gentoo resync : 19.03.2019

4 files changed, 111 insertions, 13 deletions

diff --git a/sys-auth/sssd/Manifest b/sys-auth/sssd/Manifest
index 9466fb6269e0..d3ecad02c4a2 100644
--- a/sys-auth/sssd/Manifest
+++ b/sys-auth/sssd/Manifest
@@ -1,9 +1,10 @@
 AUX sssd 489 BLAKE2B 552ffc9c5053e6de3e4d59ae50cbd95ae44460f51d7f753d9792eefb10507225a32beb91c1a47adf0ddbffff339a245f09c260738a781d05a0a955b8bf283148 SHA512 eab8d42d0188e55a18803b738af77c1969bf7c4b59503ee99975d4739e3c532c300e394a393327b7b98254672c1c2b0b15f81c9c27479e7cbbfb4995ab12b43e
 AUX sssd-curl-macros.patch 1104 BLAKE2B c03179ab4d608988316224b184c6bc349230e4ee4b79b866615ceb76f091cc28a667f09a591a8b3b98655d1f6160d2e49a4df4177e616d27e7f1e50d465642dc SHA512 77b311c7a8101e5facf046d08deb7a7d363ef6e393fa44feddf82e1398dede44aa3ac57555c10496b5ba1ca370f0f6370ba8c7cd1ae80a3b2657c3e3f9fbb063
+AUX sssd-fix-CVE-2019-3811.patch 3745 BLAKE2B c09dcdd2d4f698771e099c1aca008a42833375b0d723348ead780f84ce3491b54b7a9266b83c5c7e481ec997f69662bd45e33520a0b1ec37b93a8ef800093985 SHA512 b9d95fb9515e367dd7d645778f330a5c7c7fadb9c49ddbbcd78aee18c5918d0bb8e45735c508bf1f574307afc6076a34c420cacb7963b70333e0f678ff3864b6
 AUX sssd.conf 124 BLAKE2B b6f9c016a014510f97b036d23d5f50e1e13085220fe82b0e6ef7a3ceeb114e59af935f39e66e4ad60a46f43983930e5d381b16b0ed31ba4349abe38c4b509367 SHA512 f16908c44b213edbf6b0c6e8d49df92e8c06fc623279037074fe51e49b8aca7dc18f5ed83f71909fc8209df80dfc150583edb1687f88e61588bdf9d1fbf6ed5a
 AUX sssd.service 341 BLAKE2B 0cffcd43786633aa8e5bb42c54741cba676021c5a07554b08499504f8f630ff821ff334a21e2a4f9ae2d77d70d969018dd5a85d11b12bb31235a0ffcda4105c8 SHA512 99510d11f390722f56bc164059033fc40299dd4ea29f98cd5f08b2648f31b2e70afeb6b2d90f919bde595546c80b4e6941cf6f48130661ead09c0576043e4cf5
 DIST sssd-1.16.3.tar.gz 6217114 BLAKE2B eefaf8de466d0d76e9a4b60aefef6eb63c17a55b9a1f2e07e973a61d71cbe5432e92357656a1eb353d45bbc2fa92290cef45898d0b315d4a4c4074652ff25a23 SHA512 6165923f652f624bbe3ddc625ae682c4867eb7a20652d0cf74bbb8dda2307c917d3189ede26fd21a4fb5fd5926149271a65fa09f3affe928029ed99e6422b728
-DIST sssd-2.0.0.tar.gz 6263376 BLAKE2B 9785710d62485a1168749bf9a2989999f721e390356e599092f3274b6d7029af1f7d4c0a1b2b09d0d55233fd30cc661d4ad5bf9ca6ca53c75151dd1dab7515c5 SHA512 affeb0799d8a4fcbcb4b2ed7925b397ae6ba0e2982c5603e98636b765d3820a3b29ac58b0771e5cc00c752512f091ae4fd271d441544147a0570d3c14b535701
-EBUILD sssd-1.16.3-r1.ebuild 6199 BLAKE2B 56c981f72b3a45b10fc68059d073704ca3f04a8a0d2915a0912778e0482eb61fedc9f13916b401f43bdb6ce7e990c2392c2b5b6cde935305e0176b24f72da687 SHA512 47f0b7ec34fa27c340e947764c3b2e7b9b3b2740a56f8c9be09fbbc2d52c76ec4c12db731de89698f0475becc384a07288d2786ffc863b811f7ceb64966ef798
-EBUILD sssd-2.0.0-r1.ebuild 6201 BLAKE2B ce17198d255a390e7182be57019a01d47e26ecd17e9429324b318d6ca9f0553002decd8282186785d7c84cc84a2e3e36ff4901e8d549e84d23b212371a76c973 SHA512 4fe06340622cedd8031f56775340ad43933c2fd26b089d219e083d0e1b9d0b8115986662f487cf9ff1050d43bad2de52c1196786e399fc3a833ba3dbd60f45c4
+DIST sssd-2.1.0.tar.gz 6463331 BLAKE2B 9226370dc384c58841d944bdf9b067d953bf138ee7a289f01a4b8bb5d09beee3b9f21609989123d8f4f9fc13237670d61e32dcb194555ddc6785c598ce78d08c SHA512 12a7e5b89d462350af3c43e15b24a437dd985ac4a2e419d5e52cc0d05c6eacb9319d39b23681595ef860120cd1ae6e5fb265054afeddcb05d3d5f5de5d6ffa63
+EBUILD sssd-1.16.3-r2.ebuild 6293 BLAKE2B a119a5c17f85303865c1932de2b7d3c5acebba684f46a01dae4a8e7a12d5edaabe49ea56024d2beedf6ed6f76be4407ac2c70049a547844af5e8d05cba364171 SHA512 51f4d5164cee659555005c9714553066d3656b71cd7ab37d36309c7f5e80419bac5e221667f470a61f824f1d2bc42cfa3e8ad54e0308574cb530e9b26335ac06
+EBUILD sssd-2.1.0.ebuild 6201 BLAKE2B 6d3bfcc63d3d6042a34c26fa499af5ac76ea4537b16d8df77f7822ed156f32310d07aa49c79e4539eac48546c88b01fcf57bf4aa5b37d3621ea53f5ade12aa06 SHA512 cf338e0f6f13a22f0d210d7c6a991f9e81948112972cc94025df9acecfb95eb1883aa29a409fc8ebf637421b284b9d7654ffc3e9de1ae83a6321c67298c77bd4
 MISC metadata.xml 1090 BLAKE2B 7085d66b3454b3756d7dab49b6d9525c4ba90156d07f2710f4eb3c5bf3bbd9d10412d511dc0fe091ac4c5291f87a258fac6adbe9732d20a96660f4e0a66cf247 SHA512 2cbf20cd206a45bd82b1416926a02de06bf40b1b4168f19202c367cf8e24d764745b8a5116366ee10520cae15800e17b43d3000995419117f02b2d37474f142e
diff --git a/sys-auth/sssd/files/sssd-fix-CVE-2019-3811.patch b/sys-auth/sssd/files/sssd-fix-CVE-2019-3811.patch
new file mode 100644
index 000000000000..87db45fd24bb
--- /dev/null
+++ b/sys-auth/sssd/files/sssd-fix-CVE-2019-3811.patch
@@ -0,0 +1,96 @@
+From 28792523a01a7d21bcc8931794164f253e691a68 Mon Sep 17 00:00:00 2001
+From: Tomas Halman <thalman@redhat.com>
+Date: Mon, 3 Dec 2018 14:11:31 +0100
+Subject: [PATCH] nss: sssd returns '/' for emtpy home directories
+
+For empty home directory in passwd file sssd returns "/". Sssd
+should respect system behaviour and return the same as nsswitch
+"files" module - return empty string.
+
+Resolves:
+https://pagure.io/SSSD/sssd/issue/3901
+
+Reviewed-by: Simo Sorce <simo@redhat.com>
+Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
+(cherry picked from commit 90f32399b4100ce39cf665649fde82d215e5eb49)
+---
+ src/confdb/confdb.c                      |  9 +++++++++
+ src/man/include/ad_modified_defaults.xml | 19 +++++++++++++++++++
+ src/responder/nss/nss_protocol_pwent.c   |  2 +-
+ src/tests/intg/test_files_provider.py    |  2 +-
+ 4 files changed, 30 insertions(+), 2 deletions(-)
+
+diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c
+index a3eb9c66d9..17bb4f8274 100644
+--- a/src/confdb/confdb.c
++++ b/src/confdb/confdb.c
+@@ -1301,6 +1301,15 @@ static int confdb_get_domain_internal(struct confdb_ctx *cdb,
+             ret = ENOMEM;
+             goto done;
+         }
++    } else {
++        if (strcasecmp(domain->provider, "ad") == 0) {
++            /* ad provider default */
++            domain->fallback_homedir = talloc_strdup(domain, "/home/%d/%u");
++            if (!domain->fallback_homedir) {
++                ret = ENOMEM;
++                goto done;
++            }
++        }
+     }
+ 
+     tmp = ldb_msg_find_attr_as_string(res->msgs[0],
+diff --git a/src/man/include/ad_modified_defaults.xml b/src/man/include/ad_modified_defaults.xml
+index 818a2bf787..425b7e8ee0 100644
+--- a/src/man/include/ad_modified_defaults.xml
++++ b/src/man/include/ad_modified_defaults.xml
+@@ -76,4 +76,23 @@
+             </listitem>
+         </itemizedlist>
+     </refsect2>
++    <refsect2 id='nss_modifications'>
++        <title>NSS configuration</title>
++        <itemizedlist>
++            <listitem>
++                <para>
++                    fallback_homedir = /home/%d/%u
++                </para>
++                <para>
++                    The AD provider automatically sets
++                    "fallback_homedir = /home/%d/%u" to provide personal
++                    home directories for users without the homeDirectory
++                    attribute. If your AD Domain is properly
++                    populated with Posix attributes, and you want to avoid
++                    this fallback behavior, you can explicitly
++                    set "fallback_homedir = %o".
++                </para>
++            </listitem>
++        </itemizedlist>
++    </refsect2>
+ </refsect1>
+diff --git a/src/responder/nss/nss_protocol_pwent.c b/src/responder/nss/nss_protocol_pwent.c
+index af9e74fc86..86fa4ec465 100644
+--- a/src/responder/nss/nss_protocol_pwent.c
++++ b/src/responder/nss/nss_protocol_pwent.c
+@@ -118,7 +118,7 @@ nss_get_homedir(TALLOC_CTX *mem_ctx,
+ 
+     homedir = nss_get_homedir_override(mem_ctx, msg, nss_ctx, domain, &hd_ctx);
+     if (homedir == NULL) {
+-        return "/";
++        return "";
+     }
+ 
+     return homedir;
+diff --git a/src/tests/intg/test_files_provider.py b/src/tests/intg/test_files_provider.py
+index ead1cc4c34..4761f1bd15 100644
+--- a/src/tests/intg/test_files_provider.py
++++ b/src/tests/intg/test_files_provider.py
+@@ -678,7 +678,7 @@ def test_user_no_dir(setup_pw_with_canary, files_domain_only):
+     Test that resolving a user without a homedir defined works and returns
+     a fallback value
+     """
+-    check_user(incomplete_user_setup(setup_pw_with_canary, 'dir', '/'))
++    check_user(incomplete_user_setup(setup_pw_with_canary, 'dir', ''))
+ 
+ 
+ def test_user_no_gecos(setup_pw_with_canary, files_domain_only):
diff --git a/sys-auth/sssd/sssd-1.16.3-r1.ebuild b/sys-auth/sssd/sssd-1.16.3-r2.ebuild
index 885dd7416e7e..f5efa5d6666b 100644
--- a/sys-auth/sssd/sssd-1.16.3-r1.ebuild
+++ b/sys-auth/sssd/sssd-1.16.3-r2.ebuild
@@ -1,7 +1,7 @@
-# Copyright 1999-2018 Gentoo Authors
+# Copyright 1999-2019 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=6
+EAPI=7
 
 PYTHON_COMPAT=( python{2_7,3_3,3_4,3_5,3_6,3_7} )
 
@@ -30,6 +30,7 @@ COMMON_DEP="
 	>=dev-libs/libpcre-8.30
 	>=app-crypt/mit-krb5-1.10.3
 	dev-libs/jansson
+	net-misc/curl
 	locator? (
 		>=app-crypt/mit-krb5-1.12.2[${MULTILIB_USEDEP}]
 		>=net-dns/c-ares-1.10.0-r1[${MULTILIB_USEDEP}]
@@ -86,6 +87,7 @@ src_prepare() {
 		"${S}"/src/sysv/gentoo/sssd.in || die "sed sssd.in"
 
 	eapply "${FILESDIR}"/${PN}-curl-macros.patch
+	eapply "${FILESDIR}"/${PN}-fix-CVE-2019-3811.patch
 
 	default
 	eautoreconf
@@ -189,7 +191,7 @@ multilib_src_install() {
 		dopammod .libs/pam_sss.so
 
 		into /
-		dolib .libs/libnss_sss.so*
+		dolib.so .libs/libnss_sss.so*
 
 		if use locator; then
 			exeinto /usr/$(get_libdir)/krb5/plugins/libkrb5
@@ -233,5 +235,5 @@ multilib_src_test() {
 pkg_postinst(){
 	elog "You must set up sssd.conf (default installed into /etc/sssd)"
 	elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
-	elog "features. Please see howto in	http://fedorahosted.org/sssd/wiki/HOWTO_Configure_1_0_2"
+	elog "features. Please see howto in	https://docs.pagure.org/SSSD.sssd/design_pages/index.html#implemented-in-1-16-x"
 }
diff --git a/sys-auth/sssd/sssd-2.0.0-r1.ebuild b/sys-auth/sssd/sssd-2.1.0.ebuild
index 4d67daf3221a..63f65b59a7ba 100644
--- a/sys-auth/sssd/sssd-2.0.0-r1.ebuild
+++ b/sys-auth/sssd/sssd-2.1.0.ebuild
@@ -1,7 +1,7 @@
-# Copyright 1999-2018 Gentoo Authors
+# Copyright 1999-2019 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=6
+EAPI=7
 
 PYTHON_COMPAT=( python{2_7,3_3,3_4,3_5,3_6,3_7} )
 
@@ -30,6 +30,7 @@ COMMON_DEP="
 	>=dev-libs/libpcre-8.30
 	>=app-crypt/mit-krb5-1.10.3
 	dev-libs/jansson
+	net-misc/curl
 	locator? (
 		>=app-crypt/mit-krb5-1.12.2[${MULTILIB_USEDEP}]
 		>=net-dns/c-ares-1.10.0-r1[${MULTILIB_USEDEP}]
@@ -85,8 +86,6 @@ src_prepare() {
 	sed -i 's:#!/sbin/runscript:#!/sbin/openrc-run:' \
 		"${S}"/src/sysv/gentoo/sssd.in || die "sed sssd.in"
 
-	eapply "${FILESDIR}"/${PN}-curl-macros.patch
-
 	default
 	eautoreconf
 	multilib_copy_sources
@@ -189,7 +188,7 @@ multilib_src_install() {
 		dopammod .libs/pam_sss.so
 
 		into /
-		dolib .libs/libnss_sss.so*
+		dolib.so .libs/libnss_sss.so*
 
 		if use locator; then
 			exeinto /usr/$(get_libdir)/krb5/plugins/libkrb5
@@ -233,5 +232,5 @@ multilib_src_test() {
 pkg_postinst(){
 	elog "You must set up sssd.conf (default installed into /etc/sssd)"
 	elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
-	elog "features. Please see howto in	http://fedorahosted.org/sssd/wiki/HOWTO_Configure_1_0_2"
+	elog "features. Please see howto in	https://docs.pagure.org/SSSD.sssd/design_pages/smartcard_authentication_require.html"
 }