SHA256
1
0
forked from pool/sssd

40 Commits

Author SHA256 Message Date
f441e15470 Accepting request 1296905 from network:ldap
- Update to release 2.11.1

OBS-URL: https://build.opensuse.org/request/show/1296905
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/sssd?expand=0&rev=144
2025-08-03 11:36:06 +00:00
OBS User unknown
ac2341eb71 [info=0e0d1361c8452d81d3f95f3e2e6ee1170e16356d1e2c4145af472ea204b6b873]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=347
2025-07-31 20:37:02 +00:00
OBS User unknown
a3a7d85e9d [info=2cc08891af6234d5afcc0dbcd562d9e7997322d0ba593c0363ff67fb1a41f8b5]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=346
2025-07-31 16:19:50 +00:00
OBS User unknown
2f0ff24af8 [info=7f6b2a57ed82abb7351dba23c5b0a73d09c020997808a90ead672498ccbea34d]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=345
2025-07-18 09:37:49 +00:00
OBS User unknown
305cc94848 [info=07ba7dab750d7fd18eded76de845c5bfcf2df0e0dfa9070ca10b74fae7546643]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=344
2025-06-11 20:03:40 +00:00
OBS User unknown
f0d12afd5e [info=1802fa32614b207ec84dcdd5b6422c1ed73bf09066291fd25317219ada5bc1b6]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=343
2025-06-05 16:33:15 +00:00
aeb6440c3e [info=11708aedcc1879a4576fa05c22ada51de4b0cdea46423883ec91bd8fb59840b9]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=342
2025-06-05 13:28:01 +00:00
OBS User unknown
bf6ba5f501 [info=ea880556c3c80110b1c5270e1eee90d7c88377dbb781a18ad08280657bdc5b54]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=341
2025-03-11 21:35:56 +00:00
1bb44b7558 Accepting request 1243227 from network:ldap
- Update to release 2.10.2

OBS-URL: https://build.opensuse.org/request/show/1243227
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/sssd?expand=0&rev=143
2025-02-05 20:55:36 +00:00
OBS User unknown
a71b435f42 [info=0dd76c3fb1e8976e3f2203732d255929ddd4647604210f34bc9970c9c866a7c6]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=340
2025-02-04 22:47:19 +00:00
OBS User unknown
f7191ee183 [info=28a3ba978ae4540af4c492a58e999467d0c02d55c52fe8115b623c28f983efd4]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=339
2025-01-30 14:54:36 +00:00
6a343e865f Accepting request 1239477 from network:ldap
- Drop build dependency on ncsd, which has been deprecated
  (boo#1239262).
- Migrate away from update-alternatives, replaced by package
  conflicts; (bsc#1235789); (bsc#1216739);

OBS-URL: https://build.opensuse.org/request/show/1239477
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/sssd?expand=0&rev=142
2025-01-24 12:39:42 +00:00
OBS User unknown
48f8d04c60 [info=24b0354b14a71a7f013d2f8aed5051f5418b44f1879804a1f4fd45fd4d790c6e]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=338
2025-01-22 10:13:31 +00:00
OBS User unknown
4689a7b2db [info=660ade3bb1e5650f8b379a95197017216f506e85d72c0b139b39a31cc7cc911a]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=337
2025-01-22 10:09:51 +00:00
OBS User unknown
be6a8acd73 [info=e6e6fdcbb8c81ae2cfdf1e19038a61c6014ac6a56c4c37eacfaa19f7abca3eda]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=336
2025-01-22 09:47:29 +00:00
9647d5a334 Accepting request 1236927 from network:ldap
- Update to release 2.10.1

OBS-URL: https://build.opensuse.org/request/show/1236927
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/sssd?expand=0&rev=141
2025-01-12 10:13:57 +00:00
OBS User unknown
dcf4f635d5 [info=e9bed7037d80b1a2f8f6599da3e1d34aee9e5b250cf5642ba8f8e1c6ea438517]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=335
2025-01-10 19:53:36 +00:00
OBS User unknown
27948d90b8 [info=090bf5ef3094f02956c446012780493e69a1b75e976ce71b74cea81b1eb77897]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=334
2025-01-09 17:30:57 +00:00
OBS User unknown
86e7668f30 [info=cd05c14a49b9600916b3ace67564befd817f17fbbae208a2197db413e82a7560]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=333
2025-01-02 17:58:20 +00:00
OBS User unknown
1d71044539 [info=1507d9a0944d5e4561b50f5711c11410c6102db2357375f84d4e99c977e11c66]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=332
2024-12-20 08:21:11 +00:00
OBS User unknown
b3c6ba7ae5 [info=7a9befa6936272129afd7622722b7d44d87bdf6afa02bc7b21a6ccfd037903cc]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=331
2024-12-11 09:35:15 +00:00
bbfc610706 [info=6e6893108add570a0ec8a1cc983e87b11279bc98ee96e4f1af76ab397f1d0074]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=330
2024-11-27 10:12:37 +00:00
be0ba00c3b [info=8faca55b4aa3e3e74cbabb4b015f0b7beb4b2f1dd7b98a27b382d43be057f672]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=329
2024-11-25 09:06:26 +00:00
OBS User unknown
4565465470 [info=6e6893108add570a0ec8a1cc983e87b11279bc98ee96e4f1af76ab397f1d0074]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=328
2024-11-05 21:15:20 +00:00
OBS User unknown
55c982ab57 [info=0823836080bc76a2066070591bd0d13645c7446aa3ca664b9eb5b179699ab1b2]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=327
2024-11-05 21:03:40 +00:00
OBS User unknown
3709f0e766 [info=066c89155b2a5ef4e5f760515c1e3c2b976cc40e9d509583f3f58f219f61cbb9]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=326
2024-11-05 19:42:35 +00:00
OBS User unknown
0f06ed9ea8 [info=64fc4926abddde94cb6c33f85efec71de27adfb4c0ffab87972e4dc00bfef5d1]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=325
2024-11-05 18:20:03 +00:00
OBS User unknown
f86392c7a5 [info=4c1a7e3419ae2a9fd5571c543bf337898b158276112c19e299f4f385b5bedaf8]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=324
2024-11-05 18:00:20 +00:00
OBS User unknown
bdd89bc6f3 [info=d236d87ed89f720f7cdd75ceb8eee5ce72b6fa3d8878dd5e16de8962d581542b]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=323
2024-10-16 16:33:51 +00:00
OBS User unknown
3a117daca5 [info=03cfa0ca67c32d9aa59b740572efe4b06c350b3529fdc9dd7d46e7501d8cd398]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=322
2024-10-16 16:29:57 +00:00
d86b0e6701 Accepting request 1207137 from network:ldap
Please stage together with:
#1206308
#1206309

OBS-URL: https://build.opensuse.org/request/show/1207137
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/sssd?expand=0&rev=140
2024-10-13 15:33:26 +00:00
OBS User unknown
fbb9662fbc [info=3a2bee3ebf6e89af81880d7927649117d782a0ba9f98f06213bb4744f044b7fb]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=321
2024-10-01 10:25:27 +00:00
OBS User unknown
d7d2d5b065 [info=73fb2a82f612a286176bd085d3250101f93e35e8d95604062552e3d66d837c69]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=320
2024-09-25 20:30:52 +00:00
OBS User unknown
4b55e8bec3 [info=4ccb2378cf598025ed7140843f9027c7d6380bb9bd3e3c93331dab8f27d8db43]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=319
2024-09-25 20:16:22 +00:00
2a837063b4 [info=bf358d8fff9cbe6e4d724686e14b1ba2f74e5be0130abd0c1aec853471ca572e]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=318
2024-07-18 03:02:07 +00:00
4ba4938fe8 Accepting request 1187905 from network:ldap
- Revert the change dropping the default configuration file. If
  /usr/etc exists will be installed there, otherwise in /etc.
  (bsc#1226157);

OBS-URL: https://build.opensuse.org/request/show/1187905
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/sssd?expand=0&rev=139
2024-07-17 13:14:17 +00:00
OBS User unknown
3fd3832981 [info=bf358d8fff9cbe6e4d724686e14b1ba2f74e5be0130abd0c1aec853471ca572e]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=317
2024-07-17 12:08:46 +00:00
75c9ecde1e [info=747483e6173b31472d61e166a581bb9c9034cf6a690a8bc476176dd5b5befaba]
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=316
2024-07-16 11:11:31 +00:00
8ef9d54958 feed through formatter, use more widely used ?expr:1
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=315
2024-07-16 11:04:35 +00:00
fd5a3e89d6 Accepting request 1187794 from home:scabrero:sssd-conf
- Revert the change dropping the default configuration file. If
  /usr/etc exists will be installed there, otherwise in /etc.
  (bsc#1226157);

OBS-URL: https://build.opensuse.org/request/show/1187794
OBS-URL: https://build.opensuse.org/package/show/network:ldap/sssd?expand=0&rev=314
2024-07-16 10:57:44 +00:00
11 changed files with 182 additions and 85 deletions

4
_scmsync.obsinfo Normal file
View File

@@ -0,0 +1,4 @@
mtime: 1753994117
commit: 0e0d1361c8452d81d3f95f3e2e6ee1170e16356d1e2c4145af472ea204b6b873
url: https://src.opensuse.org/jengelh/sssd
revision: master

3
build.specials.obscpio Normal file
View File

@@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:a31e4d0a5d8f6b3d45219c049e9bb6f29dc8d630ca5dbc7f9e4e89be2ae35fa2
size 256

View File

@@ -2,10 +2,10 @@
src/sysv/systemd/sssd-kcm.service.in | 13 +++++++++++++
1 file changed, 13 insertions(+)
Index: sssd-2.10.0/src/sysv/systemd/sssd-kcm.service.in
Index: sssd-2.10.2/src/sysv/systemd/sssd-kcm.service.in
===================================================================
--- sssd-2.10.0.orig/src/sysv/systemd/sssd-kcm.service.in
+++ sssd-2.10.0/src/sysv/systemd/sssd-kcm.service.in
--- sssd-2.10.2.orig/src/sysv/systemd/sssd-kcm.service.in
+++ sssd-2.10.2/src/sysv/systemd/sssd-kcm.service.in
@@ -8,6 +8,19 @@ After=sssd-kcm.socket
Also=sssd-kcm.socket
@@ -24,5 +24,5 @@ Index: sssd-2.10.0/src/sysv/systemd/sssd-kcm.service.in
+RestrictRealtime=true
+# end of automatic additions
Environment=DEBUG_LOGGER=--logger=files
ExecStartPre=+-/bin/chown -f -R root:@SSSD_USER@ @sssdconfdir@
ExecStartPre=+-/bin/chmod -f -R g+r @sssdconfdir@
# '-H' is used with @sssdconfdir@ to support use case where /etc/sssd is a symlink.
# '-H' only allows following a command line argument itself, everything else encountered due to '-R' isn't followed.

48
logrotate.patch Normal file
View File

@@ -0,0 +1,48 @@
From: Jan Engelhardt <ej@inai.de>
Date: 2025-07-18 11:02:24.078457348 +0200
References: https://bugzilla.suse.com/show_bug.cgi?id=1246537
References: https://github.com/SSSD/sssd/issues/8041
---
src/examples/logrotate.in | 3 +--
src/sysv/systemd/sssd-kcm.service.in | 1 +
src/sysv/systemd/sssd.service.in | 1 +
3 files changed, 3 insertions(+), 2 deletions(-)
Index: sssd-2.11.1/src/examples/logrotate.in
===================================================================
--- sssd-2.11.1.orig/src/examples/logrotate.in
+++ sssd-2.11.1/src/examples/logrotate.in
@@ -8,7 +8,6 @@
delaycompress
su @SSSD_USER@ @SSSD_USER@
postrotate
- /bin/kill -HUP `cat @pidpath@/sssd.pid 2>/dev/null` 2> /dev/null || true
- /bin/pkill -HUP sssd_kcm 2> /dev/null || true
+ /usr/bin/systemctl try-reload-or-restart sssd sssd_kcm
endscript
}
Index: sssd-2.11.1/src/sysv/systemd/sssd-kcm.service.in
===================================================================
--- sssd-2.11.1.orig/src/sysv/systemd/sssd-kcm.service.in
+++ sssd-2.11.1/src/sysv/systemd/sssd-kcm.service.in
@@ -32,6 +32,7 @@ ExecStartPre=+-/bin/chmod -f g+x @sssdco
ExecStartPre=+-/bin/sh -c "/bin/chown -f -h @SSSD_USER@:@SSSD_USER@ @secdbpath@/*.ldb"
ExecStartPre=+-/bin/sh -c "/bin/chown -f -h @SSSD_USER@:@SSSD_USER@ @logpath@/sssd_kcm.log*"
ExecStart=@libexecdir@/sssd/sssd_kcm ${DEBUG_LOGGER}
+ExecReload=kill -HUP $MAINPID
CapabilityBoundingSet= CAP_DAC_READ_SEARCH CAP_SETGID CAP_SETUID
SecureBits=noroot noroot-locked
User=@SSSD_USER@
Index: sssd-2.11.1/src/sysv/systemd/sssd.service.in
===================================================================
--- sssd-2.11.1.orig/src/sysv/systemd/sssd.service.in
+++ sssd-2.11.1/src/sysv/systemd/sssd.service.in
@@ -21,6 +21,7 @@ ExecStartPre=+-/bin/sh -c "/bin/chown -f
ExecStartPre=+-/bin/chown -f -R -h @SSSD_USER@:@SSSD_USER@ @gpocachepath@
ExecStartPre=+-/bin/sh -c "/bin/chown -f -h @SSSD_USER@:@SSSD_USER@ @logpath@/*.log*"
ExecStart=@sbindir@/sssd -i ${DEBUG_LOGGER}
+ExecReload=kill -HUP $MAINPID
Type=notify
NotifyAccess=main
Restart=on-abnormal

BIN
sssd-2.10.1.tar.gz (Stored with Git LFS)

Binary file not shown.

View File

@@ -1,16 +0,0 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEwTzQf/stsUCORXo809IbKRDPZ1kFAmdYSb4ACgkQ09IbKRDP
Z1kRyRAAmkKhCUcBs4h2mDg7uzz7DfYFkHXEiY8EMoVP5Iw6ZsNL/V9fwF9xhj49
XbnCfxj2zFfVWZd5VYnTpl86Hg3NrxuPehgM+iMAXS6U/55TvRPunCtTiRwoTZ4t
zSgiBaSg3I2hmSN2cnSU8PpilEDCIeSP3uafmGXI1KUxEQltVbp0EeJ5CL5GP3xU
rFgI1pKdTySlw6jZ3vjkAaHwdsJGB0MKtjiBJYtqvHmIzbUdSNN/iE5Wf5xsdtez
KKLUrnKeQFuNyYWpjipJvbs7i9+E5VKFvCfrqFb6vQbp+Rgd98epVjp2VKovNy8p
gZQmgfbi5GCWKuBx+dbaRSFa8hWemEwnBNboV6JKq4+CoPsMkI367utZV5gd58V5
RHgLsrZfjahAXgG4ytwPhgKDV+sX+sSn4aXIdaSgc+vP7+ykLMxyzyR2GXyG+y11
WrnovdR0HywHfzvlUnKQmcLUjCkXKVwIMw0oBRa8+YLTD08EeYgu+oXXDpGD0oL1
YJLLBdr6ycR9Rk/sUqbZgEnzQZPYXazIraUrd71Ry8CaNvqi86Of7sX6SgSQQeg/
ZPLNcPWPadG/9jpMNJNsXXEZicNJXznQczlXKvRXINOJzknJYwwgH+/55otbzNzq
EjlOmFEn07bGAHCsHTfydlCeYqD9x+WV/X8CReMFjcaaBH4TDms=
=S0c5
-----END PGP SIGNATURE-----

BIN
sssd-2.11.1.tar.gz (Stored with Git LFS) Normal file

Binary file not shown.

16
sssd-2.11.1.tar.gz.asc Normal file
View File

@@ -0,0 +1,16 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEwTzQf/stsUCORXo809IbKRDPZ1kFAmiLT74ACgkQ09IbKRDP
Z1nIIQ/+NjryrInjiH9LmBZKa5wgYE8d49aHxtOc4pySV3CFhVMM0cUT0rO1umy3
+4xlvxDs/7OYdZkJapotcpf8CJDyLttxsA4/0gfBDGoCRsRLAXxnoZ9K7+0PgV5j
2DbB6+0Ay0JJ9IYjJwoIMbSKiWm2/KuqLBicNoaxvYK/OJc/K+3AkPIyqVmOItl8
23UOMuMn6NRBJP6m0R+LUEJQ4rW6cej1lc+mqsPYlerHY8BmRFzRcFjVqhsgUpQj
hCTJwq5iUpbhiyDIpYzGeS5Jr0bxAVeAZbo4YcN2GQVawOjLQYOP7UPWFm80JLbQ
GEvQHHo2YDBxcZEma6Z614/8aQI6nVzc/DMq3ffPb4E5snMJ+/v9LCGN1jjmCPWo
TSiYZrt33zeJrmsmnImWT4ejErkt7dLV9qOQS6BTjHGtgNgl4qrbiFLSZZk2oJp6
1eJERF/uqBmBYJ2Bq7Fq0Gp4u90TK6kgLV8pkz71Tl+BUPjoD8H9b6VMrwY0jiux
FfE9ZjWDDAlaLqRlbpd6lVHiQfkgCUflw7o5E+jSL96S4X+6e1aCcL3vdkLxFSCa
PCQggDD+Ng2HvNsqQ8Z1eA0k2wNuYUNLKab2eUcc4siIKmoMsPQkgmLUBINiPMyR
GR6ZQ6xdiQkBFBC+JplQM5AsVddJ7UZ2DCzUzFkriyqua58Cuyo=
=DoFI
-----END PGP SIGNATURE-----

2
sssd-rpmlintrc Normal file
View File

@@ -0,0 +1,2 @@
# See https://github.com/SSSD/sssd/pull/7794 for details
addFilter("E: missing-call-to-setgroups-before-setuid")

View File

@@ -1,3 +1,58 @@
-------------------------------------------------------------------
Thu Jul 31 16:15:46 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
- Update to release 2.11.1
* Fixed AD users in external groups not being cleared once the
cache expires.
* Fixed `cache_credentials=true` not having any effect.
* Fixed socket activation not having an effect for sssd_pam.
-------------------------------------------------------------------
Fri Jul 18 09:03:19 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
- Add logrotate.patch [boo#1246537]
-------------------------------------------------------------------
Wed Jun 11 14:53:26 UTC 2025 - Samuel Cabrero <scabrero@suse.de>
- Install file in krb5.conf.d to include sssd krb5 config snippets;
(bsc#1244325);
-------------------------------------------------------------------
Thu Jun 5 12:14:03 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
- Update to release 2.11
* The deprecated tool `sss_ssh_knownhostsproxy` was finally
removed.
* Support for `id_provider = files` was removed.
* SSSD doesn't create any more missing path components of
DIR:/FILE: ccache types while acquiring user's TGT.
* New generic id and auth provider for Identity Providers (IdPs)
for Keycloak/EntraID. [Not enabled in openSUSE for now.]
-------------------------------------------------------------------
Tue Mar 11 21:35:32 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
- Run mkdir/rm with verbose mode for the build log
-------------------------------------------------------------------
Thu Jan 30 14:24:04 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
- Update to release 2.10.2
* If the ssh responder is not running, sss_ssh_knownhosts will
not fail (but it will not return the keys).
* SSSD is now capable of handling multiple services associated
with the same port.
* sssd_pam, being a privileged binary, now clears the
environment and does not allow configuration of the
PR_SET_DUMPABLE flag as a precaution.
-------------------------------------------------------------------
Wed Jan 22 09:21:43 UTC 2025 - Dominique Leuenberger <dimstar@opensuse.org>
- Drop build dependency on ncsd, which has been deprecated
(boo#1239262).
-------------------------------------------------------------------
Tue Jan 21 16:33:00 UTC 2025 - Samuel Cabrero <scabrero@suse.de>
@@ -1874,7 +1929,6 @@ Wed Apr 4 16:13:33 PDT 2012 - ben.kevan@gmail.com
connect to an auth server
-------------------------------------------------------------------
Sun Mar 11 18:36:44 UTC 2012 - jengelh@medozas.de
- Update to new upstream release 1.8.0

106
sssd.spec
View File

@@ -17,7 +17,7 @@
Name: sssd
Version: 2.10.1
Version: 2.11.1
Release: 0
Summary: System Security Services Daemon
License: GPL-3.0-or-later AND LGPL-3.0-or-later
@@ -28,11 +28,13 @@ Source: https://github.com/SSSD/sssd/releases/download/%version/%name-%v
Source2: https://github.com/SSSD/sssd/releases/download/%version/%name-%version.tar.gz.asc
Source3: baselibs.conf
Source5: %name.keyring
Source6: %name-rpmlintrc
Patch1: 0001-TOOL-Fix-build-parameter-name-omitted.patch
Patch11: krb-noversion.diff
Patch12: harden_sssd-ifp.service.patch
Patch13: harden_sssd-kcm.service.patch
Patch14: symvers.patch
Patch15: logrotate.patch
BuildRequires: autoconf >= 2.59
BuildRequires: automake
BuildRequires: bind-utils
@@ -50,7 +52,6 @@ BuildRequires: libunistring-devel
BuildRequires: libxml2-tools
BuildRequires: libxslt-tools
BuildRequires: libopenssl-3-devel
BuildRequires: nscd
BuildRequires: nss_wrapper
BuildRequires: openldap2-devel
BuildRequires: pam-devel
@@ -89,6 +90,7 @@ BuildRequires: pkgconfig(p11-kit-1) >= 0.23.3
BuildRequires: pkgconfig(popt)
BuildRequires: pkgconfig(python3)
BuildRequires: pkgconfig(smbclient)
BuildRequires: pkgconfig(systemd)
BuildRequires: pkgconfig(talloc)
BuildRequires: pkgconfig(tdb) >= 1.1.3
BuildRequires: pkgconfig(tevent)
@@ -130,10 +132,6 @@ Obsoletes: sssd-common < %version-%release
%define permissions_path %_sysconfdir/permissions.d/
%endif
# Both SSSD and cifs-utils provide an idmap plugin for cifs.ko
# %%_sysconfdir/cifs-utils/idmap-plugin should be a symlink to one of the 2 idmap plugins,
# cifs-utils or sssd. The plugins are individually packaged and conflicts with each other
# (https://bugzilla.suse.com/show_bug.cgi?id=1235789).
%define cifs_idmap_plugin %_sysconfdir/cifs-utils/idmap-plugin
%define cifs_idmap_lib %_libdir/cifs-utils/cifs_idmap_sss.so
@@ -252,13 +250,19 @@ UIDs/GIDs and SIDs.
%package cifs-idmap-plugin
Summary: The sssd idmap plugin for cifs.idmap
Group: System/Libraries
# Conflict as per https://bugzilla.suse.com/1235789
Provides: cifs-idmap-plugin
Conflicts: cifs-idmap-plugin
%description cifs-idmap-plugin
The cifs.idmap(8) userspace helper relies on a plugin to handle the ID mapping.
This package contains the sssd ID mapping plugin.
The cifs.idmap(8) userspace helper relies on a plugin to handle the
ID mapping. This package contains the ID mapping plugin that will use
sssd.
In SUSE systems, only one such plugin can be installed at a time
(either the one from sssd, or from cifs-utils).
Without the plugin, file objects in a mounted share have UID/GID of
the original mounting process.
%package -n libsss_certmap0
Summary: FreeIPA ID mapping library
@@ -415,9 +419,6 @@ Security Services Daemon (sssd).
%autosetup -p1
%build
# help configure find nscd
export PATH="$PATH:/usr/sbin"
autoreconf -fiv
%configure \
--with-db-path="%dbpath" \
@@ -440,8 +441,7 @@ autoreconf -fiv
--with-subid
%else
--with-selinux=no \
--with-libsifp \
--with-files-provider
--with-libsifp
%endif
%make_build all
@@ -453,26 +453,26 @@ b="%buildroot"
# Copy some defaults
%if "%{?_distconfdir}" != ""
install -D -p -m 0600 src/examples/sssd-example.conf "$b/%_distconfdir/sssd/sssd.conf"
install -d -m 0755 "$b/%_distconfdir/sssd/conf.d"
install -Dpvm 0600 src/examples/sssd-example.conf "$b/%_distconfdir/sssd/sssd.conf"
install -dvm 0755 "$b/%_distconfdir/sssd/conf.d"
%else
install -D -p -m 0600 src/examples/sssd-example.conf "$b/%_sysconfdir/sssd/sssd.conf"
install -d -m 0755 "$b/%_sysconfdir/sssd/conf.d"
install -Dpm 0600 src/examples/sssd-example.conf "$b/%_sysconfdir/sssd/sssd.conf"
install -dvm 0755 "$b/%_sysconfdir/sssd/conf.d"
%endif
install -d "$b/%_unitdir"
install -dv "$b/%_unitdir"
%if 0%{?suse_version} > 1500
install -d "$b/%_distconfdir/logrotate.d"
install -m644 src/examples/logrotate "$b/%_distconfdir/logrotate.d/sssd"
install -d "$b/%_pam_vendordir"
install -dv "$b/%_distconfdir/logrotate.d"
install -vm644 src/examples/logrotate "$b/%_distconfdir/logrotate.d/sssd"
install -dv "$b/%_pam_vendordir"
mv "$b/%_pam_confdir/sssd-shadowutils" "$b/%_pam_vendordir"
%else
install -d "$b/%_sysconfdir/logrotate.d"
install -m644 src/examples/logrotate "$b/%_sysconfdir/logrotate.d/sssd"
install -dv "$b/%_sysconfdir/logrotate.d"
install -vm644 src/examples/logrotate "$b/%_sysconfdir/logrotate.d/sssd"
%endif
rm -Rfv "$b/%_initddir"
%if 0%{?suse_version} < 1600
ln -s service "$b/%_sbindir/rcsssd"
ln -sv service "$b/%_sbindir/rcsssd"
%endif
mkdir -pv "$b/%sssdstatedir/mc"
@@ -480,8 +480,8 @@ find "$b" -type f -name "*.la" -print -delete
%find_lang %name --all-name
# dummy target for cifs-idmap-plugin
mkdir -p %{buildroot}%{_sysconfdir}/cifs-utils
ln -s -f %{cifs_idmap_lib} %{buildroot}%{cifs_idmap_plugin}
mkdir -pv %buildroot/%_sysconfdir/cifs-utils
ln -sfv %cifs_idmap_lib %buildroot/%cifs_idmap_plugin
%python3_fix_shebang
%if 0%{?suse_version} > 1600
@@ -492,16 +492,16 @@ sed -i '1s@#!.*python.*@#!%_bindir/python3.11@' "$b/%_libexecdir/%name/sss_analy
%endif
echo 'u sssd - "System Security Services Daemon" /run/sssd /sbin/nologin' >system-user-sssd.conf
mkdir -p "$b/%_sysusersdir"
cp -a system-user-sssd.conf "$b/%_sysusersdir/"
mkdir -pv "$b/%_sysusersdir"
cp -av system-user-sssd.conf "$b/%_sysusersdir/"
%sysusers_generate_pre system-user-sssd.conf random system-user-sssd.conf
install -Dpm 0644 contrib/sssd-tmpfiles.conf "%buildroot/%_tmpfilesdir/%name.conf"
install -Dpvm 0644 contrib/sssd-tmpfiles.conf "%buildroot/%_tmpfilesdir/%name.conf"
#
# Security considerations for capabilities, chown and stuff:
# https://www.openwall.com/lists/oss-security/2024/12/19/1
#
# should match entry from %%files list
mkdir -p "$b/%permissions_path"
mkdir -pv "$b/%permissions_path"
cat >"$b/%permissions_path/sssd" <<-EOF
%_libexecdir/sssd/sssd_pam root:sssd 0750
+capabilities cap_dac_read_search=p
@@ -513,6 +513,10 @@ cat >"$b/%permissions_path/sssd" <<-EOF
+capabilities cap_dac_read_search=p
EOF
mkdir -pv "$b/%_sysconfdir/krb5.conf.d"
ln -sv %_datadir/%name/krb5-snippets/enable_sssd_conf_dir \
"$b/%_sysconfdir/krb5.conf.d/enable_sssd_conf_dir"
%check
# sss_config-tests fails
%make_build check || :
@@ -671,12 +675,8 @@ fi
%_mandir/??/man1/sss_ssh_*
%_mandir/??/man5/sss-certmap.5*
%_mandir/??/man5/sssd-ad.5*
%if 0%{?suse_version} < 1600
%_mandir/??/man5/sssd-files.5*
%endif
%_mandir/??/man5/sssd-ldap-attributes.5*
%_mandir/??/man5/sssd-session-recording.5*
%_mandir/??/man5/sssd-simple.5*
%_mandir/??/man5/sssd-sudo.5*
%_mandir/??/man5/sssd-systemtap.5*
%_mandir/??/man5/sssd.conf.5*
@@ -684,9 +684,6 @@ fi
%_mandir/??/man8/sssd.8*
%_mandir/man1/sss_ssh_*
%_mandir/man5/sss-certmap.5*
%if 0%{?suse_version} < 1600
%_mandir/man5/sssd-files.5*
%endif
%_mandir/man5/sssd-ldap-attributes.5*
%_mandir/man5/sssd-session-recording.5*
%_mandir/man5/sssd-simple.5*
@@ -700,9 +697,6 @@ fi
%_libdir/%name/libsss_cert*
%_libdir/%name/libsss_crypt*
%_libdir/%name/libsss_debug*
%if 0%{?suse_version} < 1600
%_libdir/%name/libsss_files*
%endif
%_libdir/%name/libsss_iface*
%_libdir/%name/libsss_sbus*
%_libdir/%name/libsss_simple*
@@ -729,7 +723,6 @@ fi
%attr(755,%sssd_user,%sssd_user) %dir %pipepath/
%attr(700,%sssd_user,%sssd_user) %dir %pipepath/private/
%attr(755,%sssd_user,%sssd_user) %dir %pubconfpath/
%attr(755,%sssd_user,%sssd_user) %dir %pubconfpath/krb5.include.d
%attr(755,%sssd_user,%sssd_user) %dir %gpocachepath/
%attr(755,%sssd_user,%sssd_user) %dir %mcpath/
%attr(700,%sssd_user,%sssd_user) %dir %keytabdir/
@@ -756,22 +749,16 @@ fi
%_datadir/%name/sssd.api.conf
%dir %_datadir/%name/sssd.api.d/
%_datadir/%name/sssd.api.d/sssd-simple.conf
%if 0%{?suse_version} < 1600
%_datadir/%name/sssd.api.d/sssd-files.conf
%else
%exclude %_mandir/*/*/sssd-files.5.gz
%endif
%attr(775,%sssd_user,%sssd_user) %ghost %dir %_rundir/sssd
%doc src/examples/sssd.conf
#
# sssd-client
# %%files sssd-client
#
%_libdir/libnss_sss.so.2
%_pam_moduledir/pam_sss.so
%_pam_moduledir/pam_sss_gss.so
%_libdir/krb5/
%_libdir/%name/modules/sssd_krb5_localauth_plugin.so
%exclude %_libdir/%name/modules/sssd_krb5_idp_plugin.so
%if 0%{?suse_version} >= 1600
%_libdir/libsubid_sss.so
%endif
@@ -783,7 +770,12 @@ fi
%_mandir/man8/sssd_krb5_localauth_plugin.8*
%_mandir/??/man8/sssd_krb5_localauth_plugin.8*
%_mandir/man8/sssd_krb5_locator_plugin.8*
#
# %%files sssd-idp
#
%exclude %_libdir/sssd/libsss_idp.so
%exclude %_libdir/%name/modules/sssd_krb5_idp_plugin.so
%exclude %_mandir/man5/sssd-idp*
%files ad
%dir %_libdir/%name/
@@ -834,7 +826,6 @@ fi
%dir %_libdir/%name/
%_libdir/%name/libsss_krb5.so
%dir %_datadir/%name/
%exclude %_datadir/%name/krb5-snippets/
%dir %_datadir/%name/sssd.api.d/
%_datadir/%name/sssd.api.d/sssd-krb5.conf
%dir %_mandir/??/
@@ -843,11 +834,16 @@ fi
%_mandir/??/man5/sssd-krb5.5*
%files krb5-common
%attr(755,root,root) %dir %pubconfpath/krb5.include.d
%config(noreplace,missingok) %{_sysconfdir}/krb5.conf.d/enable_sssd_conf_dir
%dir %_libdir/%name/
%_libdir/%name/libsss_krb5_common.so
%dir %_libexecdir/%name/
%attr(750,root,%sssd_user) %caps(cap_dac_read_search,cap_setgid,cap_setuid=p) %_libexecdir/%name/krb5_child
%attr(750,root,%sssd_user) %caps(cap_dac_read_search=p) %_libexecdir/%name/ldap_child
%dir %{_datadir}/sssd/krb5-snippets
%_datadir/%name/krb5-snippets/enable_sssd_conf_dir
%_datadir/%name/krb5-snippets/sssd_enable_idp
%files ldap
%dir %_libdir/%name/
@@ -933,16 +929,6 @@ fi
%_libdir/libsss_nss_idmap.so
%_libdir/pkgconfig/sss_nss_idmap.pc
%if 0%{?suse_version} < 1600
%files -n libsss_simpleifp0
%_libdir/libsss_simpleifp.so.0*
%files -n libsss_simpleifp-devel
%_includedir/sss_sifp*.h
%_libdir/libsss_simpleifp.so
%_libdir/pkgconfig/sss_simpleifp.pc
%endif
%files -n python3-ipa_hbac
%dir %python3_sitearch
%python3_sitearch/pyhbac.so