sssd-1.16.0-19.el7.5

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

This update fixes the following bugs:

* Previously, if a large group was requested through the sssd_nss_ex interface, the buffer used inside the SSSD had to be relocated to be able to hold all the group members. However, when SSSD wanted to free this buffer, it used the address of the original memory, not the reallocated one. Because SSSD freed the original memory address, not the new one returned by the function that reallocates the memory, the Asianux Directory Server (RHDS) sometimes terminated unexpectedly. The reason for this is that the sssd API is called from the context of RHDS. With this update, the SSSD code has been modified to free the reallocated memory. As a result, no crash that would manifest as a crash of RHDS happens in the SSSD code. (BZ#1570527)

* The sssd_nss module calls a free function when the lifetime of a netgroup representation expires. Additionally, administrators can manually expire netgroups using the sssd_cache utility. However, after this manual expiration, SSSD called the function again when the lifetime expired. As a consequence, the function was called twice and resulted in a double-free memory error. With this update, the free function is no longer called when the administrator uses the sssd_cache utility. Instead it removes the netgroup from the list of known netgroups and later, when the netgroup reaches its lifetime, it is removed from memory. As a result, the double-free error no longer occurs. (BZ#1579703)

* Previously, an RPM macro that is supposed to restart SSSD after an upgrade was placed into a section where the condition that enables this scriptlet was never true. As a consequence, the sssd service did not restart automatically during the upgrade from 7.4 to 7.5. With this update, the sssd service is now restarted explicitly instead of using the macro that was previously used. As a result, the sssd service now restarts after an upgrade. (BZ#1579780)

* Previously, the new Samba version in Asianux Server 7.5 used a newer version of the idmap plug-in interface and SSSD still provided a plug-in with an older version. If Samba was configured to use SSSD's idmap plug-in, smdb and winbind services failed to start due to the version mismatch. With this update, SSSD provides a plug-in with a matching version. As a result, smdb and winbind run as expected. (BZ#1580281)

* Previously, when the sssd_be process searched for Identity Management (IDM) groups that contained external, typically Active Directory, groups as their members, it allocated the result on a memory context that was used through the lifetime of sssd_be. As a consequence, the memory usage of sssd_be was continuously growing. With this update, more appropriate memory context owns the memory and frees it when necessary. As a result, sssd_be memory usage no longer grows with searching for IDM groups with external members. (BZ#1583746)