Attachment #216461 for bug #238465




# Created by: Lukas Slebodnik <lukas.slebodnik@intrak.sk>
# $FreeBSD: head/security/sssd/Makefile 505782 2019-07-03 19:30:03Z antoine $

PORTNAME=	sssd
PORTVERSION=	1.13.4
PORTREVISION=	20
CATEGORIES=	security
MASTER_SITES=	https://releases.pagure.org/SSSD/${PORTNAME}/


LICENSE=	GPLv3+
LICENSE_FILE=	${WRKSRC}/COPYING

DEPRECATED=	Uses deprecated version of python
EXPIRATION_DATE=	2020-09-15

LIB_DEPENDS=	libpopt.so:devel/popt \
		libtalloc.so:devel/talloc \
		libtevent.so:devel/tevent \

		nsupdate:dns/bind-tools

USES=		autoreconf cpe gettext gmake iconv libtool pathfix pkgconfig \
		shebangfix gssapi:mit

USE_LDCONFIG=	yes
USE_OPENLDAP=	yes

GNU_CONFIGURE=	yes
CONFIGURE_ARGS=	--with-selinux=no --with-semanage=no \
		--with-ldb-lib-dir=${LOCALBASE}/lib/shared-modules/ldb \

		--with-libnl=no --with-init-dir=no --datadir=${DATADIR} \
		--docdir=${DOCSDIR} --with-pid-path=/var/run \
		--localstatedir=/var --enable-pammoddir=${PREFIX}/lib \
		--with-db-path=/var/db/sss/db \
		--with-gpo-cache-path=/var/db/sss/gpo_cache \
		--with-pipe-path=/var/run/sss \
		--with-pubconf-path=/var/run/sss --with-mcache-path=/var/db/sss/mc \
		--with-unicode-lib=libunistring --with-autofs=no \
		--disable-cifs-idmap-plugin --disable-config-lib \
		--with-krb5-conf=/etc/krb5.conf
# TODO: investigate possible sssd/nfsuserd compatibility
CONFIGURE_ARGS+=	--without-nfsv4-idmapd-plugin
CFLAGS+=	-fstack-protector-all
# add __STDC_WANT_LIB_EXT1__ - see https://stackoverflow.com/questions/24206989/error-use-of-undeclared-identifier-errno-t
#CPPFLAGS+=	-D__STDC_WANT_LIB_EXT1__
#DEBUG_FLAGS=	-g
MAKE_ENV+=	LINGUAS="bg de eu es fr hu id it ja nb nl pl pt ru sv tg tr uk zh_CN zh_TW"
SUB_FILES=	pkg-message

USE_LDCONFIG=	yes
USE_OPENLDAP=	yes
INSTALL_TARGET=	install-strip
CPE_VENDOR=	fedoraproject


USE_RC_SUBR=	${PORTNAME}
PORTDATA=	*

OPTIONS_DEFINE=		DOCS SMB
OPTIONS_DEFAULT=	PYTHON3
OPTIONS_RADIO=		PYTHON
OPTIONS_RADIO_PYTHON=	PYTHON2 PYTHON3
OPTIONS_SUB=	yes

PYTHON2_CONFIGURE_WITH=	python2-bindings
PYTHON2_USES=	python:2.7
PYTHON2_VARS=	PYTHON2_CMD=${PYTHON_CMD:T} PYTHON3_CMD=
PYTHON3_CONFIGURE_WITH=	python3-bindings
PYTHON3_USES=	python:3.5+
PYTHON3_VARS=	PYTHON2_CMD= PYTHON3_CMD=${PYTHON_CMD:T}

PLIST_SUB+=	PORTVERSION=${PORTVERSION} \
	PYTHONPREFIX_SITELIBDIR=${PYTHONPREFIX_SITELIBDIR} \
	PYTHON_VER=${PYTHON_VER}

SMB_DESC=		Install IPA and AD providers (requires Samba4)
SMB_USES=		samba:lib # libndr-krb5pac libndr-nbt libndr libsamba-util
SMB_CONFIGURE_WITH=	samba
# PAC (Privilege Attribute Certificate) responder currently needs samba
SMB_CONFIGURE_ENABLE=	pac-responder

post-patch:
	@${REINPLACE_CMD} -e 's|SIGCLD|SIGCHLD|g' ${WRKSRC}/src/util/signal.c

	@${REINPLACE_CMD} -e 's|/etc/sssd/|${ETCDIR}/|g' \
		-e 's|/etc/openldap/|${LOCALBASE}/etc/openldap/|g' \
		${WRKSRC}/src/man/*xml
	@${REINPLACE_CMD} 's|%%PYTHON2_CMD%%|${PYTHON2_CMD}|g; \
		s|%%PYTHON3_CMD%%|${PYTHON3_CMD}|g' \
		${WRKSRC}/configure.ac
	@${CP} ${FILESDIR}/bsdnss.c ${WRKSRC}/src/sss_client/bsdnss.c
	@${CP} ${FILESDIR}/sss_bsd_errno.h ${WRKSRC}/src/util/sss_bsd_errno.h


	${INSTALL_DATA} ${WRKSRC}/src/examples/sssd-example.conf \
		${STAGEDIR}${ETCDIR}/sssd.conf.sample
	${LN} -sf nss_sss.so ${STAGEDIR}${PREFIX}/lib/nss_sss.so.1
# clean these up from the install; we create them in rc script start_precmd
.for d in db/sss db/sss_mc log/sssd run/sss/krb5.include.d run/sss/private run/sss
	@${RMDIR} ${STAGEDIR}/var/${d}
.endfor
# clean unused man dirs
.for i in nl/man1 nl/man5 pt/man1 pt/man5
	@${RMDIR} ${STAGEDIR}${PREFIX}/man/${i}
.endfor

.include <bsd.port.options.mk>

.if empty(PORT_OPTIONS:MPYTHON2) && empty(PORT_OPTIONS:MPYTHON3)
PLIST_SUB+=	PYTHON="@comment "
USES+=		python:3.5+,build
.else
PLIST_SUB+=	PYTHON=
.endif

.include <bsd.port.mk>

Lines 1-2 Link Here

(-)security/sssd/distinfo (-2 / +5 lines)
1	SHA256 (sssd-1.11.7.tar.gz) = ff12d5730a6d7d08fe11140aa58e544900b75c63902b7a07bbbc12d6a99cb5b5	1	TIMESTAMP = 1560523527
2	SIZE (sssd-1.11.7.tar.gz) = 3661227	2	SHA256 (sssd-1.13.4.tar.gz) = 0a7bba7697088734c5fa1844dbb6de4f1f11afd30df02f0c1dd2579114c0a194
		3	SIZE (sssd-1.13.4.tar.gz) = 4730392
		4	SHA256 (sssd-1.13.4.tar.gz.asc) = adf1ebfd023079092748f4998e4d8476014ee78f30ce59e0a464f841aef79afa
		5	SIZE (sssd-1.13.4.tar.gz.asc) = 181




--- Makefile.am.orig	2019-04-13 14:48:41 UTC
+++ Makefile.am
@@ -54,7 +54,7 @@ sssddatadir = $(datadir)/sssd
 sssdapiplugindir = $(sssddatadir)/sssd.api.d
 dbuspolicydir = $(sysconfdir)/dbus-1/system.d
 dbusservicedir = $(datadir)/dbus-1/system-services
-sss_statedir = $(localstatedir)/lib/sss
+sss_statedir = $(localstatedir)/db/sss
 localedir = @localedir@
 nsslibdir = @nsslibdir@
 pamlibdir = @pammoddir@
@@ -96,6 +96,9 @@
                  -fno-strict-aliasing \
                  -std=gnu99
 endif
+if HAVE_ERRNO_T
+    AM_CFLAGS += -D__STDC_WANT_LIB_EXT1__
+endif

 pkgconfig_DATA =

@@ -427,6 +427,7 @@ AM_CPPFLAGS = \
     $(OPENLDAP_CFLAGS) \
     $(GLIB2_CFLAGS) \
     $(JOURNALD_CFLAGS) \
+    -DHOST_NAME_MAX=_POSIX_HOST_NAME_MAX \
     -DLIBDIR=\"$(libdir)\" \
     -DVARDIR=\"$(localstatedir)\" \
     -DSSS_STATEDIR=\"$(sss_statedir)\" \
@@ -497,6 +498,7 @@ SSSD_LIBS = \
     $(COLLECTION_LIBS) \
     $(DHASH_LIBS) \
     $(SSS_CRYPT_LIBS) \
     $(OPENLDAP_LIBS) \
+    $(LTLIBINTL) \
     $(TDB_LIBS)
 
 PYTHON_BINDINGS_LIBS = \
@@ -546,6 +548,7 @@ dist_noinst_HEADERS = \
     src/util/sss_ssh.h \
     src/util/sss_ini.h \
     src/util/sss_format.h \
+    src/util/sss_bsd_errno.h \
     src/util/sss_config.h \
     src/util/refcount.h \
     src/util/find_uid.h \
@@ -2725,9 +2728,10 @@ intgcheck:
@@ -1700,9 +1703,10 @@ endif
 # Client Libraries #
 ####################
 

     src/sss_client/nss_passwd.c \
     src/sss_client/nss_group.c \
     src/sss_client/nss_netgroup.c \
@@ -2741,9 +2745,9 @@ libnss_sss_la_SOURCES = \
     src/sss_client/nss_mc_passwd.c \
     src/sss_client/nss_mc_group.c \
     src/sss_client/nss_mc_initgr.c \
     src/sss_client/nss_mc.h
-libnss_sss_la_LIBADD = \
+nss_sss_la_LIBADD = \

     -module \
     -version-info 2:0:0 \
     -Wl,--version-script,$(srcdir)/src/sss_client/sss_nss.exports
@@ -2936,6 +2940,7 @@ libsss_krb5_common_la_CFLAGS = \
 libsss_krb5_common_la_LIBADD = \
     $(KEYUTILS_LIBS) \
     $(DHASH_LIBS) \
+    $(LTLIBINTL) \
     $(KRB5_LIBS)
 libsss_krb5_common_la_LDFLAGS = \
     -avoid-version
@@ -3184,6 +3189,7 @@ ldap_child_LDADD = \
     $(TALLOC_LIBS) \
     $(POPT_LIBS) \
     $(OPENLDAP_LIBS) \
     $(DHASH_LIBS) \
+    $(LTLIBINTL) \
     $(KRB5_LIBS)
 
 if BUILD_SEMANAGE
@@ -3223,6 +3229,7 @@ gpo_child_LDADD = \
     $(POPT_LIBS) \
     $(DHASH_LIBS) \
     $(INI_CONFIG_LIBS) \
+    $(LTLIBINTL) \
     $(SMBCLIENT_LIBS)
 
 proxy_child_SOURCES = \
@@ -3254,6 +3261,7 @@ p11_child_LDADD = \
     $(POPT_LIBS) \
     $(NSS_LIBS) \
     libsss_crypt.la \
+    $(LTLIBINTL) \
     $(NULL)
 
 memberof_la_SOURCES = \
+notinstall-data-hook:
 	rm $(DESTDIR)/$(nsslibdir)/libnss_sss.so.2 \
        $(DESTDIR)/$(nsslibdir)/libnss_sss.so
 	mv $(DESTDIR)/$(nsslibdir)/libnss_sss.so.2.0.0 $(DESTDIR)/$(nsslibdir)/libnss_sss.so.2




--- configure.ac.orig	2016-04-13 14:48:41 UTC
+++ configure.ac
@@ -44,7 +44,8 @@
 AC_CHECK_HEADERS(stdint.h dlfcn.h)
 AC_CONFIG_HEADER(config.h)

 AC_CHECK_TYPES([errno_t], [], [], [[#include <errno.h>]])
+AM_CONDITIONAL([HAVE_ERRNO_T], [test "$ac_cv_type_errno_t" = yes])

 m4_include([src/build_macros.m4])
 BUILD_WITH_SHARED_BUILD_DIR
@@ -266,13 +266,13 @@ AM_CONDITIONAL([HAVE_PROFILE_CATALOGS], 
 AM_CONDITIONAL([HAVE_MANPAGES], [test "x$HAVE_MANPAGES" != "x"])
 AM_CONDITIONAL([HAVE_PO4A], [test "x$PO4A" != "xno"])
 
-AC_CHECK_PROG(HAVE_PYTHON2, python2, yes, no)
+AC_CHECK_PROGS(HAVE_PYTHON2, %%PYTHON2_CMD%% python2, yes, no)
 AS_IF([test x$HAVE_PYTHON2 = xyes],
-      [AC_PATH_PROG(PYTHON2, python2)])
+      [AC_PATH_PROGS(PYTHON2, %%PYTHON2_CMD%% python2)])
     [AC_GNU_SOURCE])
 
-AC_CHECK_PROG(HAVE_PYTHON3, python3, yes, no)
+AC_CHECK_PROGS(HAVE_PYTHON3, %%PYTHON3_CMD%% python3, yes, no)
 AS_IF([test x$HAVE_PYTHON3 = xyes],
-      [AC_PATH_PROG(PYTHON3, python3)])
+      [AC_PATH_PROGS(PYTHON3, %%PYTHON3_CMD%% python3)])
 
 if test x$HAVE_PYTHON2_BINDINGS = x1; then
     AS_IF([test x$HAVE_PYTHON2 != xyes],




--- src/monitor/monitor.c.orig	2014-09-17 13:01:37 UTC
+++ src/monitor/monitor.c
@@ -2832,6 +2832,20 @@ int main(int argc, const char *argv[])
     ret = server_setup(MONITOR_NAME, flags, monitor->conf_path, &main_ctx);
     if (ret != EOK) return 2;
 
+    /* Use confd initialized in server_setup. ldb_tdb module (1.4.0) check PID            
+   * of process which initialized db for locking purposes.            
+   * Failed to unlock db: ../ldb_tdb/ldb_tdb.c:147:            
+   *    Reusing ldb opened by pid 28889 in process 28893            
+   */            
+   talloc_zfree(monitor->cdb);            
+   monitor->cdb = main_ctx->confdb_ctx;            
+
+   ret = confdb_get_domains(monitor->cdb, &monitor->domains);            
+   if (ret != EOK) {            
+	DEBUG(SSSDBG_FATAL_FAILURE, "No domains configured.\n");            
+	return 4;            
+   }            
+
     monitor->is_daemon = !opt_interactive;
     monitor->parent_pid = main_ctx->parent_pid;
     monitor->ev = main_ctx->event_ctx;

Line 0 Link Here

(-)security/sssd/files/patch-src-util-cert-nss-cert.c (+10 lines)
	1	--- src/util/cert/nss/cert.c.orig 2016-04-13 14:48:41 UTC
	2	+++ src/util/cert/nss/cert.c
	3	@@ -31,6 +31,7 @@
	4	#include "util/crypto/sss_crypto.h"
	5	#include "util/crypto/nss/nss_util.h"
	6	#include "util/cert.h"
	7	+#include "util/sss_endian.h"
	8
	9	#define NS_CERT_HEADER "-----BEGIN CERTIFICATE-----"
	10	#define NS_CERT_TRAILER "-----END CERTIFICATE-----"




--- src/util/util.c.orig	2016-04-13 14:48:41 UTC
+++ src/util/util.c
@@ -946,7 +946,7 @@ errno_t sss_utc_to_time_t(const char *st
     len = strlen(str);
     if (str[len-1] != 'Z') {
         DEBUG(SSSDBG_TRACE_INTERNAL,
-              "%s does not seem to be in UTZ time zone.\n", str);
+              "%s does not seem to be in UTC time zone.\n", str);
         return ERR_TIMESPEC_NOT_SUPPORTED;
     }
 
@@ -967,15 +967,13 @@ errno_t sss_utc_to_time_t(const char *st
         return EINVAL;
     }
 
-    ut = mktime(&tm);
+    ut = timegm(&tm);
     if (ut == -1) {
         DEBUG(SSSDBG_TRACE_INTERNAL,
-              "mktime failed to convert [%s].\n", str);
+              "timegm failed to convert [%s].\n", str);
         return EINVAL;
     }
 
-    tzset();
-    ut -= timezone;
     *_unix_time = ut;
     return EOK;
 }

Lines 1-4 Link Here

(-)security/sssd/files/patch-src__confdb__confdb.c (-1 / +3 lines)
1	--- src/confdb/confdb.c.orig 2014-09-17 13:01:37 UTC	1	diff --git src/confdb/confdb.c src/confdb/confdb.c
		2	index 19d8884..67720f7 100644
		3	--- src/confdb/confdb.c
2	+++ src/confdb/confdb.c	4	+++ src/confdb/confdb.c
3	@@ -28,6 +28,11 @@	5	@@ -28,6 +28,11 @@
4	#include "util/strtonum.h"	6	#include "util/strtonum.h"

Lines 1-4 Link Here

(-)security/sssd/files/patch-src__external__inotify.m4 (-1 / +3 lines)
1	--- src/external/inotify.m4.orig 2014-09-17 13:01:37 UTC	1	diff --git src/external/inotify.m4 src/external/inotify.m4
		2	index 9572f6d..2a5a8cf 100644
		3	--- src/external/inotify.m4
2	+++ src/external/inotify.m4	4	+++ src/external/inotify.m4
3	@@ -20,10 +20,10 @@ int main () {	5	@@ -20,10 +20,10 @@ int main () {
4	AS_IF([test x"$inotify_works" != xyes],	6	AS_IF([test x"$inotify_works" != xyes],

Lines 1-4 Link Here

(-)security/sssd/files/patch-src__external__krb5.m4 (-1 / +3 lines)
1	--- src/external/krb5.m4.orig 2014-09-17 13:01:37 UTC	1	diff --git src/external/krb5.m4 src/external/krb5.m4
		2	index 861c8c9..978ec03 100644
		3	--- src/external/krb5.m4
2	+++ src/external/krb5.m4	4	+++ src/external/krb5.m4
3	@@ -9,7 +9,7 @@ if test x$KRB5_CFLAGS != x; then	5	@@ -9,7 +9,7 @@ if test x$KRB5_CFLAGS != x; then
4	KRB5_PASSED_CFLAGS=$KRB5_CFLAGS	6	KRB5_PASSED_CFLAGS=$KRB5_CFLAGS

Lines 1-6 Link Here

(-)security/sssd/files/patch-src__providers__krb5__krb5_delayed_online_authentication.c (-3 / +5 lines)
1	--- src/providers/krb5/krb5_delayed_online_authentication.c.orig 2014-09-17 13:01:37 UTC	1	diff --git src/providers/krb5/krb5_delayed_online_authentication.c src/providers/krb5/krb5_delayed_online_authentication.c
		2	index 33b839e..da6ccfc 100644
		3	--- src/providers/krb5/krb5_delayed_online_authentication.c
2	+++ src/providers/krb5/krb5_delayed_online_authentication.c	4	+++ src/providers/krb5/krb5_delayed_online_authentication.c
3	@@ -320,6 +320,7 @@ errno_t init_delayed_online_authentication(struct krb5	5	@@ -320,6 +320,7 @@ errno_t init_delayed_online_authentication(struct krb5_ctx *krb5_ctx,
4	struct tevent_context *ev)	6	struct tevent_context *ev)
5	{	7	{
6	int ret;	8	int ret;
Lines 8-14 Link Here
8	hash_table_t *tmp_table;	10	hash_table_t *tmp_table;
9		11
10	ret = get_uid_table(krb5_ctx, &tmp_table);	12	ret = get_uid_table(krb5_ctx, &tmp_table);
11	@@ -339,6 +340,7 @@ errno_t init_delayed_online_authentication(struct krb5	13	@@ -339,6 +340,7 @@ errno_t init_delayed_online_authentication(struct krb5_ctx *krb5_ctx,
12	"hash_destroy failed [%s].\n", hash_error_string(ret));	14	"hash_destroy failed [%s].\n", hash_error_string(ret));
13	return EFAULT;	15	return EFAULT;
14	}	16	}




--- src/providers/ldap/ldap_auth.c.orig	2016-04-13 14:48:41 UTC
+++ src/providers/ldap/ldap_auth.c
@@ -37,7 +37,6 @@
 #include <sys/time.h>

 #include <security/pam_modules.h>
 
 #include "util/util.h"
@@ -51,6 +50,22 @@
     PWEXPIRE_SHADOW
 };
 
 #define LDAP_PWEXPIRE_WARNING_TIME 0
 
+struct spwd
+{
+  char *sp_namp;              /* Login name.  */

 static errno_t add_expired_warning(struct pam_data *pd, long exp_time)
 {
     int ret;
@@ -96,9 +111,9 @@ static errno_t check_pwexpire_kerberos(c
         return EINVAL;
     }
 
+    tzset();
     expire_time = mktime(&tm);
     if (expire_time == -1) {
         DEBUG(SSSDBG_CRIT_FAILURE,
@@ -116,12 +132,10 @@ static errno_t check_pwexpire_kerberos(const char *exp
         return EINVAL;
     }
 
-    tzset();
-    expire_time -= timezone;
     DEBUG(SSSDBG_TRACE_ALL,
-          "Time info: tzname[0] [%s] tzname[1] [%s] timezone [%ld] "
-           "daylight [%d] now [%ld] expire_time [%ld].\n", tzname[0],
-           tzname[1], timezone, daylight, now, expire_time);
+          "Time info: tzname[0] [%s] tzname[1] [%s] "
+           "now [%ld] expire_time [%ld].\n", tzname[0],
+           tzname[1], now, expire_time);
 
     if (difftime(now, expire_time) > 0.0) {
         DEBUG(SSSDBG_CONF_SETTINGS, "Kerberos password expired.\n");
@@ -945,7 +960,7 @@ void sdap_pam_chpass_handler(struct be_r
     DEBUG(SSSDBG_OP_FAILURE,
           "starting password change request for user [%s].\n", pd->user);
 

 
     if (pd->cmd != SSS_PAM_CHAUTHTOK && pd->cmd != SSS_PAM_CHAUTHTOK_PRELIM) {
         DEBUG(SSSDBG_OP_FAILURE,
@@ -1094,7 +1109,7 @@ static void sdap_auth4chpass_done(struct
         dp_err = DP_ERR_OFFLINE;
         break;
     default:

     }
 
 done:
@@ -1156,7 +1171,7 @@ static void sdap_pam_chpass_done(struct 
                                                     state->sh, state->dn,
                                                     lastchanged_name);
         if (subreq == NULL) {

             goto done;
         }
 
@@ -1177,7 +1192,7 @@ static void sdap_lastchange_done(struct 
 
     ret = sdap_modify_shadow_lastchange_recv(req);
     if (ret != EOK) {

         goto done;
     }
 
@@ -1218,7 +1233,7 @@ void sdap_pam_auth_handler(struct be_req
         goto done;
     }
 

 
     switch (pd->cmd) {
     case SSS_PAM_AUTHENTICATE:
@@ -1307,7 +1322,7 @@ static void sdap_pam_auth_done(struct te
         state->pd->pam_status = PAM_PERM_DENIED;
         break;
     default:
-        state->pd->pam_status = PAM_SYSTEM_ERR;




--- src/providers/ldap/sdap_access.c.orig	2016-04-13 14:48:41 UTC
+++ src/providers/ldap/sdap_access.c
@@ -557,9 +557,9 @@ bool nds_check_expired(const char *exp_t
         return true;
     }
 
+    tzset();
     expire_time = mktime(&tm);
     if (expire_time == -1) {
         DEBUG(SSSDBG_CRIT_FAILURE,
@@ -506,13 +507,11 @@ static bool nds_check_expired(const char *exp_time_str
         return true;
     }
 
-    tzset();
-    expire_time -= timezone;
     now = time(NULL);
     DEBUG(SSSDBG_TRACE_ALL,
-          "Time info: tzname[0] [%s] tzname[1] [%s] timezone [%ld] "
-           "daylight [%d] now [%ld] expire_time [%ld].\n", tzname[0],
-           tzname[1], timezone, daylight, now, expire_time);
+          "Time info: tzname[0] [%s] tzname[1] [%s] "
+           "now [%ld] expire_time [%ld].\n", tzname[0],
+           tzname[1], now, expire_time);
 
     if (difftime(now, expire_time) > 0.0) {
         DEBUG(SSSDBG_CONF_SETTINGS, "NDS account expired.\n");




--- src/sss_client/common.c.orig	2016-04-13 14:48:41 UTC
+++ src/sss_client/common.c
@@ -25,6 +25,7 @@
 #include "config.h"

 
 #if HAVE_PTHREAD
 #include <pthread.h>
@@ -124,7 +126,6 @@ static enum sss_status sss_cli_send_req(
             *errnop = error;
             break;
         case 0:

             break;
         case 1:
             if (pfd.revents & (POLLERR | POLLHUP | POLLNVAL)) {
@@ -232,7 +233,6 @@ static enum sss_status sss_cli_recv_rep(
             *errnop = error;
             break;
         case 0:

             break;
         case 1:
             if (pfd.revents & (POLLHUP)) {
@@ -669,7 +669,6 @@ static enum sss_status sss_cli_check_soc
             *errnop = error;
             break;
         case 0:

             break;
         case 1:
             if (pfd.revents & (POLLERR | POLLHUP | POLLNVAL)) {
@@ -719,7 +718,7 @@ enum nss_status sss_nss_make_request(enu
     /* avoid looping in the nss daemon */
     envval = getenv("_SSS_LOOPS");
     if (envval && strcmp(envval, "NO") == 0) {

     }
 
     ret = sss_cli_check_socket(errnop, SSS_NSS_SOCKET_NAME);
@@ -727,9 +726,9 @@ enum nss_status sss_nss_make_request(enu
 #ifdef NONSTANDARD_SSS_NSS_BEHAVIOUR
         *errnop = 0;
         errno = 0;
-        return NSS_STATUS_NOTFOUND;
+        return NS_NOTFOUND;
 #else
-        return NSS_STATUS_UNAVAIL;
+        return NS_UNAVAIL;
 #endif
     }
 
@@ -741,9 +740,9 @@ enum nss_status sss_nss_make_request(enu
 #ifdef NONSTANDARD_SSS_NSS_BEHAVIOUR
             *errnop = 0;
             errno = 0;
-            return NSS_STATUS_NOTFOUND;
+            return NS_NOTFOUND;
 #else
-            return NSS_STATUS_UNAVAIL;
+            return NS_UNAVAIL;
 #endif
         }
 
@@ -752,17 +751,17 @@ enum nss_status sss_nss_make_request(enu
     }
     switch (ret) {
     case SSS_STATUS_TRYAGAIN:
-        return NSS_STATUS_TRYAGAIN;

+        return NS_SUCCESS;
     case SSS_STATUS_UNAVAIL:
     default:
 #ifdef NONSTANDARD_SSS_NSS_BEHAVIOUR
         *errnop = 0;
         errno = 0;
-        return NSS_STATUS_NOTFOUND;
+        return NS_NOTFOUND;
 #else
-        return NSS_STATUS_UNAVAIL;
+        return NS_UNAVAIL;
 #endif
     }
 }
@@ -791,12 +790,12 @@ int sss_pac_make_request(enum sss_cli_co
@@ -750,23 +749,23 @@ int sss_pac_make_request(enum sss_cli_command cmd,
     /* avoid looping in the nss daemon */
     envval = getenv("_SSS_LOOPS");
     if (envval && strcmp(envval, "NO") == 0) {

     }
 
     ret = sss_cli_make_request_nochecks(cmd, rd, repbuf, replen, errnop);
@@ -804,7 +803,7 @@ int sss_pac_make_request(enum sss_cli_co
         /* try reopen socket */
         ret = sss_cli_check_socket(errnop, SSS_PAC_SOCKET_NAME);
         if (ret != SSS_STATUS_SUCCESS) {
-            return NSS_STATUS_UNAVAIL;
+            return NS_UNAVAIL;
         }
 
         /* and make request one more time */
@@ -812,12 +811,12 @@ int sss_pac_make_request(enum sss_cli_co
     }
     switch (ret) {
     case SSS_STATUS_TRYAGAIN:
-        return NSS_STATUS_TRYAGAIN;

Lines 1-4 Link Here

(-)security/sssd/files/patch-src__sss_client__nss_group.c (-1 / +3 lines)
1	--- src/sss_client/nss_group.c.orig 2014-09-17 13:01:37 UTC	1	diff --git src/sss_client/nss_group.c src/sss_client/nss_group.c
		2	index e6ea54b..b27b671 100644
		3	--- src/sss_client/nss_group.c
2	+++ src/sss_client/nss_group.c	4	+++ src/sss_client/nss_group.c
3	@@ -343,6 +343,76 @@ out:	5	@@ -343,6 +343,76 @@ out:
4	}	6	}

Lines 1-4 Link Here

(-)security/sssd/files/patch-src__sss_client__sss_nss.exports (-4 / +7 lines)
1	--- src/sss_client/sss_nss.exports.orig 2014-09-17 13:01:37 UTC	1	diff --git src/sss_client/sss_nss.exports src/sss_client/sss_nss.exports
		2	index 1eefea8..8e85a05 100644
		3	--- src/sss_client/sss_nss.exports
2	+++ src/sss_client/sss_nss.exports	4	+++ src/sss_client/sss_nss.exports
3	@@ -3,6 +3,7 @@ EXPORTED {	5	@@ -3,6 +3,7 @@ EXPORTED {
4	# public functions	6	# public functions
Lines 8-20 Link Here
8	_nss_sss_getpwnam_r;	10	_nss_sss_getpwnam_r;
9	_nss_sss_getpwuid_r;	11	_nss_sss_getpwuid_r;
10	_nss_sss_setpwent;	12	_nss_sss_setpwent;
11	@@ -14,7 +15,24 @@ EXPORTED {	13	@@ -14,8 +15,25 @@ EXPORTED {
12	_nss_sss_setgrent;	14	_nss_sss_setgrent;
13	_nss_sss_getgrent_r;	15	_nss_sss_getgrent_r;
14	_nss_sss_endgrent;	16	_nss_sss_endgrent;
15	+ _nss_sss_getgroupmembership;	17	+ _nss_sss_getgroupmembership;
16	_nss_sss_initgroups_dyn;	18	_nss_sss_initgroups_dyn;
17	+	19
18	+ __nss_compat_getgrnam_r;	20	+ __nss_compat_getgrnam_r;
19	+ __nss_compat_getgrgid_r;	21	+ __nss_compat_getgrgid_r;
20	+ __nss_compat_getgrent_r;	22	+ __nss_compat_getgrent_r;
Lines 30-35 Link Here
30	+ __nss_compat_gethostbyname;	32	+ __nss_compat_gethostbyname;
31	+ __nss_compat_gethostbyname2;	33	+ __nss_compat_gethostbyname2;
32	+ __nss_compat_gethostbyaddr;	34	+ __nss_compat_gethostbyaddr;
33		35	+
34	#_nss_sss_getaliasbyname_r;	36	#_nss_sss_getaliasbyname_r;
35	#_nss_sss_setaliasent;	37	#_nss_sss_setaliasent;
		38	#_nss_sss_getaliasent_r;

Lines 1-4 Link Here

(-)security/sssd/files/patch-src__util__crypto__libcrypto__crypto_sha512crypt.c (-1 / +3 lines)
1	--- src/util/crypto/libcrypto/crypto_sha512crypt.c.orig 2014-09-17 13:01:37 UTC	1	diff --git src/util/crypto/libcrypto/crypto_sha512crypt.c src/util/crypto/libcrypto/crypto_sha512crypt.c
		2	index 34547d0..6901851 100644
		3	--- src/util/crypto/libcrypto/crypto_sha512crypt.c
2	+++ src/util/crypto/libcrypto/crypto_sha512crypt.c	4	+++ src/util/crypto/libcrypto/crypto_sha512crypt.c
3	@@ -28,6 +28,12 @@	5	@@ -28,6 +28,12 @@
4	#include <openssl/evp.h>	6	#include <openssl/evp.h>

Lines 1-4 Link Here

(-)security/sssd/files/patch-src__util__crypto__nss__nss_sha512crypt.c (-1 / +3 lines)
1	--- src/util/crypto/nss/nss_sha512crypt.c.orig 2014-09-17 13:01:37 UTC	1	diff --git src/util/crypto/nss/nss_sha512crypt.c src/util/crypto/nss/nss_sha512crypt.c
		2	index 9fedd5e..90192ac 100644
		3	--- src/util/crypto/nss/nss_sha512crypt.c
2	+++ src/util/crypto/nss/nss_sha512crypt.c	4	+++ src/util/crypto/nss/nss_sha512crypt.c
3	@@ -29,6 +29,12 @@	5	@@ -29,6 +29,12 @@
4	#include <sechash.h>	6	#include <sechash.h>

Lines 1-6 Link Here

(-)security/sssd/files/patch-src__util__find_uid.c (-3 / +5 lines)
1	--- src/util/find_uid.c.orig 2014-09-17 13:01:37 UTC	1	diff --git src/util/find_uid.c src/util/find_uid.c
		2	index 4c8f73a..40f3690 100644
		3	--- src/util/find_uid.c
2	+++ src/util/find_uid.c	4	+++ src/util/find_uid.c
3	@@ -67,7 +67,7 @@ static errno_t get_uid_from_pid(const pid_t pid, uid_t	5	@@ -67,7 +67,7 @@ static errno_t get_uid_from_pid(const pid_t pid, uid_t *uid)
4	uint32_t num=0;	6	uint32_t num=0;
5	errno_t error;	7	errno_t error;
6		8
Lines 9-15 Link Here
9	if (ret < 0) {	11	if (ret < 0) {
10	DEBUG(SSSDBG_CRIT_FAILURE, "snprintf failed");	12	DEBUG(SSSDBG_CRIT_FAILURE, "snprintf failed");
11	return EINVAL;	13	return EINVAL;
12	@@ -207,12 +207,12 @@ static errno_t get_active_uid_linux(hash_table_t *tabl	14	@@ -207,12 +207,12 @@ static errno_t get_active_uid_linux(hash_table_t *table, uid_t search_uid)
13	struct dirent *dirent;	15	struct dirent *dirent;
14	int ret, err;	16	int ret, err;
15	pid_t pid = -1;	17	pid_t pid = -1;




--- src/util/server.c.orig	2016-04-13 14:48:41 UTC
+++ src/util/server.c
@@ -308,8 +308,11 @@ static void setup_signals(void)
     BlockSignals(false, SIGTERM);
 
     CatchSignal(SIGHUP, sig_hup);
-
 #ifndef HAVE_PRCTL
         /* If prctl is not defined on the system, try to handle
          * some common termination signals gracefully */
-    CatchSignal(SIGSEGV, sig_segv_abrt);
-    CatchSignal(SIGABRT, sig_segv_abrt);
+    /* If prctl is not defined on the system, try to handle
+     * some common termination signals gracefully */
+    (void) sig_segv_abrt; /* unused */
+    /*
+      CatchSignal(SIGSEGV, sig_segv_abrt);




--- src/util/signal.c.orig	2014-09-17 13:01:37 UTC
+++ src/util/signal.c
@@ -28,45 +28,6 @@
  * @brief Signal handling
  */
 
-/****************************************************************************
- Catch child exits and reap the child zombie status.
-****************************************************************************/
-
-static void sig_cld(int signum)
-{
-	while (waitpid((pid_t)-1,(int *)NULL, WNOHANG) > 0)
-		;
-
-	/*
-	 * Turns out it's *really* important not to
-	 * restore the signal handler here if we have real POSIX
-	 * signal handling. If we do, then we get the signal re-delivered
-	 * immediately - hey presto - instant loop ! JRA.
-	 */
-
-#if !defined(HAVE_SIGACTION)
-	CatchSignal(SIGCLD, sig_cld);
-#endif
-}
-
-/****************************************************************************
-catch child exits - leave status;
-****************************************************************************/
-
-static void sig_cld_leave_status(int signum)
-{
-	/*
-	 * Turns out it's *really* important not to
-	 * restore the signal handler here if we have real POSIX
-	 * signal handling. If we do, then we get the signal re-delivered
-	 * immediately - hey presto - instant loop ! JRA.
-	 */
-
-#if !defined(HAVE_SIGACTION)
-	CatchSignal(SIGCLD, sig_cld_leave_status);
-#endif
-}
-
 /**
  Block sigs.
 **/
@@ -125,22 +86,4 @@ void (*CatchSignal(int signum,void (*handler)(int )))(
 	/* FIXME: need to handle sigvec and systems with broken signal() */
 	return signal(signum, handler);
 #endif
-}
-
-/**
- Ignore SIGCLD via whatever means is necessary for this OS.
-**/
-
-void CatchChild(void)
-{
-	CatchSignal(SIGCLD, sig_cld);
-}
-
-/**
- Catch SIGCLD but leave the child around so it's status can be reaped.
-**/
-
-void CatchChildLeaveStatus(void)
-{
-	CatchSignal(SIGCLD, sig_cld_leave_status);
 }

Lines 1-6 Link Here

(-)security/sssd/files/patch-src__util__sss_ldap.c (-3 / +5 lines)
1	--- src/util/sss_ldap.c.orig 2014-09-17 13:01:37 UTC	1	diff --git src/util/sss_ldap.c src/util/sss_ldap.c
		2	index dd63b4b..0764622 100644
		3	--- src/util/sss_ldap.c
2	+++ src/util/sss_ldap.c	4	+++ src/util/sss_ldap.c
3	@@ -206,6 +206,9 @@ static void sdap_async_sys_connect_done(struct tevent_	5	@@ -206,6 +206,9 @@ static void sdap_async_sys_connect_done(struct tevent_context *ev,
4	errno = 0;	6	errno = 0;
5	ret = connect(state->fd, (struct sockaddr *) &state->addr,	7	ret = connect(state->fd, (struct sockaddr *) &state->addr,
6	state->addr_len);	8	state->addr_len);
Lines 10-16 Link Here
10	if (ret != EOK) {	12	if (ret != EOK) {
11	ret = errno;	13	ret = errno;
12	if (ret == EINPROGRESS \|\| ret == EINTR) {	14	if (ret == EINPROGRESS \|\| ret == EINTR) {
13	@@ -346,7 +349,7 @@ struct tevent_req sss_ldap_init_send(TALLOC_CTX mem_	15	@@ -346,7 +349,7 @@ struct tevent_req sss_ldap_init_send(TALLOC_CTX mem_ctx,
14	"Using file descriptor [%d] for LDAP connection.\n", state->sd);	16	"Using file descriptor [%d] for LDAP connection.\n", state->sd);
15		17
16	subreq = sdap_async_sys_connect_send(state, ev, state->sd,	18	subreq = sdap_async_sys_connect_send(state, ev, state->sd,




--- src/util/util.h.orig	2016-04-13 14:48:41 UTC
+++ src/util/util.h
@@ -586,5 +586,10 @@
  * so that it's guaranteed the file is removed.
  */
 int sss_unique_filename(TALLOC_CTX *owner, char *path_tmpl);
-void CatchChild(void);
-void CatchChildLeaveStatus(void);
 
 /* from memory.c */
 typedef int (void_destructor_fn_t)(void *);
@@ -542,5 +540,6 @@ char * sss_replace_space(TALLOC_CTX *mem_ctx,
 char * sss_reverse_replace_space(TALLOC_CTX *mem_ctx,
                                  const char *orig_name,
                                  const char replace_char);
+#include "util/sss_bsd_errno.h"
+
+#ifndef N_ELEMENTS
+#define N_ELEMENTS(arr) (sizeof(arr) / sizeof(arr[0]))
+#endif
 
 #endif /* __SSSD_UTIL_H__ */




--- src/external/pac_responder.m4.orig	2016-04-13 14:48:41 UTC
+++ src/external/pac_responder.m4
@@ -14,7 +14,7 @@ then
     PKG_CHECK_MODULES(NDR_KRB5PAC, ndr_krb5pac, ndr_krb5pac_ok=yes,
         AC_MSG_WARN([Cannot build pac responder without libndr_krb5pac]))
 

     AC_MSG_CHECKING(for supported MIT krb5 version)
     KRB5_VERSION="`$KRB5_CONFIG --version`"
     case $KRB5_VERSION in
@@ -23,7 +23,10 @@ then
         Kerberos\ 5\ release\ 1.10* | \
         Kerberos\ 5\ release\ 1.11* | \
         Kerberos\ 5\ release\ 1.12* | \
         Kerberos\ 5\ release\ 1.13* | \
-        Kerberos\ 5\ release\ 1.14*)
+        Kerberos\ 5\ release\ 1.14* | \
+        Kerberos\ 5\ release\ 1.15* | \
+        Kerberos\ 5\ release\ 1.16* | \

Line 0 Link Here

(-)security/sssd/files/patch-src_providers_ad_ad__gpo__ndr.c (+11 lines)
	1	--- src/providers/ad/ad_gpo_ndr.c.orig 2019-10-02 15:20:18 UTC
	2	+++ src/providers/ad/ad_gpo_ndr.c
	3	@@ -258,7 +258,7 @@ ndr_pull_dom_sid(struct ndr_pull *ndr,
	4	NDR_CHECK(ndr_pull_align(ndr, 4));
	5	NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &r->sid_rev_num));
	6	NDR_CHECK(ndr_pull_int8(ndr, NDR_SCALARS, &r->num_auths));
	7	- if (r->num_auths < 0 \|\| r->num_auths > ARRAY_SIZE(r->sub_auths)) {
	8	+ if (r->num_auths < 0 \|\| r->num_auths > N_ELEMENTS(r->sub_auths)) {
	9	return ndr_pull_error(ndr, NDR_ERR_RANGE, "value out of range");
	10	}
	11	NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, r->id_auth, 6));

Lines 34-40 Link Here

(-)security/sssd/files/sssd.in (-1 / +1 lines)
34		34
35	sssd_prestart()	35	sssd_prestart()
36	{	36	{
37	for i in db/sss db/sss_mc log/sssd run/sss/krb5.include.d run/sss/private run/sss; do	37	for i in db/sss db/sss/db db/sss/gpo_cache db/sss/mc log/sssd run/sss/krb5.include.d run/sss/private run/sss; do
38	if [ ! -d var/${i} ]; then mkdir -p /var/${i}; fi	38	if [ ! -d var/${i} ]; then mkdir -p /var/${i}; fi
39	done	39	done
40	}	40	}




include/ipa_hbac.h
include/sss_idmap.h
include/sss_nss_idmap.h
include/sss_sifp_dbus.h
include/sss_sifp.h
include/wbclient_sssd.h
%%SMB%%lib/krb5/plugins/authdata/sssd_pac_plugin.so
lib/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so
lib/libipa_hbac.so
lib/libipa_hbac.so.0
lib/libipa_hbac.so.0.0.1
lib/libsss_idmap.so
lib/libsss_idmap.so.0
lib/libsss_idmap.so.0.5.0
lib/libsss_nss_idmap.so
lib/libsss_nss_idmap.so.0
lib/libsss_nss_idmap.so.0.1.0
lib/libsss_simpleifp.so
lib/libsss_simpleifp.so.0
lib/libsss_simpleifp.so.0.0.1
lib/libsss_sudo.so
lib/nss_sss.so
lib/nss_sss.so.1
lib/nss_sss.so.2
lib/nss_sss.so.2.0.0
lib/pam_sss.so
%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/pyhbac.so
%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/pysss_murmur.so
%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/pysss_nss_idmap.so
%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/pysss.so
%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig-%%PORTVERSION%%-py%%PYTHON_VER%%.egg-info
%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/__init__.py
%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/ipachangeconf.py
%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/sssd_upgrade_config.py
%%PYTHON2%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/__init__.pyc
%%PYTHON2%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/ipachangeconf.pyc
%%PYTHON2%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/sssd_upgrade_config.pyc
%%PYTHON3%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/__pycache__/__init__.cpython-37.pyc
%%PYTHON3%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/__pycache__/ipachangeconf.cpython-37.pyc
%%PYTHON3%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/__pycache__/sssd_upgrade_config.cpython-37.pyc
lib/shared-modules/ldb/memberof.so
%%SMB%%lib/sssd/libsss_ad.so
lib/sssd/libsss_cert.so
lib/sssd/libsss_child.so
lib/sssd/libsss_crypt.so
lib/sssd/libsss_debug.so

lib/sssd/libsss_proxy.so
lib/sssd/libsss_simple.so
lib/sssd/libsss_util.so
lib/sssd/libsss_semanage.so
lib/sssd/modules/libwbclient.so
lib/sssd/modules/libwbclient.so.0
lib/sssd/modules/libwbclient.so.0.12.0
lib/sssd/modules/sssd_krb5_localauth_plugin.so
libdata/pkgconfig/ipa_hbac.pc
libdata/pkgconfig/sss_idmap.pc
libdata/pkgconfig/sss_nss_idmap.pc
libdata/pkgconfig/sss_simpleifp.pc
libdata/pkgconfig/wbclient_sssd.pc
%%SMB%%libexec/sssd/gpo_child
libexec/sssd/krb5_child
libexec/sssd/ldap_child
libexec/sssd/p11_child
libexec/sssd/proxy_child
libexec/sssd/sss_signal
libexec/sssd/sssd_be
libexec/sssd/sssd_ifp
libexec/sssd/sssd_nss
%%SMB%%libexec/sssd/sssd_pac
libexec/sssd/sssd_pam
libexec/sssd/sssd_ssh
libexec/sssd/sssd_sudo
man/de/man1/sss_ssh_authorizedkeys.1.gz
man/de/man1/sss_ssh_knownhostsproxy.1.gz
man/de/man5/sssd-ifp.5.gz
man/de/man5/sssd-krb5.5.gz
man/de/man5/sssd-ldap.5.gz
man/de/man5/sssd-simple.5.gz
man/de/man5/sssd-sudo.5.gz
man/de/man5/sssd.conf.5.gz
man/de/man8/pam_sss.8.gz
man/de/man8/sss_cache.8.gz
man/de/man8/sss_debuglevel.8.gz
man/de/man8/sss_groupadd.8.gz
man/de/man8/sss_groupdel.8.gz
man/de/man8/sss_groupmod.8.gz
man/de/man8/sss_groupshow.8.gz
man/de/man8/sss_obfuscate.8.gz
man/de/man8/sss_seed.8.gz
man/de/man8/sss_useradd.8.gz
man/de/man8/sss_userdel.8.gz
man/de/man8/sss_usermod.8.gz
man/de/man8/sssd_krb5_locator_plugin.8.gz
man/de/man8/sssd.8.gz
man/es/man1/sss_ssh_knownhostsproxy.1.gz
man/es/man5/sssd-ldap.5.gz
man/es/man5/sssd-simple.5.gz
man/es/man5/sssd-sudo.5.gz
man/es/man5/sssd.conf.5.gz
man/es/man8/pam_sss.8.gz
man/es/man8/sss_cache.8.gz
man/es/man8/sss_debuglevel.8.gz
man/es/man8/sss_groupadd.8.gz

man/es/man8/sssd_krb5_locator_plugin.8.gz
man/fr/man1/sss_ssh_authorizedkeys.1.gz
man/fr/man1/sss_ssh_knownhostsproxy.1.gz
man/fr/man5/sssd-ad.5.gz
man/fr/man5/sssd-krb5.5.gz
man/fr/man5/sssd-ldap.5.gz
man/fr/man5/sssd-simple.5.gz

man/ja/man1/sss_ssh_authorizedkeys.1.gz
man/ja/man1/sss_ssh_knownhostsproxy.1.gz
man/ja/man5/sssd-krb5.5.gz
man/ja/man5/sssd-ldap.5.gz
man/ja/man5/sssd-simple.5.gz
man/ja/man5/sssd.conf.5.gz
man/ja/man8/pam_sss.8.gz
man/ja/man8/sss_cache.8.gz
man/ja/man8/sss_debuglevel.8.gz
man/ja/man8/sss_groupadd.8.gz

man/ja/man8/sssd_krb5_locator_plugin.8.gz
man/man1/sss_ssh_authorizedkeys.1.gz
man/man1/sss_ssh_knownhostsproxy.1.gz
%%SMB%%man/man5/sssd-ad.5.gz
man/man5/sssd-ifp.5.gz
%%SMB%%man/man5/sssd-ipa.5.gz
man/man5/sssd-krb5.5.gz
man/man5/sssd-ldap.5.gz
man/man5/sssd-simple.5.gz

man/man8/sss_groupmod.8.gz
man/man8/sss_groupshow.8.gz
man/man8/sss_obfuscate.8.gz
man/man8/sss_override.8.gz
man/man8/sss_seed.8.gz
man/man8/sss_useradd.8.gz
man/man8/sss_userdel.8.gz

man/pt/man8/sss_groupmod.8.gz
man/uk/man1/sss_ssh_authorizedkeys.1.gz
man/uk/man1/sss_ssh_knownhostsproxy.1.gz
man/uk/man5/sss_rpcidmapd.5.gz
man/uk/man5/sssd-ad.5.gz
man/uk/man5/sssd-ifp.5.gz
man/uk/man5/sssd-ipa.5.gz
man/uk/man5/sssd-krb5.5.gz
man/uk/man5/sssd-ldap.5.gz
man/uk/man5/sssd-simple.5.gz

man/uk/man8/sss_useradd.8.gz
man/uk/man8/sss_userdel.8.gz
man/uk/man8/sss_usermod.8.gz
man/uk/man8/sssd.8.gz
man/uk/man8/sssd_krb5_locator_plugin.8.gz
man/uk/man8/sssd.8.gz
sbin/sss_cache
sbin/sss_debuglevel
sbin/sss_groupadd
sbin/sss_groupdel
sbin/sss_groupmod
sbin/sss_groupshow
%%PYTHON%%sbin/sss_obfuscate
sbin/sss_override
sbin/sss_seed
sbin/sss_useradd
sbin/sss_userdel

%%PORTDOCS%%@dir %%DOCSDIR%%/idmap_doc
%%PORTDOCS%%@dir %%DOCSDIR%%/libsss_sudo_doc
%%PORTDOCS%%@dir %%DOCSDIR%%/nss_idmap_doc
%%PORTDOCS%%@dir %%DOCSDIR%%/sss_simpleifp_doc
@dir /var/db/sss
@dir /var/db/sss/db
@dir /var/db/sss/gpo_cache
@dir /var/db/sss/keytabs
@dir /var/db/sss/mc
@dir /var/log/sssd
@dir /var/run/sss
@dir /var/run/sss/krb5.include.d
@dir /var/run/sss/private

Return to bug 238465

Lines 1-9 Link Here

(-)security/sssd/Makefile (-18 / +42 lines)
1	# Created by: Lukas Slebodnik <lukas.slebodnik@intrak.sk>	1	# Created by: Lukas Slebodnik <lukas.slebodnik@intrak.sk>
2	# $FreeBSD: head/security/sssd/Makefile 529824 2020-03-29 18:16:30Z fernape $	2	# $FreeBSD: head/security/sssd/Makefile 505782 2019-07-03 19:30:03Z antoine $
3		3
4	PORTNAME= sssd	4	PORTNAME= sssd
5	PORTVERSION= 1.11.7	5	PORTVERSION= 1.13.4
6	PORTREVISION= 20
7	CATEGORIES= security	6	CATEGORIES= security
8	MASTER_SITES= https://releases.pagure.org/SSSD/${PORTNAME}/	7	MASTER_SITES= https://releases.pagure.org/SSSD/${PORTNAME}/
9		8
Lines 13-21 Link Here
13	LICENSE= GPLv3+	12	LICENSE= GPLv3+
14	LICENSE_FILE= ${WRKSRC}/COPYING	13	LICENSE_FILE= ${WRKSRC}/COPYING
15		14
16	DEPRECATED= Uses deprecated version of python
17	EXPIRATION_DATE= 2020-09-15
18
19	LIB_DEPENDS= libpopt.so:devel/popt \	15	LIB_DEPENDS= libpopt.so:devel/popt \
20	libtalloc.so:devel/talloc \	16	libtalloc.so:devel/talloc \
21	libtevent.so:devel/tevent \	17	libtevent.so:devel/tevent \
Lines 38-48 Link Here
38	nsupdate:dns/bind-tools	34	nsupdate:dns/bind-tools
39		35
40	USES= autoreconf cpe gettext gmake iconv libtool pathfix pkgconfig \	36	USES= autoreconf cpe gettext gmake iconv libtool pathfix pkgconfig \
41	python:2.7 shebangfix gssapi:mit	37	shebangfix gssapi:mit
42		38
43	USE_LDCONFIG= yes
44	USE_OPENLDAP= yes
45
46	GNU_CONFIGURE= yes	39	GNU_CONFIGURE= yes
47	CONFIGURE_ARGS= --with-selinux=no --with-semanage=no \	40	CONFIGURE_ARGS= --with-selinux=no --with-semanage=no \
48	--with-ldb-lib-dir=${LOCALBASE}/lib/shared-modules/ldb \	41	--with-ldb-lib-dir=${LOCALBASE}/lib/shared-modules/ldb \
Lines 50-66 Link Here
50	--with-libnl=no --with-init-dir=no --datadir=${DATADIR} \	43	--with-libnl=no --with-init-dir=no --datadir=${DATADIR} \
51	--docdir=${DOCSDIR} --with-pid-path=/var/run \	44	--docdir=${DOCSDIR} --with-pid-path=/var/run \
52	--localstatedir=/var --enable-pammoddir=${PREFIX}/lib \	45	--localstatedir=/var --enable-pammoddir=${PREFIX}/lib \
53	--with-db-path=/var/db/sss --with-pipe-path=/var/run/sss \	46	--with-db-path=/var/db/sss/db \
54	--with-pubconf-path=/var/run/sss --with-mcache-path=/var/db/sss_mc \	47	--with-gpo-cache-path=/var/db/sss/gpo_cache \
		48	--with-pipe-path=/var/run/sss \
		49	--with-pubconf-path=/var/run/sss --with-mcache-path=/var/db/sss/mc \
55	--with-unicode-lib=libunistring --with-autofs=no \	50	--with-unicode-lib=libunistring --with-autofs=no \
56	--disable-cifs-idmap-plugin --disable-config-lib \	51	--disable-cifs-idmap-plugin --disable-config-lib \
57	--with-krb5-conf=/etc/krb5.conf	52	--with-krb5-conf=/etc/krb5.conf
		53	# TODO: investigate possible sssd/nfsuserd compatibility
		54	CONFIGURE_ARGS+= --without-nfsv4-idmapd-plugin
58	CFLAGS+= -fstack-protector-all	55	CFLAGS+= -fstack-protector-all
59	PLIST_SUB= PYTHON_VER=${PYTHON_VER}	56	# add __STDC_WANT_LIB_EXT1__ - see https://stackoverflow.com/questions/24206989/error-use-of-undeclared-identifier-errno-t
		57	#CPPFLAGS+= -D__STDC_WANT_LIB_EXT1__
60	#DEBUG_FLAGS= -g	58	#DEBUG_FLAGS= -g
61	MAKE_ENV+= LINGUAS="bg de eu es fr hu id it ja nb nl pl pt ru sv tg tr uk zh_CN zh_TW"	59	MAKE_ENV+= LINGUAS="bg de eu es fr hu id it ja nb nl pl pt ru sv tg tr uk zh_CN zh_TW"
62	SUB_FILES= pkg-message	60	SUB_FILES= pkg-message
63		61
		62	USE_LDCONFIG= yes
		63	USE_OPENLDAP= yes
64	INSTALL_TARGET= install-strip	64	INSTALL_TARGET= install-strip
65	CPE_VENDOR= fedoraproject	65	CPE_VENDOR= fedoraproject
66		66
Lines 70-81 Link Here
70	USE_RC_SUBR= ${PORTNAME}	70	USE_RC_SUBR= ${PORTNAME}
71	PORTDATA= *	71	PORTDATA= *
72		72
73	OPTIONS_DEFINE= DOCS SMB	73	OPTIONS_DEFINE= DOCS SMB
		74	OPTIONS_DEFAULT= PYTHON3
		75	OPTIONS_RADIO= PYTHON
		76	OPTIONS_RADIO_PYTHON= PYTHON2 PYTHON3
74	OPTIONS_SUB= yes	77	OPTIONS_SUB= yes
75		78
		79	PYTHON2_CONFIGURE_WITH= python2-bindings
		80	PYTHON2_USES= python:2.7
		81	PYTHON2_VARS= PYTHON2_CMD=${PYTHON_CMD:T} PYTHON3_CMD=
		82	PYTHON3_CONFIGURE_WITH= python3-bindings
		83	PYTHON3_USES= python:3.5+
		84	PYTHON3_VARS= PYTHON2_CMD= PYTHON3_CMD=${PYTHON_CMD:T}
		85
		86	PLIST_SUB+= PORTVERSION=${PORTVERSION} \
		87	PYTHONPREFIX_SITELIBDIR=${PYTHONPREFIX_SITELIBDIR} \
		88	PYTHON_VER=${PYTHON_VER}
		89
76	SMB_DESC= Install IPA and AD providers (requires Samba4)	90	SMB_DESC= Install IPA and AD providers (requires Samba4)
77	SMB_USES= samba:lib # libndr-krb5pac libndr-nbt libndr libsamba-util	91	SMB_USES= samba:lib # libndr-krb5pac libndr-nbt libndr libsamba-util
78	SMB_CONFIGURE_WITH= samba	92	SMB_CONFIGURE_WITH= samba
		93	# PAC (Privilege Attribute Certificate) responder currently needs samba
		94	SMB_CONFIGURE_ENABLE= pac-responder
79		95
80	post-patch:	96	post-patch:
81	@${REINPLACE_CMD} -e 's\|SIGCLD\|SIGCHLD\|g' ${WRKSRC}/src/util/signal.c	97	@${REINPLACE_CMD} -e 's\|SIGCLD\|SIGCHLD\|g' ${WRKSRC}/src/util/signal.c
Lines 95-100 Link Here
95	@${REINPLACE_CMD} -e 's\|/etc/sssd/\|${ETCDIR}/\|g' \	111	@${REINPLACE_CMD} -e 's\|/etc/sssd/\|${ETCDIR}/\|g' \
96	-e 's\|/etc/openldap/\|${LOCALBASE}/etc/openldap/\|g' \	112	-e 's\|/etc/openldap/\|${LOCALBASE}/etc/openldap/\|g' \
97	${WRKSRC}/src/man/*xml	113	${WRKSRC}/src/man/*xml
		114	@${REINPLACE_CMD} 's\|%%PYTHON2_CMD%%\|${PYTHON2_CMD}\|g; \
		115	s\|%%PYTHON3_CMD%%\|${PYTHON3_CMD}\|g' \
		116	${WRKSRC}/configure.ac
98	@${CP} ${FILESDIR}/bsdnss.c ${WRKSRC}/src/sss_client/bsdnss.c	117	@${CP} ${FILESDIR}/bsdnss.c ${WRKSRC}/src/sss_client/bsdnss.c
99	@${CP} ${FILESDIR}/sss_bsd_errno.h ${WRKSRC}/src/util/sss_bsd_errno.h	118	@${CP} ${FILESDIR}/sss_bsd_errno.h ${WRKSRC}/src/util/sss_bsd_errno.h
100		119
Lines 102-114 Link Here
102	${INSTALL_DATA} ${WRKSRC}/src/examples/sssd-example.conf \	121	${INSTALL_DATA} ${WRKSRC}/src/examples/sssd-example.conf \
103	${STAGEDIR}${ETCDIR}/sssd.conf.sample	122	${STAGEDIR}${ETCDIR}/sssd.conf.sample
104	${LN} -sf nss_sss.so ${STAGEDIR}${PREFIX}/lib/nss_sss.so.1	123	${LN} -sf nss_sss.so ${STAGEDIR}${PREFIX}/lib/nss_sss.so.1
105	# clean these up from the install; we create them in rc script start_precmd
106	.for d in db/sss db/sss_mc log/sssd run/sss/krb5.include.d run/sss/private run/sss
107	@${RMDIR} ${STAGEDIR}/var/${d}
108	.endfor
109	# clean unused man dirs	124	# clean unused man dirs
110	.for i in nl/man1 nl/man5 pt/man1 pt/man5	125	.for i in nl/man1 nl/man5 pt/man1 pt/man5
111	@${RMDIR} ${STAGEDIR}${PREFIX}/man/${i}	126	@${RMDIR} ${STAGEDIR}${PREFIX}/man/${i}
112	.endfor	127	.endfor
		128
		129	.include <bsd.port.options.mk>
		130
		131	.if empty(PORT_OPTIONS:MPYTHON2) && empty(PORT_OPTIONS:MPYTHON3)
		132	PLIST_SUB+= PYTHON="@comment "
		133	USES+= python:3.5+,build
		134	.else
		135	PLIST_SUB+= PYTHON=
		136	.endif
113		137
114	.include <bsd.port.mk>	138	.include <bsd.port.mk>

Lines 1-30 Link Here

(-)security/sssd/files/patch-Makefile.am (-21 / +55 lines)
1	--- Makefile.am.orig 2020-03-16 18:30:24 UTC	1	--- Makefile.am.orig 2019-04-13 14:48:41 UTC
2	+++ Makefile.am	2	+++ Makefile.am
3	@@ -311,6 +311,7 @@ AM_CPPFLAGS = \	3	@@ -54,7 +54,7 @@ sssddatadir = $(datadir)/sssd
4	$(LIBNL_CFLAGS) \	4	sssdapiplugindir = $(sssddatadir)/sssd.api.d
		5	dbuspolicydir = $(sysconfdir)/dbus-1/system.d
		6	dbusservicedir = $(datadir)/dbus-1/system-services
		7	-sss_statedir = $(localstatedir)/lib/sss
		8	+sss_statedir = $(localstatedir)/db/sss
		9	localedir = @localedir@
		10	nsslibdir = @nsslibdir@
		11	pamlibdir = @pammoddir@
		12	@@ -96,6 +96,9 @@
		13	-fno-strict-aliasing \
		14	-std=gnu99
		15	endif
		16	+if HAVE_ERRNO_T
		17	+ AM_CFLAGS += -D__STDC_WANT_LIB_EXT1__
		18	+endif
		19
		20	pkgconfig_DATA =
		21
		22	@@ -427,6 +427,7 @@ AM_CPPFLAGS = \
5	$(OPENLDAP_CFLAGS) \	23	$(OPENLDAP_CFLAGS) \
6	$(GLIB2_CFLAGS) \	24	$(GLIB2_CFLAGS) \
		25	$(JOURNALD_CFLAGS) \
7	+ -DHOST_NAME_MAX=_POSIX_HOST_NAME_MAX \	26	+ -DHOST_NAME_MAX=_POSIX_HOST_NAME_MAX \
8	-DLIBDIR=\"$(libdir)\" \	27	-DLIBDIR=\"$(libdir)\" \
9	-DVARDIR=\"$(localstatedir)\" \	28	-DVARDIR=\"$(localstatedir)\" \
10	-DSHLIBEXT=\"$(SHLIBEXT)\" \	29	-DSSS_STATEDIR=\"$(sss_statedir)\" \
11	@@ -378,6 +379,7 @@ SSSD_LIBS = \	30	@@ -497,6 +498,7 @@ SSSD_LIBS = \
		31	$(COLLECTION_LIBS) \
12	$(DHASH_LIBS) \	32	$(DHASH_LIBS) \
13	$(SSS_CRYPT_LIBS) \
14	$(OPENLDAP_LIBS) \	33	$(OPENLDAP_LIBS) \
15	+ $(LTLIBINTL) \	34	+ $(LTLIBINTL) \
16	$(TDB_LIBS)	35	$(TDB_LIBS)
17		36
18	PYTHON_BINDINGS_LIBS = \	37	PYTHON_BINDINGS_LIBS = \
19	@@ -433,6 +435,7 @@ dist_noinst_HEADERS = \	38	@@ -546,6 +548,7 @@ dist_noinst_HEADERS = \
20	src/util/sss_ssh.h \	39	src/util/sss_ssh.h \
21	src/util/sss_ini.h \	40	src/util/sss_ini.h \
22	src/util/sss_format.h \	41	src/util/sss_format.h \
23	+ src/util/sss_bsd_errno.h \	42	+ src/util/sss_bsd_errno.h \
		43	src/util/sss_config.h \
24	src/util/refcount.h \	44	src/util/refcount.h \
25	src/util/find_uid.h \	45	src/util/find_uid.h \
26	src/util/user_info_msg.h \	46	@@ -2725,9 +2728,10 @@ intgcheck:
27	@@ -1700,9 +1703,10 @@ endif
28	# Client Libraries #	47	# Client Libraries #
29	####################	48	####################
30		49
Lines 37-45 Link Here
37	src/sss_client/nss_passwd.c \	56	src/sss_client/nss_passwd.c \
38	src/sss_client/nss_group.c \	57	src/sss_client/nss_group.c \
39	src/sss_client/nss_netgroup.c \	58	src/sss_client/nss_netgroup.c \
40	@@ -1715,9 +1719,9 @@ libnss_sss_la_SOURCES = \	59	@@ -2741,9 +2745,9 @@ libnss_sss_la_SOURCES = \
41	src/sss_client/nss_mc_passwd.c \
42	src/sss_client/nss_mc_group.c \	60	src/sss_client/nss_mc_group.c \
		61	src/sss_client/nss_mc_initgr.c \
43	src/sss_client/nss_mc.h	62	src/sss_client/nss_mc.h
44	-libnss_sss_la_LIBADD = \	63	-libnss_sss_la_LIBADD = \
45	+nss_sss_la_LIBADD = \	64	+nss_sss_la_LIBADD = \
Lines 49-68 Link Here
49	-module \	68	-module \
50	-version-info 2:0:0 \	69	-version-info 2:0:0 \
51	-Wl,--version-script,$(srcdir)/src/sss_client/sss_nss.exports	70	-Wl,--version-script,$(srcdir)/src/sss_client/sss_nss.exports
52	@@ -2086,6 +2090,7 @@ ldap_child_LDADD = \	71	@@ -2936,6 +2940,7 @@ libsss_krb5_common_la_CFLAGS = \
		72	libsss_krb5_common_la_LIBADD = \
		73	$(KEYUTILS_LIBS) \
		74	$(DHASH_LIBS) \
		75	+ $(LTLIBINTL) \
		76	$(KRB5_LIBS)
		77	libsss_krb5_common_la_LDFLAGS = \
		78	-avoid-version
		79	@@ -3184,6 +3189,7 @@ ldap_child_LDADD = \
		80	$(TALLOC_LIBS) \
53	$(POPT_LIBS) \	81	$(POPT_LIBS) \
54	$(OPENLDAP_LIBS) \
55	$(DHASH_LIBS) \	82	$(DHASH_LIBS) \
56	+ $(LTLIBINTL) \	83	+ $(LTLIBINTL) \
57	$(KRB5_LIBS)	84	$(KRB5_LIBS)
58		85
		86	if BUILD_SEMANAGE
		87	@@ -3223,6 +3229,7 @@ gpo_child_LDADD = \
		88	$(POPT_LIBS) \
		89	$(DHASH_LIBS) \
		90	$(INI_CONFIG_LIBS) \
		91	+ $(LTLIBINTL) \
		92	$(SMBCLIENT_LIBS)
		93
59	proxy_child_SOURCES = \	94	proxy_child_SOURCES = \
60	@@ -2333,7 +2338,7 @@ else	95	@@ -3254,6 +3261,7 @@ p11_child_LDADD = \
61	mkdir -p $(DESTDIR)$(initdir)	96	$(POPT_LIBS) \
62	endif	97	$(NSS_LIBS) \
		98	libsss_crypt.la \
		99	+ $(LTLIBINTL) \
		100	$(NULL)
63		101
64	-install-data-hook:	102	memberof_la_SOURCES = \
65	+notinstall-data-hook:
66	rm $(DESTDIR)/$(nsslibdir)/libnss_sss.so.2 \
67	$(DESTDIR)/$(nsslibdir)/libnss_sss.so
68	mv $(DESTDIR)/$(nsslibdir)/libnss_sss.so.2.0.0 $(DESTDIR)/$(nsslibdir)/libnss_sss.so.2

Lines 1-20 Link Here

(-)security/sssd/files/patch-configure.ac (-16 / +25 lines)
1	--- configure.ac.orig 2014-09-17 13:01:37 UTC	1	--- configure.ac.orig 2016-04-13 14:48:41 UTC
2	+++ configure.ac	2	+++ configure.ac
3	@@ -5,14 +5,14 @@ AC_INIT([sssd],	3	@@ -44,7 +44,8 @@
4	VERSION_NUMBER,	4	AC_CHECK_HEADERS(stdint.h dlfcn.h)
5	[sssd-devel@lists.fedorahosted.org])	5	AC_CONFIG_HEADER(config.h)
		6
		7	AC_CHECK_TYPES([errno_t], [], [], [[#include <errno.h>]])
		8	+AM_CONDITIONAL([HAVE_ERRNO_T], [test "$ac_cv_type_errno_t" = yes])
		9
		10	m4_include([src/build_macros.m4])
		11	BUILD_WITH_SHARED_BUILD_DIR
		12	@@ -266,13 +266,13 @@ AM_CONDITIONAL([HAVE_PROFILE_CATALOGS],
		13	AM_CONDITIONAL([HAVE_MANPAGES], [test "x$HAVE_MANPAGES" != "x"])
		14	AM_CONDITIONAL([HAVE_PO4A], [test "x$PO4A" != "xno"])
6		15
7	+AC_CONFIG_SRCDIR([BUILD.txt])	16	-AC_CHECK_PROG(HAVE_PYTHON2, python2, yes, no)
8	+AC_CONFIG_AUX_DIR([build])	17	+AC_CHECK_PROGS(HAVE_PYTHON2, %%PYTHON2_CMD%% python2, yes, no)
9	+	18	AS_IF([test x$HAVE_PYTHON2 = xyes],
10	m4_ifdef([AC_USE_SYSTEM_EXTENSIONS],	19	- [AC_PATH_PROG(PYTHON2, python2)])
11	[AC_USE_SYSTEM_EXTENSIONS],	20	+ [AC_PATH_PROGS(PYTHON2, %%PYTHON2_CMD%% python2)])
12	[AC_GNU_SOURCE])
13		21
14	CFLAGS="$CFLAGS -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE"	22	-AC_CHECK_PROG(HAVE_PYTHON3, python3, yes, no)
15	-	23	+AC_CHECK_PROGS(HAVE_PYTHON3, %%PYTHON3_CMD%% python3, yes, no)
16	-AC_CONFIG_SRCDIR([BUILD.txt])	24	AS_IF([test x$HAVE_PYTHON3 = xyes],
17	-AC_CONFIG_AUX_DIR([build])	25	- [AC_PATH_PROG(PYTHON3, python3)])
		26	+ [AC_PATH_PROGS(PYTHON3, %%PYTHON3_CMD%% python3)])
18		27
19	AM_INIT_AUTOMAKE([-Wall foreign subdir-objects tar-pax])	28	if test x$HAVE_PYTHON2_BINDINGS = x1; then
20	AM_PROG_CC_C_O	29	AS_IF([test x$HAVE_PYTHON2 != xyes],

Line 0 Link Here

(-)security/sssd/files/patch-src-monitor-monitor.c (+23 lines)
	1	--- src/monitor/monitor.c.orig 2014-09-17 13:01:37 UTC
	2	+++ src/monitor/monitor.c
	3	@@ -2832,6 +2832,20 @@ int main(int argc, const char *argv[])
	4	ret = server_setup(MONITOR_NAME, flags, monitor->conf_path, &main_ctx);
	5	if (ret != EOK) return 2;
	6
	7	+ /* Use confd initialized in server_setup. ldb_tdb module (1.4.0) check PID
	8	+ * of process which initialized db for locking purposes.
	9	+ * Failed to unlock db: ../ldb_tdb/ldb_tdb.c:147:
	10	+ * Reusing ldb opened by pid 28889 in process 28893
	11	+ */
	12	+ talloc_zfree(monitor->cdb);
	13	+ monitor->cdb = main_ctx->confdb_ctx;
	14	+
	15	+ ret = confdb_get_domains(monitor->cdb, &monitor->domains);
	16	+ if (ret != EOK) {
	17	+ DEBUG(SSSDBG_FATAL_FAILURE, "No domains configured.\n");
	18	+ return 4;
	19	+ }
	20	+
	21	monitor->is_daemon = !opt_interactive;
	22	monitor->parent_pid = main_ctx->parent_pid;
	23	monitor->ev = main_ctx->event_ctx;

Line 0 Link Here

(-)security/sssd/files/patch-src-util-util.c (+29 lines)
	1	--- src/util/util.c.orig 2016-04-13 14:48:41 UTC
	2	+++ src/util/util.c
	3	@@ -946,7 +946,7 @@ errno_t sss_utc_to_time_t(const char *st
	4	len = strlen(str);
	5	if (str[len-1] != 'Z') {
	6	DEBUG(SSSDBG_TRACE_INTERNAL,
	7	- "%s does not seem to be in UTZ time zone.\n", str);
	8	+ "%s does not seem to be in UTC time zone.\n", str);
	9	return ERR_TIMESPEC_NOT_SUPPORTED;
	10	}
	11
	12	@@ -967,15 +967,13 @@ errno_t sss_utc_to_time_t(const char *st
	13	return EINVAL;
	14	}
	15
	16	- ut = mktime(&tm);
	17	+ ut = timegm(&tm);
	18	if (ut == -1) {
	19	DEBUG(SSSDBG_TRACE_INTERNAL,
	20	- "mktime failed to convert [%s].\n", str);
	21	+ "timegm failed to convert [%s].\n", str);
	22	return EINVAL;
	23	}
	24
	25	- tzset();
	26	- ut -= timezone;
	27	*_unix_time = ut;
	28	return EOK;
	29	}

Lines 1-4 Link Here

(-)security/sssd/files/patch-src__providers__ldap__ldap_auth.c (-25 / +14 lines)
1	--- src/providers/ldap/ldap_auth.c.orig 2014-09-17 13:01:37 UTC	1	--- src/providers/ldap/ldap_auth.c.orig 2016-04-13 14:48:41 UTC
2	+++ src/providers/ldap/ldap_auth.c	2	+++ src/providers/ldap/ldap_auth.c
3	@@ -37,7 +37,6 @@	3	@@ -37,7 +37,6 @@
4	#include <sys/time.h>	4	#include <sys/time.h>
Lines 8-17 Link Here
8	#include <security/pam_modules.h>	8	#include <security/pam_modules.h>
9		9
10	#include "util/util.h"	10	#include "util/util.h"
11	@@ -56,6 +55,22 @@ enum pwexpire {	11	@@ -51,6 +50,22 @@
12	PWEXPIRE_SHADOW
13	};
14		12
		13	#define LDAP_PWEXPIRE_WARNING_TIME 0
		14
15	+struct spwd	15	+struct spwd
16	+{	16	+{
17	+ char sp_namp; / Login name. */	17	+ char sp_namp; / Login name. */
Lines 31-61 Link Here
31	static errno_t add_expired_warning(struct pam_data *pd, long exp_time)	31	static errno_t add_expired_warning(struct pam_data *pd, long exp_time)
32	{	32	{
33	int ret;	33	int ret;
34	@@ -109,6 +124,7 @@ static errno_t check_pwexpire_kerberos(const char *exp	34	@@ -96,9 +111,9 @@ static errno_t check_pwexpire_kerberos(c
35	return EINVAL;
36	}	35	}
37		36
38	+ tzset();
39	expire_time = mktime(&tm);
40	if (expire_time == -1) {
41	DEBUG(SSSDBG_CRIT_FAILURE,
42	@@ -116,12 +132,10 @@ static errno_t check_pwexpire_kerberos(const char *exp
43	return EINVAL;
44	}
45
46	- tzset();
47	- expire_time -= timezone;
48	DEBUG(SSSDBG_TRACE_ALL,	37	DEBUG(SSSDBG_TRACE_ALL,
49	- "Time info: tzname[0] [%s] tzname[1] [%s] timezone [%ld] "	38	- "Time info: tzname[0] [%s] tzname[1] [%s] timezone [%ld] "
50	- "daylight [%d] now [%ld] expire_time [%ld].\n", tzname[0],	39	- "daylight [%d] now [%ld] expire_time [%ld].\n", tzname[0],
51	- tzname[1], timezone, daylight, now, expire_time);	40	- tzname[1], timezone, daylight, now, expire_time);
52	+ "Time info: tzname[0] [%s] tzname[1] [%s] "	41	+ "Time info: tzname[0] [%s] tzname[1] [%s] "
53	+ "now [%ld] expire_time [%ld].\n", tzname[0],	42	+ "now [%ld] expire_time [%ld].\n", tzname[0],
54	+ tzname[1], now, expire_time);	43	+ tzname[1], now, expire_time);
55		44
56	if (difftime(now, expire_time) > 0.0) {	45	if (difftime(now, expire_time) > 0.0) {
57	DEBUG(SSSDBG_CONF_SETTINGS, "Kerberos password expired.\n");	46	DEBUG(SSSDBG_CONF_SETTINGS, "Kerberos password expired.\n");
58	@@ -924,7 +938,7 @@ void sdap_pam_chpass_handler(struct be_req *breq)	47	@@ -945,7 +960,7 @@ void sdap_pam_chpass_handler(struct be_r
59	DEBUG(SSSDBG_OP_FAILURE,	48	DEBUG(SSSDBG_OP_FAILURE,
60	"starting password change request for user [%s].\n", pd->user);	49	"starting password change request for user [%s].\n", pd->user);
61		50
Lines 64-70 Link Here
64		53
65	if (pd->cmd != SSS_PAM_CHAUTHTOK && pd->cmd != SSS_PAM_CHAUTHTOK_PRELIM) {	54	if (pd->cmd != SSS_PAM_CHAUTHTOK && pd->cmd != SSS_PAM_CHAUTHTOK_PRELIM) {
66	DEBUG(SSSDBG_OP_FAILURE,	55	DEBUG(SSSDBG_OP_FAILURE,
67	@@ -1069,7 +1083,7 @@ static void sdap_auth4chpass_done(struct tevent_req *r	56	@@ -1094,7 +1109,7 @@ static void sdap_auth4chpass_done(struct
68	dp_err = DP_ERR_OFFLINE;	57	dp_err = DP_ERR_OFFLINE;
69	break;	58	break;
70	default:	59	default:
Lines 73-79 Link Here
73	}	62	}
74		63
75	done:	64	done:
76	@@ -1131,7 +1145,7 @@ static void sdap_pam_chpass_done(struct tevent_req *re	65	@@ -1156,7 +1171,7 @@ static void sdap_pam_chpass_done(struct
77	state->sh, state->dn,	66	state->sh, state->dn,
78	lastchanged_name);	67	lastchanged_name);
79	if (subreq == NULL) {	68	if (subreq == NULL) {
Lines 82-88 Link Here
82	goto done;	71	goto done;
83	}	72	}
84		73
85	@@ -1152,7 +1166,7 @@ static void sdap_lastchange_done(struct tevent_req *re	74	@@ -1177,7 +1192,7 @@ static void sdap_lastchange_done(struct
86		75
87	ret = sdap_modify_shadow_lastchange_recv(req);	76	ret = sdap_modify_shadow_lastchange_recv(req);
88	if (ret != EOK) {	77	if (ret != EOK) {
Lines 91-97 Link Here
91	goto done;	80	goto done;
92	}	81	}
93		82
94	@@ -1193,7 +1207,7 @@ void sdap_pam_auth_handler(struct be_req *breq)	83	@@ -1218,7 +1233,7 @@ void sdap_pam_auth_handler(struct be_req
95	goto done;	84	goto done;
96	}	85	}
97		86
Lines 100-107 Link Here
100		89
101	switch (pd->cmd) {	90	switch (pd->cmd) {
102	case SSS_PAM_AUTHENTICATE:	91	case SSS_PAM_AUTHENTICATE:
103	@@ -1291,7 +1305,7 @@ static void sdap_pam_auth_done(struct tevent_req *req)	92	@@ -1307,7 +1322,7 @@ static void sdap_pam_auth_done(struct te
104	state->pd->pam_status = PAM_NEW_AUTHTOK_REQD;	93	state->pd->pam_status = PAM_PERM_DENIED;
105	break;	94	break;
106	default:	95	default:
107	- state->pd->pam_status = PAM_SYSTEM_ERR;	96	- state->pd->pam_status = PAM_SYSTEM_ERR;

Lines 1-27 Link Here

(-)security/sssd/files/patch-src__providers__ldap__sdap_access.c (-16 / +4 lines)
1	--- src/providers/ldap/sdap_access.c.orig 2014-09-17 13:01:37 UTC	1	--- src/providers/ldap/sdap_access.c.orig 2016-04-13 14:48:41 UTC
2	+++ src/providers/ldap/sdap_access.c	2	+++ src/providers/ldap/sdap_access.c
3	@@ -499,6 +499,7 @@ static bool nds_check_expired(const char *exp_time_str	3	@@ -557,9 +557,9 @@ bool nds_check_expired(const char *exp_t
4	return true;
5	}
6		4
7	+ tzset();
8	expire_time = mktime(&tm);
9	if (expire_time == -1) {
10	DEBUG(SSSDBG_CRIT_FAILURE,
11	@@ -506,13 +507,11 @@ static bool nds_check_expired(const char *exp_time_str
12	return true;
13	}
14
15	- tzset();
16	- expire_time -= timezone;
17	now = time(NULL);	5	now = time(NULL);
18	DEBUG(SSSDBG_TRACE_ALL,	6	DEBUG(SSSDBG_TRACE_ALL,
19	- "Time info: tzname[0] [%s] tzname[1] [%s] timezone [%ld] "	7	- "Time info: tzname[0] [%s] tzname[1] [%s] timezone [%ld] "
20	- "daylight [%d] now [%ld] expire_time [%ld].\n", tzname[0],	8	- "daylight [%d] now [%ld] expire_time [%ld].\n", tzname[0],
21	- tzname[1], timezone, daylight, now, expire_time);	9	- tzname[1], timezone, daylight, now, expire_time);
22	+ "Time info: tzname[0] [%s] tzname[1] [%s] "	10	+ "Time info: tzname[0] [%s] tzname[1] [%s] "
23	+ "now [%ld] expire_time [%ld].\n", tzname[0],	11	+ "now [%ld] expire_time [%ld].\n", tzname[0],
24	+ tzname[1], now, expire_time);	12	+ tzname[1], now, expire_time);
25		13
26	if (difftime(now, expire_time) > 0.0) {	14	if (difftime(now, expire_time) > 0.0) {
27	DEBUG(SSSDBG_CONF_SETTINGS, "NDS account expired.\n");	15	DEBUG(SSSDBG_CONF_SETTINGS, "NDS account expired.\n");

Lines 1-4 Link Here

(-)security/sssd/files/patch-src__sss_client__common.c (-9 / +46 lines)
1	--- src/sss_client/common.c.orig 2014-09-17 13:01:37 UTC	1	--- src/sss_client/common.c.orig 2016-04-13 14:48:41 UTC
2	+++ src/sss_client/common.c	2	+++ src/sss_client/common.c
3	@@ -25,6 +25,7 @@	3	@@ -25,6 +25,7 @@
4	#include "config.h"	4	#include "config.h"
Lines 16-22 Link Here
16		16
17	#if HAVE_PTHREAD	17	#if HAVE_PTHREAD
18	#include <pthread.h>	18	#include <pthread.h>
19	@@ -124,7 +126,6 @@ static enum sss_status sss_cli_send_req(enum sss_cli_c	19	@@ -124,7 +126,6 @@ static enum sss_status sss_cli_send_req(
20	*errnop = error;	20	*errnop = error;
21	break;	21	break;
22	case 0:	22	case 0:
Lines 24-30 Link Here
24	break;	24	break;
25	case 1:	25	case 1:
26	if (pfd.revents & (POLLERR \| POLLHUP \| POLLNVAL)) {	26	if (pfd.revents & (POLLERR \| POLLHUP \| POLLNVAL)) {
27	@@ -232,7 +233,6 @@ static enum sss_status sss_cli_recv_rep(enum sss_cli_c	27	@@ -232,7 +233,6 @@ static enum sss_status sss_cli_recv_rep(
28	*errnop = error;	28	*errnop = error;
29	break;	29	break;
30	case 0:	30	case 0:
Lines 32-38 Link Here
32	break;	32	break;
33	case 1:	33	case 1:
34	if (pfd.revents & (POLLHUP)) {	34	if (pfd.revents & (POLLHUP)) {
35	@@ -669,7 +669,6 @@ static enum sss_status sss_cli_check_socket(int *errno	35	@@ -669,7 +669,6 @@ static enum sss_status sss_cli_check_soc
36	*errnop = error;	36	*errnop = error;
37	break;	37	break;
38	case 0:	38	case 0:
Lines 40-46 Link Here
40	break;	40	break;
41	case 1:	41	case 1:
42	if (pfd.revents & (POLLERR \| POLLHUP \| POLLNVAL)) {	42	if (pfd.revents & (POLLERR \| POLLHUP \| POLLNVAL)) {
43	@@ -719,23 +718,23 @@ enum nss_status sss_nss_make_request(enum sss_cli_comm	43	@@ -719,7 +718,7 @@ enum nss_status sss_nss_make_request(enu
44	/* avoid looping in the nss daemon */	44	/* avoid looping in the nss daemon */
45	envval = getenv("_SSS_LOOPS");	45	envval = getenv("_SSS_LOOPS");
46	if (envval && strcmp(envval, "NO") == 0) {	46	if (envval && strcmp(envval, "NO") == 0) {
Lines 49-60 Link Here
49	}	49	}
50		50
51	ret = sss_cli_check_socket(errnop, SSS_NSS_SOCKET_NAME);	51	ret = sss_cli_check_socket(errnop, SSS_NSS_SOCKET_NAME);
52	if (ret != SSS_STATUS_SUCCESS) {	52	@@ -727,9 +726,9 @@ enum nss_status sss_nss_make_request(enu
		53	#ifdef NONSTANDARD_SSS_NSS_BEHAVIOUR
		54	*errnop = 0;
		55	errno = 0;
		56	- return NSS_STATUS_NOTFOUND;
		57	+ return NS_NOTFOUND;
		58	#else
53	- return NSS_STATUS_UNAVAIL;	59	- return NSS_STATUS_UNAVAIL;
54	+ return NS_UNAVAIL;	60	+ return NS_UNAVAIL;
		61	#endif
55	}	62	}
56		63
57	ret = sss_cli_make_request_nochecks(cmd, rd, repbuf, replen, errnop);	64	@@ -741,9 +740,9 @@ enum nss_status sss_nss_make_request(enu
		65	#ifdef NONSTANDARD_SSS_NSS_BEHAVIOUR
		66	*errnop = 0;
		67	errno = 0;
		68	- return NSS_STATUS_NOTFOUND;
		69	+ return NS_NOTFOUND;
		70	#else
		71	- return NSS_STATUS_UNAVAIL;
		72	+ return NS_UNAVAIL;
		73	#endif
		74	}
		75
		76	@@ -752,17 +751,17 @@ enum nss_status sss_nss_make_request(enu
		77	}
58	switch (ret) {	78	switch (ret) {
59	case SSS_STATUS_TRYAGAIN:	79	case SSS_STATUS_TRYAGAIN:
60	- return NSS_STATUS_TRYAGAIN;	80	- return NSS_STATUS_TRYAGAIN;
Lines 64-75 Link Here
64	+ return NS_SUCCESS;	84	+ return NS_SUCCESS;
65	case SSS_STATUS_UNAVAIL:	85	case SSS_STATUS_UNAVAIL:
66	default:	86	default:
		87	#ifdef NONSTANDARD_SSS_NSS_BEHAVIOUR
		88	*errnop = 0;
		89	errno = 0;
		90	- return NSS_STATUS_NOTFOUND;
		91	+ return NS_NOTFOUND;
		92	#else
67	- return NSS_STATUS_UNAVAIL;	93	- return NSS_STATUS_UNAVAIL;
68	+ return NS_UNAVAIL;	94	+ return NS_UNAVAIL;
		95	#endif
69	}	96	}
70	}	97	}
71		98	@@ -791,12 +790,12 @@ int sss_pac_make_request(enum sss_cli_co
72	@@ -750,23 +749,23 @@ int sss_pac_make_request(enum sss_cli_command cmd,
73	/* avoid looping in the nss daemon */	99	/* avoid looping in the nss daemon */
74	envval = getenv("_SSS_LOOPS");	100	envval = getenv("_SSS_LOOPS");
75	if (envval && strcmp(envval, "NO") == 0) {	101	if (envval && strcmp(envval, "NO") == 0) {
Lines 84-89 Link Here
84	}	110	}
85		111
86	ret = sss_cli_make_request_nochecks(cmd, rd, repbuf, replen, errnop);	112	ret = sss_cli_make_request_nochecks(cmd, rd, repbuf, replen, errnop);
		113	@@ -804,7 +803,7 @@ int sss_pac_make_request(enum sss_cli_co
		114	/* try reopen socket */
		115	ret = sss_cli_check_socket(errnop, SSS_PAC_SOCKET_NAME);
		116	if (ret != SSS_STATUS_SUCCESS) {
		117	- return NSS_STATUS_UNAVAIL;
		118	+ return NS_UNAVAIL;
		119	}
		120
		121	/* and make request one more time */
		122	@@ -812,12 +811,12 @@ int sss_pac_make_request(enum sss_cli_co
		123	}
87	switch (ret) {	124	switch (ret) {
88	case SSS_STATUS_TRYAGAIN:	125	case SSS_STATUS_TRYAGAIN:
89	- return NSS_STATUS_TRYAGAIN;	126	- return NSS_STATUS_TRYAGAIN;

Lines 1-17 Link Here

(-)security/sssd/files/patch-src__util__server.c (-10 / +4 lines)
1	--- src/util/server.c.orig 2014-09-17 13:01:37 UTC	1	--- src/util/server.c.orig 2016-04-13 14:48:41 UTC
2	+++ src/util/server.c	2	+++ src/util/server.c
3	@@ -322,12 +322,14 @@ static void setup_signals(void)	3	@@ -308,8 +308,11 @@ static void setup_signals(void)
4	BlockSignals(false, SIGTERM);
5
6	CatchSignal(SIGHUP, sig_hup);
7	-
8	#ifndef HAVE_PRCTL	4	#ifndef HAVE_PRCTL
9	- /* If prctl is not defined on the system, try to handle	5	/* If prctl is not defined on the system, try to handle
10	- * some common termination signals gracefully */	6	* some common termination signals gracefully */
11	- CatchSignal(SIGSEGV, sig_segv_abrt);	7	- CatchSignal(SIGSEGV, sig_segv_abrt);
12	- CatchSignal(SIGABRT, sig_segv_abrt);	8	- CatchSignal(SIGABRT, sig_segv_abrt);
13	+ /* If prctl is not defined on the system, try to handle
14	+ * some common termination signals gracefully */
15	+ (void) sig_segv_abrt; /* unused */	9	+ (void) sig_segv_abrt; /* unused */
16	+ /*	10	+ /*
17	+ CatchSignal(SIGSEGV, sig_segv_abrt);	11	+ CatchSignal(SIGSEGV, sig_segv_abrt);

Lines 1-71 Link Here

(-)security/sssd/files/patch-src__util__signal.c (-71 lines)
1	--- src/util/signal.c.orig 2014-09-17 13:01:37 UTC
2	+++ src/util/signal.c
3	@@ -28,45 +28,6 @@
4	* @brief Signal handling
5	*/
6
7	-/****************************************************************************
8	- Catch child exits and reap the child zombie status.
9	-****************************************************************************/
10	-
11	-static void sig_cld(int signum)
12	-{
13	- while (waitpid((pid_t)-1,(int *)NULL, WNOHANG) > 0)
14	- ;
15	-
16	- /*
17	- * Turns out it's really important not to
18	- * restore the signal handler here if we have real POSIX
19	- * signal handling. If we do, then we get the signal re-delivered
20	- * immediately - hey presto - instant loop ! JRA.
21	- */
22	-
23	-#if !defined(HAVE_SIGACTION)
24	- CatchSignal(SIGCLD, sig_cld);
25	-#endif
26	-}
27	-
28	-/****************************************************************************
29	-catch child exits - leave status;
30	-****************************************************************************/
31	-
32	-static void sig_cld_leave_status(int signum)
33	-{
34	- /*
35	- * Turns out it's really important not to
36	- * restore the signal handler here if we have real POSIX
37	- * signal handling. If we do, then we get the signal re-delivered
38	- * immediately - hey presto - instant loop ! JRA.
39	- */
40	-
41	-#if !defined(HAVE_SIGACTION)
42	- CatchSignal(SIGCLD, sig_cld_leave_status);
43	-#endif
44	-}
45	-
46	/**
47	Block sigs.
48	**/
49	@@ -125,22 +86,4 @@ void (CatchSignal(int signum,void (handler)(int )))(
50	/* FIXME: need to handle sigvec and systems with broken signal() */
51	return signal(signum, handler);
52	#endif
53	-}
54	-
55	-/**
56	- Ignore SIGCLD via whatever means is necessary for this OS.
57	-**/
58	-
59	-void CatchChild(void)
60	-{
61	- CatchSignal(SIGCLD, sig_cld);
62	-}
63	-
64	-/**
65	- Catch SIGCLD but leave the child around so it's status can be reaped.
66	-**/
67	-
68	-void CatchChildLeaveStatus(void)
69	-{
70	- CatchSignal(SIGCLD, sig_cld_leave_status);
71	}

Lines 1-18 Link Here

(-)security/sssd/files/patch-src__util__util.h (-14 / +9 lines)
1	--- src/util/util.h.orig 2014-09-17 13:01:37 UTC	1	--- src/util/util.h.orig 2016-04-13 14:48:41 UTC
2	+++ src/util/util.h	2	+++ src/util/util.h
3	@@ -227,8 +227,6 @@ void sig_term(int sig);	3	@@ -586,5 +586,10 @@
4	#include <signal.h>	4	* so that it's guaranteed the file is removed.
5	void BlockSignals(bool block, int signum);	5	*/
6	void (CatchSignal(int signum,void (handler)(int )))(int);	6	int sss_unique_filename(TALLOC_CTX owner, char path_tmpl);
7	-void CatchChild(void);
8	-void CatchChildLeaveStatus(void);
9
10	/* from memory.c */
11	typedef int (void_destructor_fn_t)(void *);
12	@@ -542,5 +540,6 @@ char * sss_replace_space(TALLOC_CTX *mem_ctx,
13	char * sss_reverse_replace_space(TALLOC_CTX *mem_ctx,
14	const char *orig_name,
15	const char replace_char);
16	+#include "util/sss_bsd_errno.h"	7	+#include "util/sss_bsd_errno.h"
		8	+
		9	+#ifndef N_ELEMENTS
		10	+#define N_ELEMENTS(arr) (sizeof(arr) / sizeof(arr[0]))
		11	+#endif
17		12
18	#endif /* __SSSD_UTIL_H__ */	13	#endif /* __SSSD_UTIL_H__ */

Lines 1-6 Link Here

(-)security/sssd/files/patch-src_external_pac__responder.m4 (-7 / +6 lines)
1	--- src/external/pac_responder.m4.orig 2014-09-17 13:01:37 UTC	1	--- src/external/pac_responder.m4.orig 2016-04-13 14:48:41 UTC
2	+++ src/external/pac_responder.m4	2	+++ src/external/pac_responder.m4
3	@@ -14,14 +14,19 @@ then	3	@@ -14,7 +14,7 @@ then
4	PKG_CHECK_MODULES(NDR_KRB5PAC, ndr_krb5pac, ndr_krb5pac_ok=yes,	4	PKG_CHECK_MODULES(NDR_KRB5PAC, ndr_krb5pac, ndr_krb5pac_ok=yes,
5	AC_MSG_WARN([Cannot build pac responder without libndr_krb5pac]))	5	AC_MSG_WARN([Cannot build pac responder without libndr_krb5pac]))
6		6
Lines 9-20 Link Here
9	AC_MSG_CHECKING(for supported MIT krb5 version)	9	AC_MSG_CHECKING(for supported MIT krb5 version)
10	KRB5_VERSION="`$KRB5_CONFIG --version`"	10	KRB5_VERSION="`$KRB5_CONFIG --version`"
11	case $KRB5_VERSION in	11	case $KRB5_VERSION in
12	Kerberos\ 5\ release\ 1.9* \| \	12	@@ -23,7 +23,10 @@ then
13	Kerberos\ 5\ release\ 1.10* \| \
14	Kerberos\ 5\ release\ 1.11* \| \	13	Kerberos\ 5\ release\ 1.11* \| \
15	- Kerberos\ 5\ release\ 1.12*)	14	Kerberos\ 5\ release\ 1.12* \| \
16	+ Kerberos\ 5\ release\ 1.12* \| \	15	Kerberos\ 5\ release\ 1.13* \| \
17	+ Kerberos\ 5\ release\ 1.13* \| \	16	- Kerberos\ 5\ release\ 1.14*)
18	+ Kerberos\ 5\ release\ 1.14* \| \	17	+ Kerberos\ 5\ release\ 1.14* \| \
19	+ Kerberos\ 5\ release\ 1.15* \| \	18	+ Kerberos\ 5\ release\ 1.15* \| \
20	+ Kerberos\ 5\ release\ 1.16* \| \	19	+ Kerberos\ 5\ release\ 1.16* \| \

Lines 5-39 Link Here

(-)security/sssd/pkg-plist (-28 / +74 lines)
5	include/ipa_hbac.h	5	include/ipa_hbac.h
6	include/sss_idmap.h	6	include/sss_idmap.h
7	include/sss_nss_idmap.h	7	include/sss_nss_idmap.h
		8	include/sss_sifp_dbus.h
		9	include/sss_sifp.h
		10	include/wbclient_sssd.h
		11	%%SMB%%lib/krb5/plugins/authdata/sssd_pac_plugin.so
8	lib/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so	12	lib/krb5/plugins/libkrb5/sssd_krb5_locator_plugin.so
9	lib/libipa_hbac.so	13	lib/libipa_hbac.so
10	lib/libipa_hbac.so.0	14	lib/libipa_hbac.so.0
11	lib/libipa_hbac.so.0.0.1	15	lib/libipa_hbac.so.0.0.1
12	lib/libsss_idmap.so	16	lib/libsss_idmap.so
13	lib/libsss_idmap.so.0	17	lib/libsss_idmap.so.0
14	lib/libsss_idmap.so.0.4.0	18	lib/libsss_idmap.so.0.5.0
15	lib/libsss_nss_idmap.so	19	lib/libsss_nss_idmap.so
16	lib/libsss_nss_idmap.so.0	20	lib/libsss_nss_idmap.so.0
17	lib/libsss_nss_idmap.so.0.0.1	21	lib/libsss_nss_idmap.so.0.1.0
		22	lib/libsss_simpleifp.so
		23	lib/libsss_simpleifp.so.0
		24	lib/libsss_simpleifp.so.0.0.1
18	lib/libsss_sudo.so	25	lib/libsss_sudo.so
19	lib/nss_sss.so	26	lib/nss_sss.so
20	lib/nss_sss.so.1	27	lib/nss_sss.so.1
21	lib/nss_sss.so.2	28	lib/nss_sss.so.2
22	lib/nss_sss.so.2.0.0	29	lib/nss_sss.so.2.0.0
23	lib/pam_sss.so	30	lib/pam_sss.so
24	%%PYTHON_SITELIBDIR%%/SSSDConfig-1.11.7-py%%PYTHON_VER%%.egg-info	31	%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/pyhbac.so
25	%%PYTHON_SITELIBDIR%%/SSSDConfig/__init__.py	32	%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/pysss_murmur.so
26	%%PYTHON_SITELIBDIR%%/SSSDConfig/__init__.pyc	33	%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/pysss_nss_idmap.so
27	%%PYTHON_SITELIBDIR%%/SSSDConfig/ipachangeconf.py	34	%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/pysss.so
28	%%PYTHON_SITELIBDIR%%/SSSDConfig/ipachangeconf.pyc	35	%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig-%%PORTVERSION%%-py%%PYTHON_VER%%.egg-info
29	%%PYTHON_SITELIBDIR%%/SSSDConfig/sssd_upgrade_config.py	36	%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/__init__.py
30	%%PYTHON_SITELIBDIR%%/SSSDConfig/sssd_upgrade_config.pyc	37	%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/ipachangeconf.py
31	%%PYTHON_SITELIBDIR%%/pyhbac.so	38	%%PYTHON%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/sssd_upgrade_config.py
32	%%PYTHON_SITELIBDIR%%/pysss.so	39	%%PYTHON2%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/__init__.pyc
33	%%PYTHON_SITELIBDIR%%/pysss_murmur.so	40	%%PYTHON2%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/ipachangeconf.pyc
34	%%PYTHON_SITELIBDIR%%/pysss_nss_idmap.so	41	%%PYTHON2%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/sssd_upgrade_config.pyc
		42	%%PYTHON3%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/__pycache__/__init__.cpython-37.pyc
		43	%%PYTHON3%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/__pycache__/ipachangeconf.cpython-37.pyc
		44	%%PYTHON3%%%%PYTHONPREFIX_SITELIBDIR%%/SSSDConfig/__pycache__/sssd_upgrade_config.cpython-37.pyc
35	lib/shared-modules/ldb/memberof.so	45	lib/shared-modules/ldb/memberof.so
36	%%SMB%%lib/sssd/libsss_ad.so	46	%%SMB%%lib/sssd/libsss_ad.so
		47	lib/sssd/libsss_cert.so
37	lib/sssd/libsss_child.so	48	lib/sssd/libsss_child.so
38	lib/sssd/libsss_crypt.so	49	lib/sssd/libsss_crypt.so
39	lib/sssd/libsss_debug.so	50	lib/sssd/libsss_debug.so
Lines 45-70 Link Here
45	lib/sssd/libsss_proxy.so	56	lib/sssd/libsss_proxy.so
46	lib/sssd/libsss_simple.so	57	lib/sssd/libsss_simple.so
47	lib/sssd/libsss_util.so	58	lib/sssd/libsss_util.so
		59	lib/sssd/libsss_semanage.so
		60	lib/sssd/modules/libwbclient.so
		61	lib/sssd/modules/libwbclient.so.0
		62	lib/sssd/modules/libwbclient.so.0.12.0
		63	lib/sssd/modules/sssd_krb5_localauth_plugin.so
48	libdata/pkgconfig/ipa_hbac.pc	64	libdata/pkgconfig/ipa_hbac.pc
49	libdata/pkgconfig/sss_idmap.pc	65	libdata/pkgconfig/sss_idmap.pc
50	libdata/pkgconfig/sss_nss_idmap.pc	66	libdata/pkgconfig/sss_nss_idmap.pc
		67	libdata/pkgconfig/sss_simpleifp.pc
		68	libdata/pkgconfig/wbclient_sssd.pc
		69	%%SMB%%libexec/sssd/gpo_child
51	libexec/sssd/krb5_child	70	libexec/sssd/krb5_child
52	libexec/sssd/ldap_child	71	libexec/sssd/ldap_child
		72	libexec/sssd/p11_child
53	libexec/sssd/proxy_child	73	libexec/sssd/proxy_child
54	libexec/sssd/sss_signal	74	libexec/sssd/sss_signal
55	libexec/sssd/sssd_be	75	libexec/sssd/sssd_be
56	libexec/sssd/sssd_ifp	76	libexec/sssd/sssd_ifp
57	libexec/sssd/sssd_nss	77	libexec/sssd/sssd_nss
		78	%%SMB%%libexec/sssd/sssd_pac
58	libexec/sssd/sssd_pam	79	libexec/sssd/sssd_pam
59	libexec/sssd/sssd_ssh	80	libexec/sssd/sssd_ssh
60	libexec/sssd/sssd_sudo	81	libexec/sssd/sssd_sudo
61	man/es/man1/sss_ssh_authorizedkeys.1.gz	82	man/de/man1/sss_ssh_authorizedkeys.1.gz
		83	man/de/man1/sss_ssh_knownhostsproxy.1.gz
		84	man/de/man5/sssd-ifp.5.gz
		85	man/de/man5/sssd-krb5.5.gz
		86	man/de/man5/sssd-ldap.5.gz
		87	man/de/man5/sssd-simple.5.gz
		88	man/de/man5/sssd-sudo.5.gz
		89	man/de/man5/sssd.conf.5.gz
		90	man/de/man8/pam_sss.8.gz
		91	man/de/man8/sss_cache.8.gz
		92	man/de/man8/sss_debuglevel.8.gz
		93	man/de/man8/sss_groupadd.8.gz
		94	man/de/man8/sss_groupdel.8.gz
		95	man/de/man8/sss_groupmod.8.gz
		96	man/de/man8/sss_groupshow.8.gz
		97	man/de/man8/sss_obfuscate.8.gz
		98	man/de/man8/sss_seed.8.gz
		99	man/de/man8/sss_useradd.8.gz
		100	man/de/man8/sss_userdel.8.gz
		101	man/de/man8/sss_usermod.8.gz
		102	man/de/man8/sssd_krb5_locator_plugin.8.gz
		103	man/de/man8/sssd.8.gz
62	man/es/man1/sss_ssh_knownhostsproxy.1.gz	104	man/es/man1/sss_ssh_knownhostsproxy.1.gz
63	man/es/man5/sssd-ldap.5.gz	105	man/es/man5/sssd-ldap.5.gz
64	man/es/man5/sssd-simple.5.gz	106	man/es/man5/sssd-simple.5.gz
65	man/es/man5/sssd-sudo.5.gz	107	man/es/man5/sssd-sudo.5.gz
66	man/es/man5/sssd.conf.5.gz
67	man/es/man8/pam_sss.8.gz
68	man/es/man8/sss_cache.8.gz	108	man/es/man8/sss_cache.8.gz
69	man/es/man8/sss_debuglevel.8.gz	109	man/es/man8/sss_debuglevel.8.gz
70	man/es/man8/sss_groupadd.8.gz	110	man/es/man8/sss_groupadd.8.gz
Lines 80-86 Link Here
80	man/es/man8/sssd_krb5_locator_plugin.8.gz	120	man/es/man8/sssd_krb5_locator_plugin.8.gz
81	man/fr/man1/sss_ssh_authorizedkeys.1.gz	121	man/fr/man1/sss_ssh_authorizedkeys.1.gz
82	man/fr/man1/sss_ssh_knownhostsproxy.1.gz	122	man/fr/man1/sss_ssh_knownhostsproxy.1.gz
83	man/fr/man5/sssd-ad.5.gz
84	man/fr/man5/sssd-krb5.5.gz	123	man/fr/man5/sssd-krb5.5.gz
85	man/fr/man5/sssd-ldap.5.gz	124	man/fr/man5/sssd-ldap.5.gz
86	man/fr/man5/sssd-simple.5.gz	125	man/fr/man5/sssd-simple.5.gz
Lines 103-112 Link Here
103	man/ja/man1/sss_ssh_authorizedkeys.1.gz	142	man/ja/man1/sss_ssh_authorizedkeys.1.gz
104	man/ja/man1/sss_ssh_knownhostsproxy.1.gz	143	man/ja/man1/sss_ssh_knownhostsproxy.1.gz
105	man/ja/man5/sssd-krb5.5.gz	144	man/ja/man5/sssd-krb5.5.gz
106	man/ja/man5/sssd-ldap.5.gz
107	man/ja/man5/sssd-simple.5.gz	145	man/ja/man5/sssd-simple.5.gz
108	man/ja/man5/sssd.conf.5.gz
109	man/ja/man8/pam_sss.8.gz
110	man/ja/man8/sss_cache.8.gz	146	man/ja/man8/sss_cache.8.gz
111	man/ja/man8/sss_debuglevel.8.gz	147	man/ja/man8/sss_debuglevel.8.gz
112	man/ja/man8/sss_groupadd.8.gz	148	man/ja/man8/sss_groupadd.8.gz
Lines 121-129 Link Here
121	man/ja/man8/sssd_krb5_locator_plugin.8.gz	157	man/ja/man8/sssd_krb5_locator_plugin.8.gz
122	man/man1/sss_ssh_authorizedkeys.1.gz	158	man/man1/sss_ssh_authorizedkeys.1.gz
123	man/man1/sss_ssh_knownhostsproxy.1.gz	159	man/man1/sss_ssh_knownhostsproxy.1.gz
124	man/man5/sssd-ad.5.gz	160	%%SMB%%man/man5/sssd-ad.5.gz
125	man/man5/sssd-ifp.5.gz	161	man/man5/sssd-ifp.5.gz
126	man/man5/sssd-ipa.5.gz	162	%%SMB%%man/man5/sssd-ipa.5.gz
127	man/man5/sssd-krb5.5.gz	163	man/man5/sssd-krb5.5.gz
128	man/man5/sssd-ldap.5.gz	164	man/man5/sssd-ldap.5.gz
129	man/man5/sssd-simple.5.gz	165	man/man5/sssd-simple.5.gz
Lines 137-142 Link Here
137	man/man8/sss_groupmod.8.gz	173	man/man8/sss_groupmod.8.gz
138	man/man8/sss_groupshow.8.gz	174	man/man8/sss_groupshow.8.gz
139	man/man8/sss_obfuscate.8.gz	175	man/man8/sss_obfuscate.8.gz
		176	man/man8/sss_override.8.gz
140	man/man8/sss_seed.8.gz	177	man/man8/sss_seed.8.gz
141	man/man8/sss_useradd.8.gz	178	man/man8/sss_useradd.8.gz
142	man/man8/sss_userdel.8.gz	179	man/man8/sss_userdel.8.gz
Lines 148-155 Link Here
148	man/pt/man8/sss_groupmod.8.gz	185	man/pt/man8/sss_groupmod.8.gz
149	man/uk/man1/sss_ssh_authorizedkeys.1.gz	186	man/uk/man1/sss_ssh_authorizedkeys.1.gz
150	man/uk/man1/sss_ssh_knownhostsproxy.1.gz	187	man/uk/man1/sss_ssh_knownhostsproxy.1.gz
		188	man/uk/man5/sss_rpcidmapd.5.gz
151	man/uk/man5/sssd-ad.5.gz	189	man/uk/man5/sssd-ad.5.gz
152	man/uk/man5/sssd-ifp.5.gz	190	man/uk/man5/sssd-ifp.5.gz
		191	man/uk/man5/sssd-ipa.5.gz
153	man/uk/man5/sssd-krb5.5.gz	192	man/uk/man5/sssd-krb5.5.gz
154	man/uk/man5/sssd-ldap.5.gz	193	man/uk/man5/sssd-ldap.5.gz
155	man/uk/man5/sssd-simple.5.gz	194	man/uk/man5/sssd-simple.5.gz
Lines 167-181 Link Here
167	man/uk/man8/sss_useradd.8.gz	206	man/uk/man8/sss_useradd.8.gz
168	man/uk/man8/sss_userdel.8.gz	207	man/uk/man8/sss_userdel.8.gz
169	man/uk/man8/sss_usermod.8.gz	208	man/uk/man8/sss_usermod.8.gz
170	man/uk/man8/sssd.8.gz
171	man/uk/man8/sssd_krb5_locator_plugin.8.gz	209	man/uk/man8/sssd_krb5_locator_plugin.8.gz
		210	man/uk/man8/sssd.8.gz
172	sbin/sss_cache	211	sbin/sss_cache
173	sbin/sss_debuglevel	212	sbin/sss_debuglevel
174	sbin/sss_groupadd	213	sbin/sss_groupadd
175	sbin/sss_groupdel	214	sbin/sss_groupdel
176	sbin/sss_groupmod	215	sbin/sss_groupmod
177	sbin/sss_groupshow	216	sbin/sss_groupshow
178	sbin/sss_obfuscate	217	%%PYTHON%%sbin/sss_obfuscate
		218	sbin/sss_override
179	sbin/sss_seed	219	sbin/sss_seed
180	sbin/sss_useradd	220	sbin/sss_useradd
181	sbin/sss_userdel	221	sbin/sss_userdel
Lines 188-194 Link Here
188	%%PORTDOCS%%@dir %%DOCSDIR%%/idmap_doc	228	%%PORTDOCS%%@dir %%DOCSDIR%%/idmap_doc
189	%%PORTDOCS%%@dir %%DOCSDIR%%/libsss_sudo_doc	229	%%PORTDOCS%%@dir %%DOCSDIR%%/libsss_sudo_doc
190	%%PORTDOCS%%@dir %%DOCSDIR%%/nss_idmap_doc	230	%%PORTDOCS%%@dir %%DOCSDIR%%/nss_idmap_doc
191	@postexec if [ -d %%ETCDIR%% ]; then echo "==> If you are permanently removing this port, you should do a ``rm -rf %%ETCDIR%%`` to remove any configuration files."; fi	231	%%PORTDOCS%%@dir %%DOCSDIR%%/sss_simpleifp_doc
192	@postexec if [ -d /var/db/sss ]; then echo "==> If you are permanently removing this port, you should do a ``rm -rf /var/db/sss`` to remove any additional files."; fi	232	@dir /var/db/sss
193	@postexec if [ -d /var/db/sss_mc ]; then echo "==> If you are permanently removing this port, you should do a ``rm -rf /var/db/sss_mc`` to remove any additional files."; fi	233	@dir /var/db/sss/db
194	@postexec if [ -d /var/run/sss ]; then echo "==> If you are permanently removing this port, you should do a ``rm -rf /var/run/sss`` to remove any additional files."; fi	234	@dir /var/db/sss/gpo_cache
		235	@dir /var/db/sss/keytabs
		236	@dir /var/db/sss/mc
		237	@dir /var/log/sssd
		238	@dir /var/run/sss
		239	@dir /var/run/sss/krb5.include.d
		240	@dir /var/run/sss/private