General hardening

[alexey-tikhonov]

Clear env of privileged 'sssd_pam' as a security hardening measure.

[alexey-tikhonov]

Looks like clearing 'LDB_MODULES_PATH' breaks a lot of integration tests:

sssd/Makefile.am

Line 2050 in af65c00

TESTS_ENVIRONMENT = LDB_MODULES_PATH=$(abs_top_builddir)/ldb_mod_test_dir \

so I've split this PR into two (see #7774)

This one will be probably blocked until we get rid of intg-tests...

[jengelh]

Ironically, I did spot that previously and applied it in cc675eb in part.

[eslerm]

This PR is mentioned in a vulnerability report. By not assigning CVEs, downstream maintainers (like distros) will not know which security patches are required for backporting to make downstream users of SSSD secure.

https://www.openwall.com/lists/oss-security/2024/12/19/1

[alexey-tikhonov]

This PR is mentioned in a vulnerability report.

Not a "vulnerability" but a "weaknesses".
No way to exploit it was presented thus no CVEs were assigned.

[sumit-bose]

Hi,

thanks, looks like integrations tests are passing now. I'm fine with the patch, but I might be biased, nevertheless, ACK.

bye,
Sumit

[aplopez]

LGTM

[alexey-tikhonov]

Pushed PR: #7764

• master
  • 50892b6 - Don't clear 'sssd_pam' env when built for intg-tests
  • 6cb2de5 - Clear env of privileged 'sssd_pam' as a security hardening measure.
• sssd-2-10
  • a1dba9c - Don't clear 'sssd_pam' env when built for intg-tests
  • 6fc4cc3 - Clear env of privileged 'sssd_pam' as a security hardening measure.