summaryrefslogtreecommitdiffstats
path: root/contrib/sssd.spec.in
Commit message (Collapse)AuthorAgeFilesLines
* SPEC: Change package ownership of %{pubconfpath}/krb5.include.dLukas Slebodnik2016-01-111-1/+1
| | | | | | | | | | | | | krb5 domain mapping files are stored to the directory %{pubconfpath}/krb5.include.d. It can be stored by ipa or ad provider. However this directory was owned by sub-package sssd-ipa. And ad provider can be installed without this package. Therefore %{pubconfpath}/krb5.include.d should be owned by common dependency. The owner of this directory was also fixed to sssd. It's already done by make install. It was changed only in spec file. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Only install polkit rules if the directory is availableJakub Hrozek2015-11-261-0/+3
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* p11: allow p11_child to run completely unprivilegedSumit Bose2015-11-201-1/+12
| | | | | | | | | | | | | | | | To only operation of p11_child which requires special privileges is the communication to pcscd which handles the Smartcard access. pcscd uses policy-kit for access control so access can easily be configured by dropping config snippets into the right directory. If SSSD is configured to run as un-privileged user this patch creates the needed config snippet for policy-kit and installs it in a suitable directory. As a result p11_child does not have to be installed with SETUID or SETGID bits set. Resolves https://fedorahosted.org/sssd/ticket/2755 by making it obsolete Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* spec: Missing initgroups mmap fileMichal Židek2015-10-221-0/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Avoid symlinks with python modulesLukas Slebodnik2015-10-121-8/+0
| | | | | | | | | | | | | We need to use different names for python{2,3} modules if we want to build them in the same time with automake (prefix _py2 and _py3). But resulting name need to correspond with name of module because it is used in C import function. We used symbolic links for that purpose but it breaks debian python tools which rename the real modules making symbolic links to point nowhere Resolves: https://fedorahosted.org/sssd/ticket/2814 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* BUILD: Do not build libsss_ad_common.la as libraryLukas Slebodnik2015-09-241-1/+0
| | | | | | | | | | | | libsss_ad_common.la was a dynamic library and was linked just with unit tests. It was a workaroud because module libsss_ad.so cannot be linked with tests without portability issues. But it was addted to pkglib_LTLIBRARIES and therefore it was installed with other libraries. This patch changed it and libsss_ad_test.la (old name libsss_ad_common.la) will be compiled only for unit tests (check_LTLIBRARIES) and will not be installed with command "make install". Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SPEC: Workaround for build with rpm 4.13Lukas Slebodnik2015-08-051-0/+3
| | | | | | | | | | | | | If the tarball is generated with minimal dependencies extracted from spec file then translated manual pages are not generated due to missing script po4a. This step is not necessary for regular nightly/developer builds. The tarball is created faster without such step. However rpm >= 4.13 will fail due to empty manifest file. Resolves: https://fedorahosted.org/sssd/ticket/2738 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* Add NSS version of p11_childSumit Bose2015-07-311-0/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* utils: add NSS version of cert utilsSumit Bose2015-07-311-1/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SPEC: Update spec file for krb5_local_auth_pluginLukas Slebodnik2015-07-291-5/+2
| | | | | | | | | | | | | | | | krb5_localauth_plugin could be build only with MIT kerberos >= 1.12. However, this feature was backported in downstream to older version of kerberos. So there were packaging failures error: Installed (but unpackaged) file(s) found: /usr/lib/sssd/modules/sssd_krb5_localauth_plugin.so RPM build errors: Installed (but unpackaged) file(s) found: /usr/lib/sssd/modules/sssd_krb5_localauth_plugin.so Child returncode was: 1 EXCEPTION: Command failed. See logs for output. Reviewed-by: Petr Cech <pcech@redhat.com>
* TOOLS: add sss_override for local overridesPavel Březina2015-07-271-0/+2
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2584 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* certs: add PEM/DER conversion utilitiesSumit Bose2015-06-191-0/+2
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* BUILD: Store keytabs in /var/lib/sss/keytabsJakub Hrozek2015-06-161-1/+2
| | | | | | Make sure the directory is only accessible to the sssd user Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: Fetch keytab for 1way trustsJakub Hrozek2015-06-141-0/+1
| | | | | | | | | Uses the ipa-getkeytab call to retrieve keytabs for one-way trust relationships. https://fedorahosted.org/sssd/ticket/2636 Reviewed-by: Sumit Bose <sbose@redhat.com>
* PROXY: proxy_child should work in non-root modeLukas Slebodnik2015-05-311-1/+1
| | | | | | | | | | | | | | | | | | | According to design page[1], proxy_child should run with root privileges in non-root mode however proxy_child did not have setuid bit. After setting setuid bit proxy_child will be executed with extra privileges. The effective user ID will be 0 but effective group ID will be still the same as egid of sssd_be. Therefore gid of private pipe for proxy_child should be the same. Otherwise proxy_child will fail due to wrong permissions of unix pipe (sbus_client_init -> check_file) [1] https://fedorahosted.org/sssd/wiki/DesignDocs/NotRootSSSD Resolves: https://fedorahosted.org/sssd/ticket/2655 Reviewed-by: Michal Židek <mzidek@redhat.com>
* SPEC: Fix cyclic dependencies between sssd-{krb5,}-commonLukas Slebodnik2015-05-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | libsss_ldap_common(sssd-common) requires libsss_krb5_common.so(sssd-krb5-common) and sssd-krb5-common requires sssd-common. sh$ nm --dynamic --defined-only /usr/lib64/sssd/libsss_krb5_common.so 000000000000c4d0 T krb5_service_init 000000000000b8c0 T krb5_try_kdcip 000000000000c710 T remove_krb5_info_files 0000000000014960 T select_principal_from_keytab 00000000000141d0 T sss_krb5_get_error_message sh$ nm --dynamic --undefined-only /usr/lib64/sssd/libsss_ldap_common.so U krb5_service_init U krb5_try_kdcip U remove_krb5_info_files U select_principal_from_keytab U sss_krb5_get_error_message This patch fix cyclic dependency with rpm packaging becuase it's not simple task to remove krb5 dependency from ldap provider. Resolves: https://fedorahosted.org/sssd/ticket/2507 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SPEC: Few cosmetic changesLukas Slebodnik2015-04-081-6/+4
| | | | | | | | - removed unnecessary blank lines (leftover after many changes) - list manual pages according to section number - add missing white spaces to shall scripts Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SPEC: Remove unused optionLukas Slebodnik2015-04-081-1/+0
| | | | | | | | | | The optional definition of rpm macro with_ccache was removed in patch "BUILD: Remove unnecessary patch and configure opts" as a part of ticket https://fedorahosted.org/sssd/ticket/2036. It is not used anymore so it can be removed. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SPEC: Drop workarounds for old rpmbuildLukas Slebodnik2015-04-081-9/+0
| | | | | | | Old versions of rpmbuild require ghost files to be present in the buildroot. It was mainly problem of rpmbuild on rhel5 which is not supported anymore. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SPEC: Drop workaround for old libtoolLukas Slebodnik2015-04-081-9/+0
| | | | | | | This workaround was for libtool in rhel 5 and we dropped support for it few months ago due to missing dependencies. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RPM: BuildRequire libcmocka >= 1.0Jakub Hrozek2015-03-111-1/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SPEC: Build python3 bindings on available platformsLukas Slebodnik2015-02-251-8/+136
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2574 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* SPEC: Replace python_ macros with python2_Lukas Slebodnik2015-02-251-14/+20
| | | | Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* BUILD: Add possibility to build python{2,3} bindingsLukas Slebodnik2015-02-251-0/+4
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2574 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* SPEC: Move python bindings to separate packagesLukas Slebodnik2015-02-251-2/+33
| | | | | | | Some pyhton bindings pysss and pysss_murmur was in package sssd-common. Therefore package sssd-common had python as a dependency. Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* SPEC: Use new convention for python packagesLukas Slebodnik2015-02-251-8/+12
| | | | Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* SPEC: Use libnl3 for epel6Lukas Slebodnik2015-01-201-4/+0
| | | | | | RHEL6.6 contains libnl3. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* spec: sifp requires sssd-dbusPavel Březina2015-01-091-0/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2550 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Install krb5_child as suid if running under non-privileged userJakub Hrozek2014-11-181-1/+1
| | | | | | | | | | | If sssd_be is running unprivileged, then krb5_child must be setuid to be able to access the keytab and become arbitrary user. Related: https://fedorahosted.org/sssd/ticket/2370 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: Move setting the SELinux context to a child processJakub Hrozek2014-11-051-0/+1
| | | | | | | | In order for the sssd_be process to run as unprivileged user, we need to move the semanage processing to a process that runs as the root user using setuid privileges. Reviewed-by: Michal Židek <mzidek@redhat.com>
* BUILD: Install ldap_child and as setuid if running under non-privileged userJakub Hrozek2014-11-051-1/+1
| | | | | | | | The ldap_child permissions should be 4750, owned by root.sssd, to make sure only root and sssd can execute the child and if executed by sssd, the child will run as root. Reviewed-by: Michal Židek <mzidek@redhat.com>
* SPEC: Print testsuite log for failed testLukas Slebodnik2014-10-221-1/+1
| | | | | | | | | | Starting from Automake 1.13, the parallel testsuite harness has been made the default one; this harness is quite silent. VERBOSE=yes will displays the logs of the non-passed tests (i.e., only of the failed or skipped ones, or of the ones that passed unexpectedly). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RPM: Change file ownership to sssd.sssdJakub Hrozek2014-10-221-11/+15
| | | | | | | | | | | | | Adds a private SSSD user in the %pre section of SSSD specfile. Also changes the ownership of SSSD private directories to sssd.sssd. Does not change the configure time default, so SSSD will still run as root. The file and directory ownership does not widen, because the directories are still only accessible by the private user (whose shell is /sbin/nologin) and of course the root user. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* RPM: Package the libsss_semanage.so libraryJakub Hrozek2014-10-201-0/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Add a test to change user IDsJakub Hrozek2014-10-101-0/+4
| | | | | | | Adds a unit test using the nss_wrapper and uid_wrapper libraries that exercises the ability to become another user. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* libwbclient: avoid collision with Samba versionSumit Bose2014-09-081-4/+4
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* NFSv4 client: man pageNoam Meltzer2014-09-081-0/+1
| | | | | | | | changes from previous patch: * fixed idmapd.conf example (sss plugin name) * squahsed the rpm spec into one commit Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SPEC: Drop old OS conditions from spec file.Lukas Slebodnik2014-09-051-75/+4
| | | | | | | | | | | It can be possible to build current master without samba on rhel5, but the spec file would be very complicated. It is better to simplify spec file. Resolves: https://fedorahosted.org/sssd/ticket/1974 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SPEC: Use netlink library version 3 for rhel7Lukas Slebodnik2014-09-051-1/+3
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NFSv4 client: add to RPM specNoam Meltzer2014-09-021-0/+7
| | | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Roland Mainz <rmainz@redhat.com>
* Add conditional build for MIT Kerberos localauth pluginSumit Bose2014-09-021-0/+12
| | | | | | | | This patch adds everything what is needed to build the MIT Kerberos localauth plugin if the used version of MIT Kerberos supports it. It does not implement the plugin. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* libwbclient: SSSD implementationSumit Bose2014-08-211-0/+26
| | | | | | | | | | | | | | | | | | | | | | | This patch implements the libwbclient API for Samba daemons and utilities. The main purpose is to map Active Directory users and groups identified by their SID to POSIX users and groups identified by their POSIX UIDs and GIDs respectively. The API is not fully implemented because SSSD does not support some AD features like WINS or NTLM. Additionally this implementation has its focus on the file-server use case and hence does not implement some features which might be needed for a domain controller use case. Some API calls are generic and independent of the backend like e.g. converting binary SIDs and GUIDs into a string representation and back or memory allocation and deallocation. These parts are taken from the original Samba sources together with copyright and authors. Files with'_sssd' as part of the name contain the SSSD related calls. Resolves: https://fedorahosted.org/sssd/ticket/1588 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RPM: Restart service in %posttrans, not %postJakub Hrozek2014-08-111-3/+2
| | | | | | | | | | | | | | | When upgrading from a 1.9 version with monolithic packaging to 1.10 or later with per-provider subpackage, sssd-common can be upgraded (and restarted) before the new sssd-$provider is restarted. This can lead to a startup failure, because the sssd_be process from already upgraded sssd-common would attempt to load a sssd_$provider.so from the legacy sssd package. Restarting the service in %posttrans makes sure all the packages are in place when we restart the service. Resolves: https://fedorahosted.org/sssd/ticket/2399
* AD-GPO: Store policy settings in local filesYassir Elley2014-07-201-0/+3
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* BUILD: Add the DBus service activationJakub Hrozek2014-07-081-0/+1
| | | | | | | | The system bus has the ability to start services on demant. This patch adds the sysbus service activation file that, currently, only calls the sss_signal tool to signal the monitor. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TOOLS: New helper tool sss_signalJakub Hrozek2014-07-081-0/+1
| | | | | | | | A minimal tool whose only purpose is to signal the monitor with SIGUSR2. The tool will be executed by the system bus in order to provide system activation, so it's packaged in libexec. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SPEC: Add gpo_child to package sssd-adLukas Slebodnik2014-07-011-0/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD-GPO: Add gpo-smb implementation in gpo_child processYassir Elley2014-07-011-1/+1
| | | | Reviewed-by: Sumit Bose <sbose@redhat.com>
* sss_sifp: buildPavel Březina2014-05-291-0/+38
| | | | | | https://fedorahosted.org/sssd/ticket/2254 Reviewed-by: Sumit Bose <sbose@redhat.com>
* contrib: add BuildRequires libsmbclient-devel to spec fileSumit Bose2014-05-231-0/+1
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2024-11-15 19:01:10 +0000