|
 |
fc3955 |
From de8911af504c6b6f51c906e8cec7da12ff4eed09 Mon Sep 17 00:00:00 2001
|
|
|
fc3955 |
From: Thomas Woerner <twoerner@redhat.com>
|
|
|
fc3955 |
Date: Tue, 30 Aug 2022 16:38:42 +0200
|
|
|
fc3955 |
Subject: [PATCH] ipaserver: Add missing idstart check
|
|
|
fc3955 |
|
|
|
fc3955 |
The idstart needs to be larger than UID_MAX or GID_MAX from /etc/login.defs.
|
|
|
fc3955 |
This is "Require idstart to be larger than UID_MAX" for freeipa.
|
|
|
fc3955 |
|
|
|
fc3955 |
Fixes: #896 (Invalid RID/SID SSSD backtrace after deployment)
|
|
|
fc3955 |
---
|
|
|
fc3955 |
roles/ipaserver/library/ipaserver_test.py | 13 ++++++++++++-
|
|
|
fc3955 |
roles/ipaserver/module_utils/ansible_ipa_server.py | 7 ++++++-
|
|
|
fc3955 |
2 files changed, 18 insertions(+), 2 deletions(-)
|
|
|
fc3955 |
|
|
|
fc3955 |
diff --git a/roles/ipaserver/library/ipaserver_test.py b/roles/ipaserver/library/ipaserver_test.py
|
|
|
fc3955 |
index 2158150..f830f37 100644
|
|
|
fc3955 |
--- a/roles/ipaserver/library/ipaserver_test.py
|
|
|
fc3955 |
+++ b/roles/ipaserver/library/ipaserver_test.py
|
|
|
fc3955 |
@@ -225,7 +225,8 @@ from ansible.module_utils.ansible_ipa_server import (
|
|
|
fc3955 |
read_cache, ca, tasks, check_ldap_conf, timeconf, httpinstance,
|
|
|
fc3955 |
check_dirsrv, ScriptError, get_fqdn, verify_fqdn, BadHostError,
|
|
|
fc3955 |
validate_domain_name, load_pkcs12, IPA_PYTHON_VERSION,
|
|
|
fc3955 |
- encode_certificate, check_available_memory, getargspec, adtrustinstance
|
|
|
fc3955 |
+ encode_certificate, check_available_memory, getargspec, adtrustinstance,
|
|
|
fc3955 |
+ get_min_idstart
|
|
|
fc3955 |
)
|
|
|
fc3955 |
from ansible.module_utils import six
|
|
|
fc3955 |
|
|
|
fc3955 |
@@ -579,6 +580,16 @@ def main():
|
|
|
fc3955 |
"'--ignore-topology-disconnect/--ignore-last-of-role' "
|
|
|
fc3955 |
"options can be used only during uninstallation")
|
|
|
fc3955 |
|
|
|
fc3955 |
+ if get_min_idstart is not None:
|
|
|
fc3955 |
+ min_idstart = get_min_idstart()
|
|
|
fc3955 |
+ if self.idstart < min_idstart:
|
|
|
fc3955 |
+ raise RuntimeError(
|
|
|
fc3955 |
+ "idstart (%i) must be larger than UID_MAX/GID_MAX "
|
|
|
fc3955 |
+ "(%i) setting in /etc/login.defs." % (
|
|
|
fc3955 |
+ self.idstart, min_idstart
|
|
|
fc3955 |
+ )
|
|
|
fc3955 |
+ )
|
|
|
fc3955 |
+
|
|
|
fc3955 |
if self.idmax < self.idstart:
|
|
|
fc3955 |
raise RuntimeError(
|
|
|
fc3955 |
"idmax (%s) cannot be smaller than idstart (%s)" %
|
|
|
fc3955 |
diff --git a/roles/ipaserver/module_utils/ansible_ipa_server.py b/roles/ipaserver/module_utils/ansible_ipa_server.py
|
|
|
fc3955 |
index aba6b68..5b1c4e5 100644
|
|
|
fc3955 |
--- a/roles/ipaserver/module_utils/ansible_ipa_server.py
|
|
|
fc3955 |
+++ b/roles/ipaserver/module_utils/ansible_ipa_server.py
|
|
|
fc3955 |
@@ -41,7 +41,7 @@ __all__ = ["IPAChangeConf", "certmonger", "sysrestore", "root_logger",
|
|
|
fc3955 |
"adtrustinstance", "IPAAPI_USER", "sync_time", "PKIIniLoader",
|
|
|
fc3955 |
"default_subject_base", "default_ca_subject_dn",
|
|
|
fc3955 |
"check_ldap_conf", "encode_certificate", "decode_certificate",
|
|
|
fc3955 |
- "check_available_memory", "getargspec"]
|
|
|
fc3955 |
+ "check_available_memory", "getargspec", "get_min_idstart"]
|
|
|
fc3955 |
|
|
|
fc3955 |
import sys
|
|
|
fc3955 |
|
|
|
fc3955 |
@@ -200,6 +200,11 @@ else:
|
|
|
fc3955 |
from ipalib.x509 import load_certificate
|
|
|
fc3955 |
load_pem_x509_certificate = None
|
|
|
fc3955 |
|
|
|
fc3955 |
+ try:
|
|
|
fc3955 |
+ from ipaserver.install.server.install import get_min_idstart
|
|
|
fc3955 |
+ except ImportError:
|
|
|
fc3955 |
+ get_min_idstart = None
|
|
|
fc3955 |
+
|
|
|
fc3955 |
else:
|
|
|
fc3955 |
# IPA version < 4.5
|
|
|
fc3955 |
|
|
|
fc3955 |
--
|
|
|
fc3955 |
2.37.3
|
|
|
fc3955 |
|