mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2026-02-26 18:11:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

sys-auth/sssd: Sync with Gentoo

Browse Source 
It's from Gentoo commit 2093b3c01a818dc3721376c181e7ae9b74f88508.
This commit is contained in:
Krzesimir Nowak 2024-12-02 14:12:50 +01:00
parent e1e4f55520
commit f18907e21c
13 changed files with 712 additions and 693 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sdk_container/src/third_party/portage-stable/sys-auth/sssd/Manifest vendored
View File

@ -1 +1 @@
DIST sssd-2.3.1.tar.gz 7186526 BLAKE2B 6d630fe75b9b426ef54adbe1704fde8e01fc34df7861028c07ce2985db8a151ce743d633061386fea6460fe8eabb89242b816d4bac87975bb9b7b2064ad1d547 SHA512 6aeb52d5222c5992d581296996749327bcaf276e4eb4413a6a32ea6529343432cfe413006aca4245c19b38b515be1c4c2ef88a157c617d889274179253355bc6
DIST sssd-2.9.5.tar.gz 8001964 BLAKE2B e9c839e58fbeac9e8cba83b726f075c5db6ce85059546d745672c222b594f4aa26ad103f0eb3a8ff9e2b364c3502fb93c639fe9e621fefd6fecd2319f5cb499a SHA512 d219f12ffc75af233f0e4ffc62c0442acc6da3cd94ed4eab7102a78821af5257c8e4ba0d06b2c99c08e06502f8d0d0bcc80540d63823dbe0f52eb0432ae7e14d

21
sdk_container/src/third_party/portage-stable/sys-auth/sssd/files/sssd vendored
View File

@ -1,21 +0,0 @@
#!/sbin/openrc-run
# Copyright 1999-2011 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
command="/usr/sbin/sssd"
command_args="${SSSD_OPTIONS} -D"
start_stop_daemon_args="--quiet"
description="System Security Services Daemon"
depend(){
need localmount clock
use syslog xdm
}
if [ "${RC_VERSION:-0}" = "0" ]; then
start() {
eerror "This script cannot be used for baselayout-1."
return 1
}
fi

284
sdk_container/src/third_party/portage-stable/sys-auth/sssd/files/sssd-2.3.1-CVE-2021-3621.patch vendored
View File

@ -1,284 +0,0 @@
From 9377cc4c25a1d889e241f23ec7efcd40fced3c63 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Fri, 18 Jun 2021 13:17:19 +0200
Subject: [PATCH] TOOLS: replace system() with execvp() to avoid execution of
user supplied command
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
:relnote: A flaw was found in SSSD, where the sssctl command was
vulnerable to shell command injection via the logs-fetch and
cache-expire subcommands. This flaw allows an attacker to trick
the root user into running a specially crafted sssctl command,
such as via sudo, to gain root access. The highest threat from this
vulnerability is to confidentiality, integrity, as well as system
availability.
This patch fixes a flaw by replacing system() with execvp().
:fixes: CVE-2021-3621
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
---
src/tools/sssctl/sssctl.c | 39 ++++++++++++++++-------
src/tools/sssctl/sssctl.h | 2 +-
src/tools/sssctl/sssctl_data.c | 57 +++++++++++-----------------------
src/tools/sssctl/sssctl_logs.c | 32 +++++++++++++++----
4 files changed, 73 insertions(+), 57 deletions(-)
diff --git a/src/tools/sssctl/sssctl.c b/src/tools/sssctl/sssctl.c
index 2997dbf96..8adaf3091 100644
--- a/src/tools/sssctl/sssctl.c
+++ b/src/tools/sssctl/sssctl.c
@@ -97,22 +97,36 @@ sssctl_prompt(const char *message,
return SSSCTL_PROMPT_ERROR;
}
-errno_t sssctl_run_command(const char *command)
+errno_t sssctl_run_command(const char *const argv[])
{
int ret;
+ int wstatus;
- DEBUG(SSSDBG_TRACE_FUNC, "Running %s\n", command);
+ DEBUG(SSSDBG_TRACE_FUNC, "Running '%s'\n", argv[0]);
- ret = system(command);
+ ret = fork();
if (ret == -1) {
- DEBUG(SSSDBG_CRIT_FAILURE, "Unable to execute %s\n", command);
ERROR("Error while executing external command\n");
return EFAULT;
- } else if (WEXITSTATUS(ret) != 0) {
- DEBUG(SSSDBG_CRIT_FAILURE, "Command %s failed with [%d]\n",
- command, WEXITSTATUS(ret));
+ }
+
+ if (ret == 0) {
+ /* cast is safe - see
+ https://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html
+ "The statement about argv[] and envp[] being constants ... "
+ */
+ execvp(argv[0], discard_const_p(char * const, argv));
ERROR("Error while executing external command\n");
- return EIO;
+ _exit(1);
+ } else {
+ if (waitpid(ret, &wstatus, 0) == -1) {
+ ERROR("Error while executing external command '%s'\n", argv[0]);
+ return EFAULT;
+ } else if (WEXITSTATUS(wstatus) != 0) {
+ ERROR("Command '%s' failed with [%d]\n",
+ argv[0], WEXITSTATUS(wstatus));
+ return EIO;
+ }
}
return EOK;
@@ -132,11 +146,14 @@ static errno_t sssctl_manage_service(enum sssctl_svc_action action)
#elif defined(HAVE_SERVICE)
switch (action) {
case SSSCTL_SVC_START:
- return sssctl_run_command(SERVICE_PATH" sssd start");
+ return sssctl_run_command(
+ (const char *[]){SERVICE_PATH, "sssd", "start", NULL});
case SSSCTL_SVC_STOP:
- return sssctl_run_command(SERVICE_PATH" sssd stop");
+ return sssctl_run_command(
+ (const char *[]){SERVICE_PATH, "sssd", "stop", NULL});
case SSSCTL_SVC_RESTART:
- return sssctl_run_command(SERVICE_PATH" sssd restart");
+ return sssctl_run_command(
+ (const char *[]){SERVICE_PATH, "sssd", "restart", NULL});
}
#endif
diff --git a/src/tools/sssctl/sssctl.h b/src/tools/sssctl/sssctl.h
index 0115b2457..599ef6519 100644
--- a/src/tools/sssctl/sssctl.h
+++ b/src/tools/sssctl/sssctl.h
@@ -47,7 +47,7 @@ enum sssctl_prompt_result
sssctl_prompt(const char *message,
enum sssctl_prompt_result defval);
-errno_t sssctl_run_command(const char *command);
+errno_t sssctl_run_command(const char *const argv[]); /* argv[0] - command */
bool sssctl_start_sssd(bool force);
bool sssctl_stop_sssd(bool force);
bool sssctl_restart_sssd(bool force);
diff --git a/src/tools/sssctl/sssctl_data.c b/src/tools/sssctl/sssctl_data.c
index 8d79b977f..bf2291341 100644
--- a/src/tools/sssctl/sssctl_data.c
+++ b/src/tools/sssctl/sssctl_data.c
@@ -105,15 +105,15 @@ static errno_t sssctl_backup(bool force)
}
}
- ret = sssctl_run_command("sss_override user-export "
- SSS_BACKUP_USER_OVERRIDES);
+ ret = sssctl_run_command((const char *[]){"sss_override", "user-export",
+ SSS_BACKUP_USER_OVERRIDES, NULL});
if (ret != EOK) {
ERROR("Unable to export user overrides\n");
return ret;
}
- ret = sssctl_run_command("sss_override group-export "
- SSS_BACKUP_GROUP_OVERRIDES);
+ ret = sssctl_run_command((const char *[]){"sss_override", "group-export",
+ SSS_BACKUP_GROUP_OVERRIDES, NULL});
if (ret != EOK) {
ERROR("Unable to export group overrides\n");
return ret;
@@ -158,8 +158,8 @@ static errno_t sssctl_restore(bool force_start, bool force_restart)
}
if (sssctl_backup_file_exists(SSS_BACKUP_USER_OVERRIDES)) {
- ret = sssctl_run_command("sss_override user-import "
- SSS_BACKUP_USER_OVERRIDES);
+ ret = sssctl_run_command((const char *[]){"sss_override", "user-import",
+ SSS_BACKUP_USER_OVERRIDES, NULL});
if (ret != EOK) {
ERROR("Unable to import user overrides\n");
return ret;
@@ -167,8 +167,8 @@ static errno_t sssctl_restore(bool force_start, bool force_restart)
}
if (sssctl_backup_file_exists(SSS_BACKUP_USER_OVERRIDES)) {
- ret = sssctl_run_command("sss_override group-import "
- SSS_BACKUP_GROUP_OVERRIDES);
+ ret = sssctl_run_command((const char *[]){"sss_override", "group-import",
+ SSS_BACKUP_GROUP_OVERRIDES, NULL});
if (ret != EOK) {
ERROR("Unable to import group overrides\n");
return ret;
@@ -296,40 +296,19 @@ errno_t sssctl_cache_expire(struct sss_cmdline *cmdline,
void *pvt)
{
errno_t ret;
- char *cmd_args = NULL;
- const char *cachecmd = SSS_CACHE;
- char *cmd = NULL;
- int i;
-
- if (cmdline->argc == 0) {
- ret = sssctl_run_command(cachecmd);
- goto done;
- }
- cmd_args = talloc_strdup(tool_ctx, "");
- if (cmd_args == NULL) {
- ret = ENOMEM;
- goto done;
+ const char **args = talloc_array_size(tool_ctx,
+ sizeof(char *),
+ cmdline->argc + 2);
+ if (!args) {
+ return ENOMEM;
}
+ memcpy(&args[1], cmdline->argv, sizeof(char *) * cmdline->argc);
+ args[0] = SSS_CACHE;
+ args[cmdline->argc + 1] = NULL;
- for (i = 0; i < cmdline->argc; i++) {
- cmd_args = talloc_strdup_append(cmd_args, cmdline->argv[i]);
- if (i != cmdline->argc - 1) {
- cmd_args = talloc_strdup_append(cmd_args, " ");
- }
- }
-
- cmd = talloc_asprintf(tool_ctx, "%s %s", cachecmd, cmd_args);
- if (cmd == NULL) {
- ret = ENOMEM;
- goto done;
- }
-
- ret = sssctl_run_command(cmd);
-
-done:
- talloc_free(cmd_args);
- talloc_free(cmd);
+ ret = sssctl_run_command(args);
+ talloc_free(args);
return ret;
}
diff --git a/src/tools/sssctl/sssctl_logs.c b/src/tools/sssctl/sssctl_logs.c
index 04a32bad8..ebb2c4571 100644
--- a/src/tools/sssctl/sssctl_logs.c
+++ b/src/tools/sssctl/sssctl_logs.c
@@ -31,6 +31,7 @@
#include <ldb.h>
#include <popt.h>
#include <stdio.h>
+#include <glob.h>
#include "util/util.h"
#include "tools/common/sss_process.h"
@@ -230,6 +231,7 @@ errno_t sssctl_logs_remove(struct sss_cmdline *cmdline,
{
struct sssctl_logs_opts opts = {0};
errno_t ret;
+ glob_t globbuf;
/* Parse command line. */
struct poptOption options[] = {
@@ -253,8 +255,20 @@ errno_t sssctl_logs_remove(struct sss_cmdline *cmdline,
sss_signal(SIGHUP);
} else {
+ globbuf.gl_offs = 4;
+ ret = glob(LOG_PATH"/*.log", GLOB_ERR|GLOB_DOOFFS, NULL, &globbuf);
+ if (ret != 0) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "Unable to expand log files list\n");
+ return ret;
+ }
+ globbuf.gl_pathv[0] = discard_const_p(char, "truncate");
+ globbuf.gl_pathv[1] = discard_const_p(char, "--no-create");
+ globbuf.gl_pathv[2] = discard_const_p(char, "--size");
+ globbuf.gl_pathv[3] = discard_const_p(char, "0");
+
PRINT("Truncating log files...\n");
- ret = sssctl_run_command("truncate --size 0 " LOG_FILES);
+ ret = sssctl_run_command((const char * const*)globbuf.gl_pathv);
+ globfree(&globbuf);
if (ret != EOK) {
ERROR("Unable to truncate log files\n");
return ret;
@@ -269,8 +283,8 @@ errno_t sssctl_logs_fetch(struct sss_cmdline *cmdline,
void *pvt)
{
const char *file;
- const char *cmd;
errno_t ret;
+ glob_t globbuf;
/* Parse command line. */
ret = sss_tool_popt_ex(cmdline, NULL, SSS_TOOL_OPT_OPTIONAL, NULL, NULL,
@@ -280,13 +294,19 @@ errno_t sssctl_logs_fetch(struct sss_cmdline *cmdline,
return ret;
}
- cmd = talloc_asprintf(tool_ctx, "tar -czf %s %s", file, LOG_FILES);
- if (cmd == NULL) {
- ERROR("Out of memory!");
+ globbuf.gl_offs = 3;
+ ret = glob(LOG_PATH"/*.log", GLOB_ERR|GLOB_DOOFFS, NULL, &globbuf);
+ if (ret != 0) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "Unable to expand log files list\n");
+ return ret;
}
+ globbuf.gl_pathv[0] = discard_const_p(char, "tar");
+ globbuf.gl_pathv[1] = discard_const_p(char, "-czf");
+ globbuf.gl_pathv[2] = discard_const_p(char, file);
PRINT("Archiving log files into %s...\n", file);
- ret = sssctl_run_command(cmd);
+ ret = sssctl_run_command((const char * const*)globbuf.gl_pathv);
+ globfree(&globbuf);
if (ret != EOK) {
ERROR("Unable to archive log files\n");
return ret;
--
2.25.1

10
sdk_container/src/third_party/portage-stable/sys-auth/sssd/files/sssd-2.3.1-disable-nsupdate-realm.patch vendored
View File

@ -1,10 +0,0 @@
--- a/src/external/nsupdate.m4 2020-11-05 16:27:14.661566136 +0100
+++ b/src/external/nsupdate.m4 2020-11-05 16:27:30.060674381 +0100
@@ -9,7 +9,6 @@
AC_MSG_RESULT([yes])
else
AC_MSG_RESULT([no])
- AC_MSG_ERROR([nsupdate does not support 'realm'])
fi
else

32
sdk_container/src/third_party/portage-stable/sys-auth/sssd/files/sssd-2.3.1-test_ca-Look-for-libsofthsm2.so-in-usr-libdir-sofths.patch vendored
View File

@ -1,32 +0,0 @@
From fc79d035ccc4c1a5da26bbd780aeb7e0a0afebf5 Mon Sep 17 00:00:00 2001
From: Matt Turner <mattst88@gmail.com>
Date: Fri, 14 Aug 2020 13:36:30 -0700
Subject: [PATCH] test_ca: Look for libsofthsm2.so in /usr/${libdir}/softhsm
too
Signed-off-by: Matt Turner <mattst88@gmail.com>
---
src/external/test_ca.m4 | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/src/external/test_ca.m4 b/src/external/test_ca.m4
index 4d45a5a16..d318789bc 100644
--- a/src/external/test_ca.m4
+++ b/src/external/test_ca.m4
@@ -33,9 +33,10 @@ AC_DEFUN([AM_CHECK_TEST_CA],
AM_CONDITIONAL([BUILD_TEST_CA], [test -x "$OPENSSL" -a -x "$SSH_KEYGEN" -a -x "$CERTUTIL" -a -x "$PK12UTIL"])
else
- for p in /usr/lib64/pkcs11/libsofthsm2.so /usr/lib/pkcs11/libsofthsm2.so /usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so; do
- if test -f "${p}"; then
- SOFTHSM2_PATH="${p}"
+ for p in /usr/lib{64,}/{softhsm,pkcs11} /usr/lib/x86_64-linux-gnu/softhsm; do
+ f="${p}/libsofthsm2.so"
+ if test -f "${f}"; then
+ SOFTHSM2_PATH="${f}"
break;
fi
done
--
2.26.2

12
sdk_container/src/third_party/portage-stable/sys-auth/sssd/files/sssd-2.8.2-krb5_pw_locked.patch vendored Normal file
View File

@ -0,0 +1,12 @@
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index a1c0b36..207c010 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -1037,6 +1037,7 @@ static void krb5_auth_done(struct tevent_req *subreq)
case ERR_ACCOUNT_LOCKED:
state->pam_status = PAM_PERM_DENIED;
state->dp_err = DP_ERR_OK;
+ state->pd->account_locked = true;
ret = EOK;
goto done;

19
sdk_container/src/third_party/portage-stable/sys-auth/sssd/files/sssd-2.9.1-conditional-python-install.patch vendored Normal file
View File

@ -0,0 +1,19 @@
diff --git a/src/tools/analyzer/Makefile.am b/src/tools/analyzer/Makefile.am
index b40043d04..dce6b9d36 100644
--- a/src/tools/analyzer/Makefile.am
+++ b/src/tools/analyzer/Makefile.am
@@ -5,7 +5,9 @@ dist_sss_analyze_python_SCRIPTS = \
$(NULL)
pkgpythondir = $(python3dir)/sssd
+modulesdir = $(pkgpythondir)/modules
+if BUILD_PYTHON_BINDINGS
dist_pkgpython_DATA = \
__init__.py \
source_files.py \
@@ -20,3 +22,4 @@ dist_modules_DATA = \
modules/__init__.py \
modules/request.py \
$(NULL)
+endif

10
sdk_container/src/third_party/portage-stable/sys-auth/sssd/files/sssd.service vendored
View File

@ -1,10 +0,0 @@
[Unit]
Description=System Security Services Daemon
After=nscd.service
[Service]
ExecStart=/usr/sbin/sssd -i
PIDFile=/run/sssd.pid
[Install]
WantedBy=multi-user.target

14
sdk_container/src/third_party/portage-stable/sys-auth/sssd/files/tmpfiles.d/sssd.conf vendored
View File

@ -1,14 +0,0 @@
d /etc/sssd 0700 root root - -
C /etc/sssd/sssd.conf 0600 root root - /usr/share/sssd/sssd-example.conf
d /var/lib/sss - root root - -
d /var/lib/sss/deskprofile 0755 root root - -
d /var/lib/sss/db 0700 root root - -
d /var/lib/sss/gpo_cache 0755 root root - -
d /var/lib/sss/keytabs 0700 root root - -
d /var/lib/sss/mc 0700 root root - -
d /var/lib/sss/pipes - root root - -
d /var/lib/sss/pipes/private 0700 root root - -
d /var/lib/sss/pubconf 0700 root root - -
d /var/lib/sss/pubconf/krb5.include.d 0700 root root - -
d /var/lib/sss/secrets 0755 root root - -
d /var/log/sssd 0700 root root - -

24
sdk_container/src/third_party/portage-stable/sys-auth/sssd/metadata.xml vendored
View File

@ -1,26 +1,26 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
<pkgmetadata>
<maintainer type="project">
<email>base-system@gentoo.org</email>
<name>Gentoo Base System</name>
</maintainer>
<maintainer type="person">
<email>alexxy@gentoo.org</email>
<name>Alexey Shvetsov</name>
<maintainer type="person" proxied="yes">
<email>salah.coronya@gmail.com</email>
<name>Christopher Byrne</name>
</maintainer>
<maintainer type="project" proxied="proxy">
<email>proxy-maint@gentoo.org</email>
<name>Proxy Maintainers</name>
</maintainer>
<use>
<flag name="acl"> Build and use the cifsidmap plugin</flag>
<flag name="autofs">Build helper to let <pkg>net-fs/autofs</pkg> use sssd provided information</flag>
<flag name="locator">Install sssd's Kerberos plugin</flag>
<flag name="man">Build man pages with <pkg>dev-libs/libxslt</pkg></flag>
<flag name="manpages">Build man pages with <pkg>dev-libs/libxslt</pkg></flag>
<flag name="netlink">Add support for netlink protocol via <pkg>dev-libs/libnl</pkg></flag>
<flag name="nfsv4">Add support for the nfsv4 idmapd plugin provided by <pkg>net-libs/libnfsidmap</pkg></flag>
<flag name="pac">Add Privileged Attribute Certificate Support for Kerberos</flag>
<flag name="ssh">Build helper to let <pkg>net-misc/openssh</pkg> use sssd provided information</flag>
<flag name="nfsv4">Add support for the nfsv4 idmapd plugin provided by <pkg>net-fs/nfs-utils</pkg></flag>
<flag name="samba">Add Privileged Attribute Certificate Support for Kerberos</flag>
<flag name="subid">Support subordinate uid and gid ranges in FreeIPA</flag>
<flag name="sudo">Build helper to let <pkg>app-admin/sudo</pkg> use sssd provided information</flag>
<flag name="valgrind">Depend on <pkg>dev-util/valgrind</pkg> for test suite</flag>
<flag name="systemtap">Enable SystemTap/DTrace tracing</flag>
</use>
<upstream>
<remote-id type="cpe">cpe:/a:fedoraproject:sssd</remote-id>

309
sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.3.1-r6.ebuild vendored
View File

@ -1,309 +0,0 @@
# Flatcar modifications:
# - changed files/sssd.service
# - added files/tmpfiles.d/sssd.conf
# - other ebuild modifications marked below
#
# Copyright 1999-2020 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=7
PYTHON_COMPAT=( python3_{6..11} )
TMPFILES_OPTIONAL=1
inherit autotools flag-o-matic linux-info multilib-minimal python-single-r1 pam systemd toolchain-funcs tmpfiles
DESCRIPTION="System Security Services Daemon provides access to identity and authentication"
HOMEPAGE="https://github.com/SSSD/sssd"
SRC_URI="https://github.com/SSSD/sssd/releases/download/${PN}-${PV//./_}/${P}.tar.gz"
# Flatcar: stabilize arm64
KEYWORDS="amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc x86"
LICENSE="GPL-3"
SLOT="0"
IUSE="acl doc +locator +netlink nfsv4 nls +man pac python samba selinux sudo systemd test valgrind"
RESTRICT="!test? ( test )"
REQUIRED_USE="pac? ( samba )
python? ( ${PYTHON_REQUIRED_USE} )"
# Flatcar: do not force gssapi for >=net-dns/bind-9.9
# do not force winbind for net-fs/samba
DEPEND="
>=app-crypt/mit-krb5-1.10.3
app-crypt/p11-kit
>=dev-libs/ding-libs-0.2
dev-libs/glib:2
>=dev-libs/cyrus-sasl-2.1.25-r3[kerberos]
>=dev-libs/libpcre-8.30:=
>=dev-libs/popt-1.16
>=dev-libs/openssl-1.0.2:0=
>=net-dns/bind-9.9
>=net-dns/c-ares-1.7.4
>=net-nds/openldap-2.4.30[sasl]
>=sys-apps/dbus-1.6
>=sys-apps/keyutils-1.5:=
>=sys-libs/pam-0-r1[${MULTILIB_USEDEP}]
>=sys-libs/talloc-2.0.7
>=sys-libs/tdb-1.2.9
>=sys-libs/tevent-0.9.16
>=sys-libs/ldb-1.1.17-r1:=
virtual/libintl
locator? (
>=app-crypt/mit-krb5-1.12.2[${MULTILIB_USEDEP}]
>=net-dns/c-ares-1.10.0-r1[${MULTILIB_USEDEP}]
)
acl? ( net-fs/cifs-utils[acl] )
netlink? ( dev-libs/libnl:3 )
nfsv4? ( || ( >=net-fs/nfs-utils-2.3.1-r2 net-libs/libnfsidmap ) )
nls? ( >=sys-devel/gettext-0.18 )
pac? (
app-crypt/mit-krb5[${MULTILIB_USEDEP}]
net-fs/samba
)
python? ( ${PYTHON_DEPS} )
samba? ( >=net-fs/samba-4.10.2 )
selinux? (
>=sys-libs/libselinux-2.1.9
>=sys-libs/libsemanage-2.1
)
systemd? (
dev-libs/jansson:0=
net-libs/http-parser:0=
net-misc/curl:0=
)
"
RDEPEND="${DEPEND}
>=sys-libs/glibc-2.17[nscd]
selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )
"
# Flatcar: require only autoconf:2.69
BDEPEND="
dev-build/autoconf:2.69
doc? ( app-doc/doxygen )
test? (
dev-libs/check
dev-libs/softhsm:2
dev-util/cmocka
net-libs/gnutls[pkcs11,tools]
sys-libs/libfaketime
sys-libs/nss_wrapper
sys-libs/pam_wrapper
sys-libs/uid_wrapper
valgrind? ( dev-util/valgrind )
)
man? (
app-text/docbook-xml-dtd:4.4
>=dev-libs/libxslt-1.1.26
nls? ( app-text/po4a )
)"
CONFIG_CHECK="~KEYS"
MULTILIB_WRAPPED_HEADERS=(
/usr/include/ipa_hbac.h
/usr/include/sss_idmap.h
/usr/include/sss_nss_idmap.h
# --with-ifp
/usr/include/sss_sifp.h
/usr/include/sss_sifp_dbus.h
# from 1.15.3
/usr/include/sss_certmap.h
)
PATCHES=(
"${FILESDIR}"/${P}-test_ca-Look-for-libsofthsm2.so-in-usr-libdir-sofths.patch
"${FILESDIR}"/${P}-disable-nsupdate-realm.patch
# Flatcar: add a patch for CVE-2021-3621
"${FILESDIR}"/${P}-CVE-2021-3621.patch
)
pkg_setup() {
linux-info_pkg_setup
}
src_prepare() {
sed -i 's:/var/run:/run:' \
"${S}"/src/examples/logrotate || die
default
eautoreconf
multilib_copy_sources
if use python && multilib_is_native_abi; then
python_setup
fi
}
src_configure() {
local native_dbus_cflags=$($(tc-getPKG_CONFIG) --cflags dbus-1)
multilib-minimal_src_configure
}
multilib_src_configure() {
local myconf=()
myconf+=(
--localstatedir="${EPREFIX}"/var
--with-pid-path="${EPREFIX}"/run
--with-plugin-path="${EPREFIX}"/usr/$(get_libdir)/sssd
--enable-pammoddir="${EPREFIX}"/$(getpam_mod_dir)
--with-ldb-lib-dir="${EPREFIX}"/usr/$(get_libdir)/samba/ldb
--with-db-path="${EPREFIX}"/var/lib/sss/db
--with-gpo-cache-path="${EPREFIX}"/var/lib/sss/gpo_cache
--with-pubconf-path="${EPREFIX}"/var/lib/sss/pubconf
--with-pipe-path="${EPREFIX}"/var/lib/sss/pipes
--with-mcache-path="${EPREFIX}"/var/lib/sss/mc
--with-secrets-db-path="${EPREFIX}"/var/lib/sss/secrets
--with-log-path="${EPREFIX}"/var/log/sssd
--with-os=gentoo
--with-nscd="${EPREFIX}"/usr/sbin/nscd
--with-unicode-lib="glib2"
--disable-rpath
# Flatcar: make nss lookups succeed when not running
--enable-sss-default-nss-plugin
# Flatcar: prevent cross-compilation error
# when autotools does not want to compile and run the test
$(use_with samba smb-idmap-interface-version=6)
#
--sbindir=/usr/sbin
--with-crypto="libcrypto"
--enable-local-provider
$(multilib_native_use_with systemd kcm)
$(multilib_native_use_with systemd secrets)
$(use_with samba)
--with-smb-idmap-interface-version=6
$(multilib_native_use_enable acl cifs-idmap-plugin)
$(multilib_native_use_with selinux)
$(multilib_native_use_with selinux semanage)
$(use_enable locator krb5-locator-plugin)
$(use_enable pac pac-responder)
$(multilib_native_use_with nfsv4 nfsv4-idmapd-plugin)
$(use_enable nls)
$(multilib_native_use_with netlink libnl)
$(multilib_native_use_with man manpages)
$(multilib_native_use_with sudo)
$(multilib_native_with autofs)
$(multilib_native_with ssh)
$(use_enable valgrind)
--without-python2-bindings
$(multilib_native_use_with python python3-bindings)
)
# Annoyingly configure requires that you pick systemd XOR sysv
if use systemd; then
myconf+=(
--with-initscript="systemd"
--with-systemdunitdir=$(systemd_get_systemunitdir)
# Flatcar: Set the systemd system
# configuration directory explicitly through
# _systemd_get_dir, as it will do the right
# thing in cross-compilation environment.
--with-systemdconfdir=$(_systemd_get_dir systemdsystemconfdir /etc/systemd/system)
)
else
myconf+=(--with-initscript="sysv")
fi
if ! multilib_is_native_abi; then
# work-around all the libraries that are used for CLI and server
myconf+=(
{POPT,TALLOC,TDB,TEVENT,LDB}_{CFLAGS,LIBS}=' '
# ldb headers are fine since native needs it
# ldb lib fails... but it does not seem to bother
{DHASH,COLLECTION,INI_CONFIG_V{0,1,1_1,1_3}}_{CFLAGS,LIBS}=' '
{PCRE,CARES,SYSTEMD_LOGIN,SASL,GLIB2,DBUS,CRYPTO,P11_KIT}_{CFLAGS,LIBS}=' '
{NDR_NBT,SMBCLIENT,NDR_KRB5PAC}_{CFLAGS,LIBS}=' '
# use native include path for dbus (needed for build)
DBUS_CFLAGS="${native_dbus_cflags}"
# non-pkgconfig checks
ac_cv_lib_ldap_ldap_search=yes
--without-secrets
--without-kcm
)
fi
# Flatcar: Apparently CPP is undefined, which breaks samba
# version detection.
tc-export CPP
econf "${myconf[@]}"
}
multilib_src_compile() {
if multilib_is_native_abi; then
# Flatcar: add runstatedir to make commands to avoid configure error
default runstatedir="${EPREFIX}"/run
use doc && emake docs
if use man || use nls; then
emake update-po
fi
else
emake libnss_sss.la pam_sss.la
use locator && emake sssd_krb5_locator_plugin.la
use pac && emake sssd_pac_plugin.la
fi
}
multilib_src_install() {
if multilib_is_native_abi; then
# Flatcar: add runstatedir, sysconfdir
emake -j1 DESTDIR="${D}" runstatedir="${EPREFIX}"/run \
sysconfdir="/usr/share" "${_at_args[@]}" install
if use python; then
python_optimize
python_fix_shebang "${ED}"
fi
else
# easier than playing with automake...
dopammod .libs/pam_sss.so
into /
dolib.so .libs/libnss_sss.so*
if use locator; then
exeinto /usr/$(get_libdir)/krb5/plugins/libkrb5
doexe .libs/sssd_krb5_locator_plugin.so
fi
if use pac; then
exeinto /usr/$(get_libdir)/krb5/plugins/authdata
doexe .libs/sssd_pac_plugin.so
fi
fi
}
multilib_src_install_all() {
einstalldocs
find "${ED}" -type f -name '*.la' -delete || die
# Flatcar: store on /usr
insinto /usr/share/sssd
doins "${S}"/src/examples/sssd-example.conf
# Flatcar: delete, remove /var files taken care of by tmpfiles
# Flatcar: add tmpfile directive and remove /etc/rc.d
dotmpfiles "${FILESDIR}/tmpfiles.d/sssd.conf"
rm -rf "${D}/etc/rc.d"
# strip empty dirs
if ! use doc ; then
rm -r "${ED}"/usr/share/doc/"${PF}"/doc || die
rm -r "${ED}"/usr/share/doc/"${PF}"/{hbac,idmap,nss_idmap,sss_simpleifp}_doc || die
fi
rm -r "${ED}"/run || die
}
multilib_src_test() {
multilib_is_native_abi && emake check
}
pkg_postinst() {
elog "You must set up sssd.conf (default installed into /etc/sssd)"
elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
elog "features. Please see howto in https://sssd.io/docs/design_pages/smartcard_authentication_require.html"
}

335
sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.9.5-r2.ebuild vendored Normal file
View File

@ -0,0 +1,335 @@
# Copyright 1999-2024 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=8
PLOCALES="ca de es fr ja ko pt_BR ru sv tr uk"
PLOCALES_BIN="${PLOCALES} bg cs eu fi hu id it ka nb nl pl pt tg zh_TW zh_CN"
PLOCALE_BACKUP="sv"
PYTHON_COMPAT=( python3_{10..12} )
inherit autotools linux-info multilib-minimal optfeature plocale \
python-single-r1 pam systemd toolchain-funcs
DESCRIPTION="System Security Services Daemon provides access to identity and authentication"
HOMEPAGE="https://github.com/SSSD/sssd"
if [[ ${PV} != 9999 ]]; then
SRC_URI="https://github.com/SSSD/sssd/releases/download/${PV}/${P}.tar.gz"
KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~m68k ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
else
inherit git-r3
EGIT_REPO_URI="https://github.com/SSSD/sssd.git"
EGIT_BRANCH="master"
fi
LICENSE="GPL-3"
SLOT="0"
IUSE="acl doc +netlink nfsv4 nls +man python samba selinux subid sudo systemd systemtap test"
REQUIRED_USE="
python? ( ${PYTHON_REQUIRED_USE} )
test? ( sudo )"
RESTRICT="!test? ( test )"
DEPEND="
>=app-crypt/mit-krb5-1.19.1[${MULTILIB_USEDEP}]
app-crypt/p11-kit
>=dev-libs/ding-libs-0.2
>=dev-libs/cyrus-sasl-2.1.25-r3[kerberos]
dev-libs/jansson:=
dev-libs/libpcre2:=
dev-libs/libunistring:=[${MULTILIB_USEDEP}]
>=dev-libs/popt-1.16
>=dev-libs/openssl-1.0.2:=
>=net-dns/bind-tools-9.9[gssapi]
>=net-dns/c-ares-1.10.0-r1:=[${MULTILIB_USEDEP}]
>=net-nds/openldap-2.4.30:=[sasl,experimental]
>=sys-apps/dbus-1.6
>=sys-apps/keyutils-1.5:=
>=sys-libs/pam-0-r1[${MULTILIB_USEDEP}]
>=sys-libs/talloc-2.0.7
>=sys-libs/tdb-1.2.9
>=sys-libs/tevent-0.9.16
virtual/ldb:=
virtual/libintl
acl? ( net-fs/cifs-utils[acl] )
netlink? ( dev-libs/libnl:3 )
nfsv4? ( >=net-fs/nfs-utils-2.3.1-r2 )
nls? ( >=sys-devel/gettext-0.18 )
python? (
${PYTHON_DEPS}
systemd? (
$(python_gen_cond_dep '
dev-python/python-systemd[${PYTHON_USEDEP}]
')
)
)
samba? ( >=net-fs/samba-4.10.2[winbind] )
selinux? (
>=sys-libs/libselinux-2.1.9
>=sys-libs/libsemanage-2.1
)
subid? ( >=sys-apps/shadow-4.9 )
systemd? (
sys-apps/systemd:=
sys-apps/util-linux
)
systemtap? ( dev-debug/systemtap )"
RDEPEND="${DEPEND}
selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )"
BDEPEND="
virtual/pkgconfig
${PYTHON_DEPS}
doc? ( app-text/doxygen )
man? (
app-text/docbook-xml-dtd:4.4
>=dev-libs/libxslt-1.1.26
nls? ( app-text/po4a )
)
nls? ( sys-devel/gettext )
test? (
dev-libs/check
dev-libs/softhsm:2
dev-util/cmocka
net-libs/gnutls[pkcs11,tools]
sys-libs/libfaketime
sys-libs/nss_wrapper
sys-libs/pam_wrapper
sys-libs/uid_wrapper
)
"
CONFIG_CHECK="~KEYS"
PATCHES=(
"${FILESDIR}/${PN}-2.8.2-krb5_pw_locked.patch"
"${FILESDIR}/${PN}-2.9.1-conditional-python-install.patch"
)
MULTILIB_WRAPPED_HEADERS=(
/usr/include/ipa_hbac.h
/usr/include/sss_idmap.h
/usr/include/sss_nss_idmap.h
# --with-ifp
/usr/include/sss_sifp.h
/usr/include/sss_sifp_dbus.h
# from 1.15.3
/usr/include/sss_certmap.h
)
pkg_setup() {
linux-info_pkg_setup
python-single-r1_pkg_setup
}
src_prepare() {
default
plocale_get_locales > src/man/po/LINGUAS || die
sed -i \
-e "/_langs]/ s/ .*//" \
src/man/po/po4a.cfg \
|| die
enable_locale() {
local locale=${1}
sed -i \
-e "/_langs]/ s/$/ ${locale}/" \
src/man/po/po4a.cfg \
|| die
}
plocale_for_each_locale enable_locale
PLOCALES="${PLOCALES_BIN}"
plocale_get_locales > po/LINGUAS || die
sed -i \
-e 's:/var/run:/run:' \
src/examples/logrotate \
|| die
# disable flaky test, see https://github.com/SSSD/sssd/issues/5631
sed -i \
-e '/^\s*pam-srv-tests[ \\]*$/d' \
Makefile.am \
|| die
eautoreconf
multilib_copy_sources
}
src_configure() {
local native_dbus_cflags=$($(tc-getPKG_CONFIG) --cflags dbus-1 || die)
# Workaround for bug #938302
if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
export DTRACE="${BROOT}"/usr/bin/stap-dtrace
fi
multilib-minimal_src_configure
}
multilib_src_configure() {
local myconf=()
myconf+=(
--libexecdir="${EPREFIX}"/usr/libexec
--localstatedir="${EPREFIX}"/var
--runstatedir="${EPREFIX}"/run
--sbindir="${EPREFIX}"/usr/sbin
--with-pid-path="${EPREFIX}"/run
--with-plugin-path="${EPREFIX}"/usr/$(get_libdir)/sssd
--enable-pammoddir="${EPREFIX}"/$(getpam_mod_dir)
--with-ldb-lib-dir="${EPREFIX}"/usr/$(get_libdir)/samba/ldb
--with-db-path="${EPREFIX}"/var/lib/sss/db
--with-gpo-cache-path="${EPREFIX}"/var/lib/sss/gpo_cache
--with-pubconf-path="${EPREFIX}"/var/lib/sss/pubconf
--with-pipe-path="${EPREFIX}"/var/lib/sss/pipes
--with-mcache-path="${EPREFIX}"/var/lib/sss/mc
--with-secrets-db-path="${EPREFIX}"/var/lib/sss/secrets
--with-log-path="${EPREFIX}"/var/log/sssd
--with-kcm
--enable-kcm-renewal
--with-os=gentoo
--disable-rpath
--disable-static
# Valgrind is only used for tests
--disable-valgrind
$(use_with samba)
--with-smb-idmap-interface-version=6
$(multilib_native_use_enable acl cifs-idmap-plugin)
$(multilib_native_use_with selinux)
$(multilib_native_use_with selinux semanage)
--enable-krb5-locator-plugin
$(use_enable samba pac-responder)
$(multilib_native_use_with nfsv4 nfsv4-idmapd-plugin)
$(use_enable nls)
$(multilib_native_use_with netlink libnl)
$(multilib_native_use_with man manpages)
$(multilib_native_use_with sudo)
$(multilib_native_with autofs)
$(multilib_native_with ssh)
--without-oidc-child
--without-passkey
$(use_with subid)
$(use_enable systemtap)
--without-python2-bindings
$(multilib_native_use_with python python3-bindings)
# Annoyingly configure requires that you pick systemd XOR sysv
--with-initscript=$(usex systemd systemd sysv)
KRB5_CONFIG="${ESYSROOT}"/usr/bin/krb5-config
# Needed for Samba 4.21
CPPFLAGS="${CPPFLAGS} -I${ESYSROOT}/usr/include/samba-4.0"
)
use systemd && myconf+=(
--with-systemdunitdir=$(systemd_get_systemunitdir)
)
if ! multilib_is_native_abi; then
# work-around all the libraries that are used for CLI and server
myconf+=(
{POPT,TALLOC,TDB,TEVENT,LDB}_{CFLAGS,LIBS}=' '
# ldb headers are fine since native needs it
# ldb lib fails... but it does not seem to bother
{DHASH,UNISTRING,INI_CONFIG_V{0,1,1_1,1_3}}_{CFLAGS,LIBS}=' '
{PCRE,CARES,SYSTEMD_LOGIN,SASL,DBUS,CRYPTO,P11_KIT}_{CFLAGS,LIBS}=' '
{NDR_NBT,SAMBA_UTIL,SMBCLIENT,NDR_KRB5PAC,JANSSON}_{CFLAGS,LIBS}=' '
# use native include path for dbus (needed for build)
DBUS_CFLAGS="${native_dbus_cflags}"
# non-pkgconfig checks
ac_cv_lib_ldap_ldap_search=yes
--without-kcm
--without-manpages
)
fi
econf "${myconf[@]}"
}
multilib_src_compile() {
if multilib_is_native_abi; then
default
use doc && emake docs
else
emake libnss_sss.la pam_sss.la pam_sss_gss.la
emake sssd_krb5_locator_plugin.la
use samba && emake sssd_pac_plugin.la
fi
}
multilib_src_test() {
if multilib_is_native_abi; then
local -x CK_TIMEOUT_MULTIPLIER=10
emake check VERBOSE=yes
fi
}
multilib_src_install() {
if multilib_is_native_abi; then
emake -j1 DESTDIR="${D}" install
if use python; then
python_fix_shebang "${ED}"
python_optimize
fi
else
# easier than playing with automake...
dopammod .libs/pam_sss.so
dopammod .libs/pam_sss_gss.so
into /
dolib.so .libs/libnss_sss.so*
exeinto /usr/$(get_libdir)/krb5/plugins/libkrb5
doexe .libs/sssd_krb5_locator_plugin.so
if use samba; then
exeinto /usr/$(get_libdir)/krb5/plugins/authdata
doexe .libs/sssd_pac_plugin.so
fi
fi
}
multilib_src_install_all() {
einstalldocs
insinto /etc/sssd
insopts -m600
doins src/examples/sssd-example.conf
insinto /etc/logrotate.d
insopts -m644
newins src/examples/logrotate sssd
newconfd "${FILESDIR}"/sssd.conf sssd
keepdir /var/lib/sss/db
keepdir /var/lib/sss/deskprofile
keepdir /var/lib/sss/gpo_cache
keepdir /var/lib/sss/keytabs
keepdir /var/lib/sss/mc
keepdir /var/lib/sss/pipes/private
keepdir /var/lib/sss/pubconf/krb5.include.d
keepdir /var/lib/sss/secrets
keepdir /var/log/sssd
# strip empty dirs
if ! use doc; then
rm -r "${ED}"/usr/share/doc/"${PF}"/doc || die
rm -r "${ED}"/usr/share/doc/"${PF}"/{hbac,idmap,nss_idmap}_doc || die
fi
rm -r "${ED}"/run || die
find "${ED}" -type f -name '*.la' -delete || die
}
pkg_postinst() {
elog "You must set up sssd.conf (default installed into /etc/sssd)"
elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
elog "features."
optfeature "Kerberos keytab renew (see krb5_renew_interval)" app-crypt/adcli
}

333
sdk_container/src/third_party/portage-stable/sys-auth/sssd/sssd-2.9.5.ebuild vendored Normal file
View File

@ -0,0 +1,333 @@
# Copyright 1999-2024 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
EAPI=8
PLOCALES="ca de es fr ja ko pt_BR ru sv tr uk"
PLOCALES_BIN="${PLOCALES} bg cs eu fi hu id it ka nb nl pl pt tg zh_TW zh_CN"
PLOCALE_BACKUP="sv"
PYTHON_COMPAT=( python3_{10..12} )
inherit autotools linux-info multilib-minimal optfeature plocale \
python-single-r1 pam systemd toolchain-funcs
DESCRIPTION="System Security Services Daemon provides access to identity and authentication"
HOMEPAGE="https://github.com/SSSD/sssd"
if [[ ${PV} != 9999 ]]; then
SRC_URI="https://github.com/SSSD/sssd/releases/download/${PV}/${P}.tar.gz"
KEYWORDS="amd64 ~arm ~arm64 ~hppa ~m68k ~mips ~ppc ~ppc64 ~riscv ~sparc x86"
else
inherit git-r3
EGIT_REPO_URI="https://github.com/SSSD/sssd.git"
EGIT_BRANCH="master"
fi
LICENSE="GPL-3"
SLOT="0"
IUSE="acl doc +netlink nfsv4 nls +man python samba selinux subid sudo systemd systemtap test"
REQUIRED_USE="
python? ( ${PYTHON_REQUIRED_USE} )
test? ( sudo )"
RESTRICT="!test? ( test )"
DEPEND="
>=app-crypt/mit-krb5-1.19.1[${MULTILIB_USEDEP}]
app-crypt/p11-kit
>=dev-libs/ding-libs-0.2
>=dev-libs/cyrus-sasl-2.1.25-r3[kerberos]
dev-libs/jansson:=
dev-libs/libpcre2:=
dev-libs/libunistring:=
>=dev-libs/popt-1.16
>=dev-libs/openssl-1.0.2:=
>=net-dns/bind-tools-9.9[gssapi]
>=net-dns/c-ares-1.10.0-r1:=[${MULTILIB_USEDEP}]
>=net-nds/openldap-2.4.30:=[sasl,experimental]
>=sys-apps/dbus-1.6
>=sys-apps/keyutils-1.5:=
>=sys-libs/pam-0-r1[${MULTILIB_USEDEP}]
>=sys-libs/talloc-2.0.7
>=sys-libs/tdb-1.2.9
>=sys-libs/tevent-0.9.16
>=sys-libs/ldb-1.1.17-r1:=
virtual/libintl
acl? ( net-fs/cifs-utils[acl] )
netlink? ( dev-libs/libnl:3 )
nfsv4? ( >=net-fs/nfs-utils-2.3.1-r2 )
nls? ( >=sys-devel/gettext-0.18 )
python? (
${PYTHON_DEPS}
systemd? (
$(python_gen_cond_dep '
dev-python/python-systemd[${PYTHON_USEDEP}]
')
)
)
samba? ( >=net-fs/samba-4.10.2[winbind] )
selinux? (
>=sys-libs/libselinux-2.1.9
>=sys-libs/libsemanage-2.1
)
subid? ( >=sys-apps/shadow-4.9 )
systemd? (
sys-apps/systemd:=
sys-apps/util-linux
)
systemtap? ( dev-debug/systemtap )"
RDEPEND="${DEPEND}
selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )"
BDEPEND="
virtual/pkgconfig
${PYTHON_DEPS}
doc? ( app-text/doxygen )
man? (
app-text/docbook-xml-dtd:4.4
>=dev-libs/libxslt-1.1.26
nls? ( app-text/po4a )
)
nls? ( sys-devel/gettext )
test? (
dev-libs/check
dev-libs/softhsm:2
dev-util/cmocka
net-libs/gnutls[pkcs11,tools]
sys-libs/libfaketime
sys-libs/nss_wrapper
sys-libs/pam_wrapper
sys-libs/uid_wrapper
)
"
CONFIG_CHECK="~KEYS"
PATCHES=(
"${FILESDIR}/${PN}-2.8.2-krb5_pw_locked.patch"
"${FILESDIR}/${PN}-2.9.1-conditional-python-install.patch"
)
MULTILIB_WRAPPED_HEADERS=(
/usr/include/ipa_hbac.h
/usr/include/sss_idmap.h
/usr/include/sss_nss_idmap.h
# --with-ifp
/usr/include/sss_sifp.h
/usr/include/sss_sifp_dbus.h
# from 1.15.3
/usr/include/sss_certmap.h
)
pkg_setup() {
linux-info_pkg_setup
python-single-r1_pkg_setup
}
src_prepare() {
default
plocale_get_locales > src/man/po/LINGUAS || die
sed -i \
-e "/_langs]/ s/ .*//" \
src/man/po/po4a.cfg \
|| die
enable_locale() {
local locale=${1}
sed -i \
-e "/_langs]/ s/$/ ${locale}/" \
src/man/po/po4a.cfg \
|| die
}
plocale_for_each_locale enable_locale
PLOCALES="${PLOCALES_BIN}"
plocale_get_locales > po/LINGUAS || die
sed -i \
-e 's:/var/run:/run:' \
src/examples/logrotate \
|| die
# disable flaky test, see https://github.com/SSSD/sssd/issues/5631
sed -i \
-e '/^\s*pam-srv-tests[ \\]*$/d' \
Makefile.am \
|| die
eautoreconf
multilib_copy_sources
}
src_configure() {
local native_dbus_cflags=$($(tc-getPKG_CONFIG) --cflags dbus-1 || die)
# Workaround for bug #938302
if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
export DTRACE="${BROOT}"/usr/bin/stap-dtrace
fi
multilib-minimal_src_configure
}
multilib_src_configure() {
local myconf=()
myconf+=(
--libexecdir="${EPREFIX}"/usr/libexec
--localstatedir="${EPREFIX}"/var
--runstatedir="${EPREFIX}"/run
--sbindir="${EPREFIX}"/usr/sbin
--with-pid-path="${EPREFIX}"/run
--with-plugin-path="${EPREFIX}"/usr/$(get_libdir)/sssd
--enable-pammoddir="${EPREFIX}"/$(getpam_mod_dir)
--with-ldb-lib-dir="${EPREFIX}"/usr/$(get_libdir)/samba/ldb
--with-db-path="${EPREFIX}"/var/lib/sss/db
--with-gpo-cache-path="${EPREFIX}"/var/lib/sss/gpo_cache
--with-pubconf-path="${EPREFIX}"/var/lib/sss/pubconf
--with-pipe-path="${EPREFIX}"/var/lib/sss/pipes
--with-mcache-path="${EPREFIX}"/var/lib/sss/mc
--with-secrets-db-path="${EPREFIX}"/var/lib/sss/secrets
--with-log-path="${EPREFIX}"/var/log/sssd
--with-kcm
--enable-kcm-renewal
--with-os=gentoo
--disable-rpath
--disable-static
# Valgrind is only used for tests
--disable-valgrind
$(use_with samba)
--with-smb-idmap-interface-version=6
$(multilib_native_use_enable acl cifs-idmap-plugin)
$(multilib_native_use_with selinux)
$(multilib_native_use_with selinux semanage)
--enable-krb5-locator-plugin
$(use_enable samba pac-responder)
$(multilib_native_use_with nfsv4 nfsv4-idmapd-plugin)
$(use_enable nls)
$(multilib_native_use_with netlink libnl)
$(multilib_native_use_with man manpages)
$(multilib_native_use_with sudo)
$(multilib_native_with autofs)
$(multilib_native_with ssh)
--without-oidc-child
--without-passkey
$(use_with subid)
$(use_enable systemtap)
--without-python2-bindings
$(multilib_native_use_with python python3-bindings)
# Annoyingly configure requires that you pick systemd XOR sysv
--with-initscript=$(usex systemd systemd sysv)
KRB5_CONFIG="${ESYSROOT}"/usr/bin/krb5-config
)
use systemd && myconf+=(
--with-systemdunitdir=$(systemd_get_systemunitdir)
)
if ! multilib_is_native_abi; then
# work-around all the libraries that are used for CLI and server
myconf+=(
{POPT,TALLOC,TDB,TEVENT,LDB}_{CFLAGS,LIBS}=' '
# ldb headers are fine since native needs it
# ldb lib fails... but it does not seem to bother
{DHASH,UNISTRING,INI_CONFIG_V{0,1,1_1,1_3}}_{CFLAGS,LIBS}=' '
{PCRE,CARES,SYSTEMD_LOGIN,SASL,DBUS,CRYPTO,P11_KIT}_{CFLAGS,LIBS}=' '
{NDR_NBT,SAMBA_UTIL,SMBCLIENT,NDR_KRB5PAC,JANSSON}_{CFLAGS,LIBS}=' '
# use native include path for dbus (needed for build)
DBUS_CFLAGS="${native_dbus_cflags}"
# non-pkgconfig checks
ac_cv_lib_ldap_ldap_search=yes
--without-kcm
--without-manpages
)
fi
econf "${myconf[@]}"
}
multilib_src_compile() {
if multilib_is_native_abi; then
default
use doc && emake docs
else
emake libnss_sss.la pam_sss.la pam_sss_gss.la
emake sssd_krb5_locator_plugin.la
use samba && emake sssd_pac_plugin.la
fi
}
multilib_src_test() {
if multilib_is_native_abi; then
local -x CK_TIMEOUT_MULTIPLIER=10
emake check VERBOSE=yes
fi
}
multilib_src_install() {
if multilib_is_native_abi; then
emake -j1 DESTDIR="${D}" install
if use python; then
python_fix_shebang "${ED}"
python_optimize
fi
else
# easier than playing with automake...
dopammod .libs/pam_sss.so
dopammod .libs/pam_sss_gss.so
into /
dolib.so .libs/libnss_sss.so*
exeinto /usr/$(get_libdir)/krb5/plugins/libkrb5
doexe .libs/sssd_krb5_locator_plugin.so
if use samba; then
exeinto /usr/$(get_libdir)/krb5/plugins/authdata
doexe .libs/sssd_pac_plugin.so
fi
fi
}
multilib_src_install_all() {
einstalldocs
insinto /etc/sssd
insopts -m600
doins src/examples/sssd-example.conf
insinto /etc/logrotate.d
insopts -m644
newins src/examples/logrotate sssd
newconfd "${FILESDIR}"/sssd.conf sssd
keepdir /var/lib/sss/db
keepdir /var/lib/sss/deskprofile
keepdir /var/lib/sss/gpo_cache
keepdir /var/lib/sss/keytabs
keepdir /var/lib/sss/mc
keepdir /var/lib/sss/pipes/private
keepdir /var/lib/sss/pubconf/krb5.include.d
keepdir /var/lib/sss/secrets
keepdir /var/log/sssd
# strip empty dirs
if ! use doc; then
rm -r "${ED}"/usr/share/doc/"${PF}"/doc || die
rm -r "${ED}"/usr/share/doc/"${PF}"/{hbac,idmap,nss_idmap}_doc || die
fi
rm -r "${ED}"/run || die
find "${ED}" -type f -name '*.la' -delete || die
}
pkg_postinst() {
elog "You must set up sssd.conf (default installed into /etc/sssd)"
elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
elog "features."
optfeature "Kerberos keytab renew (see krb5_renew_interval)" app-crypt/adcli
}