From b2ff7a070eb0bf1ab3c133262eb0c527e82bfc1f Mon Sep 17 00:00:00 2001 From: Michal Židek Date: Feb 26 2020 23:06:00 +0000 Subject: Adding 2.2.3 version release notes --- diff --git a/users/releases.rst b/users/releases.rst index fbeda7a..6e4cbac 100644 --- a/users/releases.rst +++ b/users/releases.rst @@ -9,6 +9,8 @@ for a longer time than other releases. 2.x Series ^^^^^^^^^^ +-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ +|`sssd-2.2.3.tar.gz `_ |`sssd-2.2.3.tar.gz.asc `_ |SHA256SUM: ``11565446290e7432dbd208c4db02fcb42ab17e853d8ba4f994af9a9c57bbbb11``|Date: 2019-09-12|:doc:`Release notes ` |`Manpages `_ | ++-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ |`sssd-2.2.2.tar.gz `_ |`sssd-2.2.2.tar.gz.asc `_ |SHA256SUM: ``5349a809d2e79ed6bbd875a49532e7e03c1e2e732c75e8d15e9e7de57d5a07d7``|Date: 2019-09-12|:doc:`Release notes ` |`Manpages `_ | +-----------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------+-------------------------------------------------------------------------------+----------------+---------------------------------------------+--------------------------------------------------------------+ |`sssd-2.2.1.tar.gz `_ |`sssd-2.2.1.tar.gz.asc `_ |SHA256SUM: ``a5c94887c293e1d996230d58da67621c4176afafb4823f2bc680208ba91abd18``|Date: 2019-08-15|:doc:`Release notes ` |`Manpages `_ | diff --git a/users/relnotes/notes_2_2_3.rst b/users/relnotes/notes_2_2_3.rst new file mode 100644 index 0000000..6ae2695 --- /dev/null +++ b/users/relnotes/notes_2_2_3.rst @@ -0,0 +1,267 @@ +SSSD 2.2.3 +========== + + +Highlights +---------- + +New features +^^^^^^^^^^^^ +* allow_missing_name now treats empty strings the same as missing names. +* 'soft_ocsp' and 'soft_crl options have been added to make the checks for + revoked certificates more flexible if the system is offline. +* Smart card authentication in polkit is now allowed by default. +* ssh_use_certificate_matching_rules now allows no_rules and all_rules values + (see man page for description). + +Notable bug fixes +^^^^^^^^^^^^^^^^^ +* Fixed several memory management errors that caused SSSD to crash under some + circumstances. +* Handling of FreeIPA users and groups containing '@' sign now works. +* Issue when autofs was unable to mount shares was fixed. +* SSSD was unable to hande ldap_uri containing URIs with different port numbers. + This was fixed. + +Packaging Changes +----------------- +None + +Documentation Changes +--------------------- +* added options soft_ocsp and soft_crl +* ssh_use_certificate_matching_rules option was updated with no_rules and + all_rules. + +Tickets Fixed +------------- + + * `2607 `_ - sssd should not always read entire autofs map from ldap + * `2660 `_ - SSSD service is crashing: dbus_watch_handle() is invoked with corrupted 'watch' value + * `2710 `_ - Propagate error about multiple entries found from cache_req to responder + * `3078 `_ - use the ERROR and PRINT macros consistently + * `3219 `_ - [RFE] Regular expression used in sssd.conf not being able to consume an @-sign in the user/group name. + * `3583 `_ - Stop calling umask(0) in selinux_child now that libsemanage has been fixed + * `3677 `_ - [RFE] SSSD smart smard card, configure to soft fail when CRL not available + * `3864 `_ - sss_ssh_authorizedkeys: no output when attribute value contains trailing whitespace + * `3914 `_ - test_pam_responder.py needs improvement + * `3938 `_ - sssctl config-check giving the wrong error message when there are only snippet files and no sssd. conf + * `3995 `_ - SSSDConfig: some options are unknown + * `4024 `_ - Non FIPS140 compliant usage of PRNG + * `4030 `_ - sss_obfuscate fails to rewriting comments + * `4073 `_ - Let IPA client read IPA objects via LDAP and not via extdom plugin when resolving trusted users and groups + * `4078 `_ - Trusted domain user logins succeed after using ipa trustdomain-disable + * `4080 `_ - Improve `sssd_nss` debug messages + * `4081 `_ - systemctl status sssd says No such file or directory about "default" when keytab exists but is empty file + * `4085 `_ - support for defaults entry is failing in sssd sudo against Openldap server + * `4094 `_ - sss_client: usage of srand()/rand() may be disruptive for the user of lib + * `4100 `_ - KCM: ccache is created with kdc_offset=INT32_MAX + * `4101 `_ - [RFE] pam_sss allow_missing_name should allow whitespace-only string + * `4102 `_ - Null dereference in sssctl/sssctl_domains.c:sssctl_domain_status_active_server() + * `4111 `_ - automount on RHEL7 gives the message 'lookup(sss): setautomntent: No such file or directory' + * `4112 `_ - ldap_uri failover doesn't work with different ports + * `4114 `_ - sssd failover leads to delayed and failed logins + * `4115 `_ - Smart Card authentication in polkit + * `4116 `_ - autofs: delete possible duplicate of an autofs entry + * `4121 `_ - [RFE]: use certificate matching rule when generating SSH key from a certificate + * `689 `_ - Split sssd-ldap man page + + +Detailed changelog +------------------ + +* Alex Rodin (7): + * Added ERROR and PRINT macros to the tools + * Update sss_ssh.c + * Update __init__.py.in + * Added PRINT macro in the sssctl tool + * Update README.md + * Updated test_pam_responder.py + * Created a new sssd-ldap-attributes.5 man page + +* Alexey Tikhonov (39): + * providers/ipa/: add_v1_user_data() amended + * responder/cache_req: added debug helper function + * responder/nss: improved debug messages + * responder/nss: DCE + * responder: log cmdline of client pid + * SSS_CLIENT: got rid of using PRNG + * util/server: amended close_low_fds() + * util/sss_krb5.c: elimination of unreachable code + * util/sss_krb5: find_principal_in_keytab() was amended + * util/sss_krb5: fixed few memory handling issues + * util/sss_krb5: debug messages fixes + * sssctl/sssctl_domains.c: null dereference fixed + * MMAP_CACHE: use CSPRNG to init hash table seed + * Moved unsecure sss_rand() out of crypto lib + * Reduces code duplication + * sss_ssh_knownhostsproxy: relocated O_NONBLOCK setting + * sss_ssh_knownhostsproxy: fixed Coverity issue + * util/sss_krb5: amended sss_krb5_get_error_message() + * Amended sss_krb5_get_error_message() usage. + * ldap_child: sanitization of error handling + * KEYTAB_CLEAN_NAME macro was replaced + * SBUS: defer deallocation of sbus_watch_ctx + * util/server.c: become_daemon() made static + * server:become_daemon(): got rid of unused codepath + * server:become_daemon(): handle fail of fork() + * server:become_daemon(): fixed waitpid()-loop + * server:become_daemon(): fix read of uninitialized value + * server:become_daemon(): change handling of chdir() fail + * server:become_daemon(): handle fail of setsid() + * util/memory: sanitization + * util/memory: helper(s) to securely erase mem was reworked + * tools/sss_seed: proper zeroization of sensitive data + * util: fixed potential mem leak in s3crypt_gen_salt() + * util/sha512_crypt_r: got rid of redundant mem align + * util/sha512_crypt_r: removed misleading comments + * util/sha512_crypt_r: proper zeroization of sensitive data + * db/sysdb_ops: proper zeroization of sensitive data + * util/authtok: set destructor in sss_authtok_new() + * LDAP: proper handling of master password + +* Ariel O. Barria (1): + * sss_obfuscate: do not fail if sssd.conf contains non-ascii characters + +* Fabiano Fidêncio (1): + * TESTS: Re-add tests for `kdestroy -A` + +* Jakub Hrozek (3): + * KCM: Fix typo in allocation check + * KCM: Set kdc_offset to zero initially + * sudo: use objectCategory instead of objectClass in ad sudo provider + +* Jakub Jelen (1): + * Allow smart card authentication in polkit + +* Lukas Slebodnik (1): + * IFP: Fix talloc hierarchy for members of struct ifp_list_domains_state + +* MIZUTA Takeshi (4): + * sss_client/idmap/common_ex.c: fix sss_nss_timedlock() to return errno + * util/server.c: fix handling when error occurs in waitpid() + * Fix timing to save errno + * Add processing to save errno before outputting DEBUG + +* Michal Židek (8): + * Bumping the version to track the 2.2.3 development + * SPECFILE: Add 'make' as build dependency + * memcache: Stop using the word fastcache for memcache + * MAN: GPO and built-in groups + * bash_rc: Build with systemtap + * MAN: Missing man pages in src/man/po/po4a.cfg + * MAN: Fix errors in Japanese translation + * Update the translations for the 2.2.3 release + +* Niranjan M.R (4): + * pytest: Use idm:DL1 module to install 389-ds + * pytest: Update README with instructions to execute tests + * pytest/testlib: Add python-ldap as dependency + * Makefile.am: Use README.md instead of README + +* Pavel Březina (49): + * sss_ptr_hash: keep value pointer when destroying spy + * autofs: fix typo in test tool + * sysdb: add expiration time to autofs entries + * sysdb: add sysdb_get_autofsentry + * sysdb: add enumerationExpireTimestamp + * sysdb: store enumeration expiration time in autofs map + * sysdb: store original dn in autofs map + * sysdb: add sysdb_del_autofsentry_by_key + * cache_req: add autofs map entries plugin + * cache_req: add autofs map by name plugin + * cache_req: add autofs entry by name plugin + * autofs: convert code to cache_req + * autofs: use cache_req to obtain single entry in getentrybyname + * autofs: use cache_req to obtain map in setent + * dp: add dp_error_to_ret + * dp: add dp_no_output type to be used in dp_set_method + * dp: add additional autofs methods + * dp: replace autofs handler with enumerate method + * ldap: add base_dn to sdap_search_bases + * ldap: rename sdap_autofs_get_map to sdap_autofs_enumerate + * ldap: implement autofs get map + * ldap: implement autofs get entry + * autofs: allow to run only setent without enumeration in test tool + * autofs: always refresh auto.master + * sysdb: invalidate also autofs entries + * sss_cache: invalidate also autofs entries + * ci: allow distribution specific supression files + * ci: suppress Debian valgrind errors + * ci: add Debian 10 + * ifp: call tevent_req_post in case of error in ifp_user_get_attr_send + * sudo: get timezone information from previous value when constructing new usn + * ci: enable on demand runs + * ci: set build name to pull request or branch name + * ci: notify that build awaits executor + * ci: convert to scripted pipeline + * db: fix potential memory leak in sysdb_store_selinux_config + * ldap: do not store empty attribute with ldap_rfc2307_fallback_to_local_users = true + * sss_ptr_hash: pass new hash_entry_t to custom delete callback + * failover: make sure we switch to anoter server if only port differs + * autofs: remove unused enum + * autofs: delete possible duplicate of an autofs entry + * ci: store artifacts in jenkins for on-demand runs + * ci: allow to specify systems where tests should be run for on-demand tests + * ci: add Fedora 31 + * ci: install python2 on Fedora 31 and RHEL 8 so python2 bindings can be built + * ci: disable python2 bindings on Fedora 32+ + * man: add missing new line to autofs_attributes.xml + * pam_sss: treat whitespace name as missing name if allow_missing_name is set + * sudo: add ldap_sudorule_object_class_attr + +* Paweł Poławski (2): + * selinux: Keep explicite umask() calls + * files_ops: Remove unused functions parameter + +* REIM THOMAS (1): + * MAN: Provide minimum information on GPO access control + +* Samuel Cabrero (12): + * SYSDB: Delete linked local user overrides when deleting a user + * SYSDB: Convert cached domain 'enumerated' attribute from bool to uint + * SDAP: Add provider name to enumeration and cleanup tasks + * LDAP: Return errno_t for ldap id enumeration task setup functions + * LDAP: Rename enumeration and cleanup functions to contain the provider + * AD: Rename enumeration functions to contain the provider name + * LDAP: Improve ldap_id_setup_enumeration error logic + * LDAP: Remove unnecessary task pointer + * LDAP: Move enum fields to id provider context + * MONITOR: Propagate error when resolv.conf does not exists in polling mode + * MONITOR: Add a new option to control resolv.conf monitoring + * MONITOR: Resolve symlinks setting the inotify watchers + +* Sumit Bose (15): + * ipa: use LDAP not extdom to lookup IPA users and groups + * utils: extend some find_domain_* calls to search disabled domain + * ipa: support disabled domains + * ipa: ignore objects from disabled domains on the client + * sysdb: add sysdb_subdomain_content_delete() + * ipa: delete content of disabled domains + * ipa: use the right context for autofs + * ssh: add ssh_use_certificate_keys option to config checks + * ssh: apply certificate matching rules + * ssh: add option ssh_use_certificate_matching_rules + * ssh: enable p11_child logging + * p11_child: allow verification with no_verification option + * p11_child: add 'soft_ocsp' and 'soft_crl options + * ipa: add failover to override lookups + * ipa: add failover to access checks + +* Thorsten Scherf (1): + * Fix option type for ldap_group_type + +* Tomas Halman (9): + * LDAP: Systemtap ldap probes fail without filter + * LDAP: extend LDAP systemtap probes of attr list + * LDAP: Add probes to be able print ldap attributes + * MAN: update systemtap man page + * TESTS: tests have to be linked with systemtap + * MAN: Update SystemTap man page + * IPA: Utilize new protocol in IPA extdom plugin + * INI: sssctl config-check giving the wrong message + * TESTS: check "sssctl config-check" output + +* pedrosam (1): + * cache_req: propagate multiple entries error to the caller +