1PKONfukv
+QIyNKBlc9x0kts/TwMLo60p2olJqh/AKlXwgexfxAzQqcuBlcZdpMqyV279cmXl
X78NYzdR9F5n4czKiDU8JWudndIzagVi/0NmuQJWfFCz0o3sCtI9QUj+GUH8Ynxd
DCyxXZptN2LtobxJnaSXB3HwwJ6qKlQTrfHWwqcmzf/p2KyJIaGg93nYhwIlLrev
HVkuTB9dTpZa0LkljWOd/i7eoGQ0zxYM3pTm2FKDy/Ff5ChPriHdjIAhYqgPxt+j
r3wMiMOIRckv1a538CAKdbC8k8Q0nmHfYTdrt3dp+fSSr4iwZLA=
=gdC9
-----END PGP SIGNATURE-----

BIN
sssd-2.11.1.tar.gz (Stored with Git LFS)

Binary file not shown.

View File

@@ -1,16 +0,0 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEwTzQf/stsUCORXo809IbKRDPZ1kFAmiLT74ACgkQ09IbKRDP
Z1nIIQ/+NjryrInjiH9LmBZKa5wgYE8d49aHxtOc4pySV3CFhVMM0cUT0rO1umy3
+4xlvxDs/7OYdZkJapotcpf8CJDyLttxsA4/0gfBDGoCRsRLAXxnoZ9K7+0PgV5j
2DbB6+0Ay0JJ9IYjJwoIMbSKiWm2/KuqLBicNoaxvYK/OJc/K+3AkPIyqVmOItl8
23UOMuMn6NRBJP6m0R+LUEJQ4rW6cej1lc+mqsPYlerHY8BmRFzRcFjVqhsgUpQj
hCTJwq5iUpbhiyDIpYzGeS5Jr0bxAVeAZbo4YcN2GQVawOjLQYOP7UPWFm80JLbQ
GEvQHHo2YDBxcZEma6Z614/8aQI6nVzc/DMq3ffPb4E5snMJ+/v9LCGN1jjmCPWo
TSiYZrt33zeJrmsmnImWT4ejErkt7dLV9qOQS6BTjHGtgNgl4qrbiFLSZZk2oJp6
1eJERF/uqBmBYJ2Bq7Fq0Gp4u90TK6kgLV8pkz71Tl+BUPjoD8H9b6VMrwY0jiux
FfE9ZjWDDAlaLqRlbpd6lVHiQfkgCUflw7o5E+jSL96S4X+6e1aCcL3vdkLxFSCa
PCQggDD+Ng2HvNsqQ8Z1eA0k2wNuYUNLKab2eUcc4siIKmoMsPQkgmLUBINiPMyR
GR6ZQ6xdiQkBFBC+JplQM5AsVddJ7UZ2DCzUzFkriyqua58Cuyo=
=DoFI
-----END PGP SIGNATURE-----

View File

@@ -1,17 +1,3 @@
-------------------------------------------------------------------
Thu Jul 31 16:15:46 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
- Update to release 2.11.1
* Fixed AD users in external groups not being cleared once the
cache expires.
* Fixed `cache_credentials=true` not having any effect.
* Fixed socket activation not having an effect for sssd_pam.
-------------------------------------------------------------------
Fri Jul 18 09:03:19 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
- Add logrotate.patch [boo#1246537]
-------------------------------------------------------------------
Wed Jun 11 14:53:26 UTC 2025 - Samuel Cabrero <scabrero@suse.de>

View File

@@ -17,7 +17,7 @@
Name: sssd
Version: 2.11.1
Version: 2.11.0
Release: 0
Summary: System Security Services Daemon
License: GPL-3.0-or-later AND LGPL-3.0-or-later
@@ -28,13 +28,11 @@ Source: https://github.com/SSSD/sssd/releases/download/%version/%name-%v
Source2: https://github.com/SSSD/sssd/releases/download/%version/%name-%version.tar.gz.asc
Source3: baselibs.conf
Source5: %name.keyring
Source6: %name-rpmlintrc
Patch1: 0001-TOOL-Fix-build-parameter-name-omitted.patch
Patch11: krb-noversion.diff
Patch12: harden_sssd-ifp.service.patch
Patch13: harden_sssd-kcm.service.patch
Patch14: symvers.patch
Patch15: logrotate.patch
BuildRequires: autoconf >= 2.59
BuildRequires: automake
BuildRequires: bind-utils
@@ -90,7 +88,6 @@ BuildRequires: pkgconfig(p11-kit-1) >= 0.23.3
BuildRequires: pkgconfig(popt)
BuildRequires: pkgconfig(python3)
BuildRequires: pkgconfig(smbclient)
BuildRequires: pkgconfig(systemd)
BuildRequires: pkgconfig(talloc)
BuildRequires: pkgconfig(tdb) >= 1.1.3
BuildRequires: pkgconfig(tevent)
@@ -441,7 +438,8 @@ autoreconf -fiv
--with-subid
%else
--with-selinux=no \
--with-libsifp
--with-libsifp \
--with-files-provider
%endif
%make_build all
@@ -697,6 +695,9 @@ fi
%_libdir/%name/libsss_cert*
%_libdir/%name/libsss_crypt*
%_libdir/%name/libsss_debug*
%if 0%{?suse_version} < 1600
%_libdir/%name/libsss_files*
%endif
%_libdir/%name/libsss_iface*
%_libdir/%name/libsss_sbus*
%_libdir/%name/libsss_simple*
@@ -929,6 +930,16 @@ fi
%_libdir/libsss_nss_idmap.so
%_libdir/pkgconfig/sss_nss_idmap.pc
%if 0%{?suse_version} < 1600
%files -n libsss_simpleifp0
%_libdir/libsss_simpleifp.so.0*
%files -n libsss_simpleifp-devel
%_includedir/sss_sifp*.h
%_libdir/libsss_simpleifp.so
%_libdir/pkgconfig/sss_simpleifp.pc
%endif
%files -n python3-ipa_hbac
%dir %python3_sitearch
%python3_sitearch/pyhbac.so