sssd-1.15.2-50.el7.11

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

This update fixes the following bugs:

* Previously, the SSSD service handled mapping between the Linux users and SELinux user labels with a hand-crafted code, that used low-level libselinux calls. This caused many failures related to SELinux user label processing for the IPA clients. With this update, SSSD now uses a high-level function "getseuserbyname()", which replaces the previous code. As a result, the described problems no longer occur. (BZ#1516700)

* Previously, the sssd_nss process did not check for the min_id and max_id limits before starting a search by numerical ID value, but only after the search. This caused an unnecessary load on the LDAP servers because SSSD would first ask for data, but then discard it because the IDs would be out of range. With this update, sssd_nss now first consults the min_id and max_id limits. As a result, searching for a numerical ID value outside the in_id and max_id range does not even reach the server. (BZ#1525110)

* Previously, there was id_ctx->srv_opts data structure remembered in sudo request to switch the latest update sequence number (USN) values. In cases when there were two concurrent sudo refresh requests and one of them failed, it caused a failover to try the next server, which freed srv_opts. This then caused the access after free error in the second sudo refresh request. A patch has been provided, which always uses srv_opts from the identity context. As a result, the described problem no longer occurs. (BZ#1530975)

Users of sssd are advised to upgrade to these updated packages, which fix these bugs.