From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Alexander Bokovoy To: git-commits@fedoraproject.org Subject: [rpms/freeipa] rawhide: Fine-tune permissions checks Date: Mon, 07 Sep 2026 13:20:12 GMT Message-ID: <178878721246.1.12913005766144279511.rpms-freeipa-3f63d99de891@fedoraproject.org> List-ID: X-Git-Repo: rpms/freeipa X-Git-Branch: rawhide X-Git-Rev: 3f63d99de891e7f99b67d0e6ffbbc6db950f7d1b ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvZnJlZWlwYQogICAgICAgICAgICBCcmFuY2ggOiByYXdoaWRlCiAgICAgICAg ICAgIENvbW1pdCA6IDNmNjNkOTlkZTg5MWU3Zjk5YjY3ZDBlNmZmYmJjNmRiOTUwZjdkMWIKICAg ICAgICAgICAgQXV0aG9yIDogQWxleGFuZGVyIEJva292b3kgPGFib2tvdm95QHJlZGhhdC5jb20+ CiAgICAgICAgICAgIERhdGUgICA6IDIwMjYtMDktMDdUMTY6MTc6MjUrMDM6MDAKICAgICAgICAg ICAgU3RhdHMgIDogKzEyMy8tMSBpbiAyIGZpbGUocykKICAgICAgICAgICAgVVJMICAgIDogaHR0 cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9mcmVlaXBhL2MvM2Y2M2Q5OWRlODkxZTdm OTliNjdkMGU2ZmZiYmM2ZGI5NTBmN2QxYj9icmFuY2g9cmF3aGlkZQoKICAgICAgICAgICAgTG9n OgogICAgICAgICAgICBGaW5lLXR1bmUgcGVybWlzc2lvbnMgY2hlY2tzCgpVcHN0cmVhbSBQUiM4 NTU4OiBodHRwczovL2dpdGh1Yi5jb20vZnJlZWlwYS9mcmVlaXBhL3B1bGwvODU1OAoKU2lnbmVk LW9mZi1ieTogQWxleGFuZGVyIEJva292b3kgPGFib2tvdm95QHJlZGhhdC5jb20+CgotLS0KZGlm ZiAtLWdpdCBhL2ZyZWVpcGEtcHItODU1OC5wYXRjaCBiL2ZyZWVpcGEtcHItODU1OC5wYXRjaApu ZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi5hOWFhNDk0Ci0tLSAvZGV2L251bGwK KysrIGIvZnJlZWlwYS1wci04NTU4LnBhdGNoCkBAIC0wLDAgKzEsMTE4IEBACitGcm9tIDNjMzdi NWFiOWJkYjBkMTc4ODE4MGI1ODZiNWY4MTQ1MzVkODkyY2YgTW9uIFNlcCAxNyAwMDowMDowMCAy MDAxCitGcm9tOiBBbGV4YW5kZXIgQm9rb3ZveSA8YWJva292b3lAcmVkaGF0LmNvbT4KK0RhdGU6 IE1vbiwgNyBTZXAgMjAyNiAxNjoxMjozMyArMDMwMAorU3ViamVjdDogW1BBVENIXSBBbGxvdyBm aW5lIHR1bmVkIHByaXZpbGVnZSBjaGVjaworCitMZXQgdXNlcnMgcGFzcyB0aHJvdWdoIHRoZSBw cml2aWxlZ2UgY2hlY2sgaWYgZWl0aGVyCistIHdob2xlIGVudHJ5IHJlYWQgZ3JhbnRlZCAoJ3Yn IGluIHRoZSBHRVIgcmVzcG9uc2UpCistIGF0IGxlYXN0IG9uZSBhdHRyaWJ1dGUgcmVhZCBncmFu dGVkCisKK1RoaXMgaXMgZW5vdWdoIHRvIGFsbG93IExEQVBSZXRyaWV2ZSB0byBwYXNzLCBiZWNh dXNlIHRoZSByZXN0IGlzCitjb250cm9sbGVkIGJ5IHRoZSBleHBsaWNpdCBBQ0lzIGluIExEQVAu CisKK1JlbGF0ZWQ6IENWRS0yMDI2LTc5Njc4CisKK1NpZ25lZC1vZmYtYnk6IEFsZXhhbmRlciBC b2tvdm95IDxhYm9rb3ZveUByZWRoYXQuY29tPgorLS0tCisgaXBhc2VydmVyL3BsdWdpbnMvYmFz ZWxkYXAucHkgIHwgMjcgKysrKysrKysrKysrKysrKysrKysrKy0tLS0tCisgaXBhc2VydmVyL3Bs dWdpbnMvcHJpdmlsZWdlLnB5IHwgMjkgKysrKysrKysrKysrKysrKysrKysrLS0tLS0tLS0KKyAy IGZpbGVzIGNoYW5nZWQsIDQzIGluc2VydGlvbnMoKyksIDEzIGRlbGV0aW9ucygtKQorCitkaWZm IC0tZ2l0IGEvaXBhc2VydmVyL3BsdWdpbnMvYmFzZWxkYXAucHkgYi9pcGFzZXJ2ZXIvcGx1Z2lu cy9iYXNlbGRhcC5weQoraW5kZXggZDY5M2M3MTEyLi5lNzUxZGM2NzMgMTAwNjQ0CistLS0gYS9p cGFzZXJ2ZXIvcGx1Z2lucy9iYXNlbGRhcC5weQorKysrIGIvaXBhc2VydmVyL3BsdWdpbnMvYmFz ZWxkYXAucHkKK0BAIC0xMDU0LDExICsxMDU0LDIyIEBAIGxhc3QsIGFmdGVyIGFsbCBzZXRzIGFu ZCBhZGRzLiIiIiksCisgICAgICAgICAgICAgICAgIGlmIG5vdCBhdHRyczoKKyAgICAgICAgICAg ICAgICAgICAgIHJldHVybiBUcnVlCisgICAgICAgICAgICAgICAgIHJldHVybiBhbnkoJ3cnIGlu IGF0dHJfcmlnaHRzLmdldChhLCAnJykgZm9yIGEgaW4gYXR0cnMpCistICAgICAgICAgICAgIyBy ZWFkIC8gc2VhcmNoIC8gY29tcGFyZQorLSAgICAgICAgICAgIGF0dHJzID0ge2EubG93ZXIoKSBm b3IgYSBpbiBwZXJtLmdldCgnaXBhcGVybWRlZmF1bHRhdHRyJywgKCkpfQorLSAgICAgICAgICAg IGlmIG5vdCBhdHRyczoKKysgICAgICAgICAgICAjIHJlYWQgLyBzZWFyY2ggLyBjb21wYXJlOiBh IHJlYWQgaXMgbmV2ZXIgZGVuaWVkIHdob2xlc2FsZSBieQorKyAgICAgICAgICAgICMgMzg5LWRz IC0tIGl0IHJldHVybnMgdGhlIGVudHJ5IGFuZCBzaWxlbnRseSBmaWx0ZXJzIG91dCB0aGUKKysg ICAgICAgICAgICAjIGluZGl2aWR1YWwgYXR0cmlidXRlcyB0aGUgY2FsbGVyIG1heSBub3Qgc2Vl LiAgUGVybWl0IHRoZQorKyAgICAgICAgICAgICMgb3BlcmF0aW9uIHdoZW5ldmVyIHRoZSBjYWxs ZXIgY2FuIHZpZXcgdGhlIGVudHJ5IChlbnRyeS1sZXZlbAorKyAgICAgICAgICAgICMgJ3YnKSBv ciByZWFkICphbnkqIG9mIGl0cyBhdHRyaWJ1dGVzLiAgSVBBJ3MgcmVhZCBBQ0lzIGFyZQorKyAg ICAgICAgICAgICMgYXR0cmlidXRlLXNjb3BlZCwgc28gYW4gdW5wcml2aWxlZ2VkIGNhbGxlciBy ZWFkaW5nIGl0cyBvd24gZW50cnkKKysgICAgICAgICAgICAjIGdldHMgJ2VudHJ5TGV2ZWxSaWdo dHM6IG5vbmUnIHlldCBjYW4gc3RpbGwgcmVhZCBjbi9zbi9tYWlsLy4uLjsKKysgICAgICAgICAg ICAjIHJlcXVpcmluZyByZWFkIG9uIHRoaXMgcGVybWlzc2lvbidzIHNwZWNpZmljIGF0dHJpYnV0 ZXMgd291bGQKKysgICAgICAgICAgICAjIHdyb25nbHkgdHVybiBzdWNoIGEgbGVnaXRpbWF0ZSBw YXJ0aWFsIHJlYWQgaW50byBhIHRvdGFsIGRlbmlhbC4KKysgICAgICAgICAgICAjIEF0dHJpYnV0 ZS1sZXZlbCBjb25maWRlbnRpYWxpdHkgKGUuZy4gdGhlIGFkbWluLW9ubHkgS2VyYmVyb3MKKysg ICAgICAgICAgICAjIGxvZ2luIGF0dHJpYnV0ZXMpIHN0YXlzIGVuZm9yY2VkIGJ5IDM4OS1kcyBv biB0aGUgcmVhZCB0aGF0CisrICAgICAgICAgICAgIyBmb2xsb3dzLiAgVGhlIHByb2JlIGFsd2F5 cyByZXF1ZXN0cyAnKicgKHNlZQorKyAgICAgICAgICAgICMgX3Byb2JlX2VmZmVjdGl2ZV9yaWdo dHMpLCBzbyBhdHRyX3JpZ2h0cyByZWZsZWN0cyBldmVyeSBhdHRyaWJ1dGUuCisrICAgICAgICAg ICAgaWYgJ3YnIGluIGVudHJ5X3JpZ2h0czoKKyAgICAgICAgICAgICAgICAgcmV0dXJuIFRydWUK Ky0gICAgICAgICAgICByZXR1cm4gYW55KCdyJyBpbiBhdHRyX3JpZ2h0cy5nZXQoYSwgJycpIGZv ciBhIGluIGF0dHJzKQorKyAgICAgICAgICAgIHJldHVybiBhbnkoJ3InIGluIHIgZm9yIHIgaW4g YXR0cl9yaWdodHMudmFsdWVzKCkpCisgCisgICAgICAgICBtb2RpZmllZF9hdHRycyA9IE5vbmUg ICMgY29tcHV0ZWQgbGF6aWx5LCBvbmx5IGZvciAnd3JpdGUnCisgICAgICAgICBmb3IgbSBpbiBt cC5rZXlzKCk6CitAQCAtMTIxNCw4ICsxMjI1LDE0IEBAIGxhc3QsIGFmdGVyIGFsbCBzZXRzIGFu ZCBhZGRzLiIiIiksCisgICAgICAgICAgICAgICAgIGNvbnRpbnVlCisgICAgICAgICAgICAgbmVl ZGVkLnVwZGF0ZShhLmxvd2VyKCkgZm9yIGEgaW4gcGVybS5nZXQoJ2lwYXBlcm1kZWZhdWx0YXR0 cicsICgpKSkKKyAKKysgICAgICAgICMgQWx3YXlzIGluY2x1ZGUgJyonIHNvIHRoZSBlZmZlY3Rp dmUgcmlnaHRzIGNvdmVyIGV2ZXJ5IGF0dHJpYnV0ZSBvZgorKyAgICAgICAgIyB0aGUgZW50cnks IG5vdCBvbmx5IHRoZSBnYXRlZCBvbmVzLiAgVGhlIHJlYWQvc2VhcmNoL2NvbXBhcmUgY2hlY2sK KysgICAgICAgICMgbmVlZHMgdG8ga25vdyB3aGV0aGVyIHRoZSBjYWxsZXIgY2FuIHJlYWQgKmFu eSogYXR0cmlidXRlIChhbgorKyAgICAgICAgIyB1bnByaXZpbGVnZWQgY2FsbGVyIG1heSByZWFk IGl0cyBvd24gZW50cnkgd2l0aG91dCBob2xkaW5nIHRoZQorKyAgICAgICAgIyBvYmplY3QncyBy ZWFkIHByaXZpbGVnZSksIHdoaWNoIGNhbm5vdCBiZSBhbnN3ZXJlZCBmcm9tIHRoZSBnYXRlZAor KyAgICAgICAgIyBhdHRyaWJ1dGVzIGFsb25lLgorICAgICAgICAgdHJ5OgorLSAgICAgICAgICAg IHJpZ2h0cyA9IGxkYXAuZ2V0X2VmZmVjdGl2ZV9yaWdodHMoZG4sIHNvcnRlZChuZWVkZWQpIG9y IFsnKiddKQorKyAgICAgICAgICAgIHJpZ2h0cyA9IGxkYXAuZ2V0X2VmZmVjdGl2ZV9yaWdodHMo ZG4sIHNvcnRlZChuZWVkZWQgfCB7JyonfSkpCisgICAgICAgICBleGNlcHQgZXJyb3JzLk5vdEZv dW5kOgorICAgICAgICAgICAgIHJldHVybiBOb25lCisgCitkaWZmIC0tZ2l0IGEvaXBhc2VydmVy L3BsdWdpbnMvcHJpdmlsZWdlLnB5IGIvaXBhc2VydmVyL3BsdWdpbnMvcHJpdmlsZWdlLnB5Citp bmRleCA0N2YyN2YxMmMuLjY1MTk5YWRjMCAxMDA2NDQKKy0tLSBhL2lwYXNlcnZlci9wbHVnaW5z L3ByaXZpbGVnZS5weQorKysrIGIvaXBhc2VydmVyL3BsdWdpbnMvcHJpdmlsZWdlLnB5CitAQCAt OTIsMTEgKzkyLDI4IEBAIGRlZiBwcmluY2lwYWxfaGFzX3ByaXZpbGVnZShhcGksIHByaW5jaXBh bCwgcHJpdmlsZWdlKToKKyAgICAgcHJpdmlsZWdlX2RuID0gYXBpLk9iamVjdC5wcml2aWxlZ2Uu Z2V0X2RuKHByaXZpbGVnZSkKKyAgICAgbGRhcCA9IGFwaS5CYWNrZW5kLmxkYXAyCisgICAgIGlm IHByaW5jaXBhbCBpcyBOb25lOgorLSAgICAgICAgZG5fb3JfcHJpbmMgPSBETihsZGFwLmNvbm4u d2hvYW1pX3MoKVs0Ol0pCistICAgICAgICBpZiBkbl9vcl9wcmluYyA9PSBETignY249RGlyZWN0 b3J5IE1hbmFnZXInKToKKysgICAgICAgICMgd2hvYW1pIHJlcG9ydHMgdGhlIGJvdW5kIGlkZW50 aXR5IGFzIGFuIGVudHJ5IEROLCBub3QgYSBLZXJiZXJvcworKyAgICAgICAgIyBwcmluY2lwYWwg bmFtZS4gQ2hlY2sgaXRzIHByaXZpbGVnZSBtZW1iZXJzaGlwIGRpcmVjdGx5IGJ5IEROOiBhCisr ICAgICAgICAjICdrcmJwcmluY2lwYWxuYW1lPTxETj4nIGZpbHRlciBjYW4gbmV2ZXIgbWF0Y2gg YW5kIHdvdWxkIGFsd2F5cworKyAgICAgICAgIyAod3JvbmdseSkgcmVwb3J0IHRoZSBjYWxsZXIg YXMgbGFja2luZyB0aGUgcHJpdmlsZWdlLgorKyAgICAgICAgYm91bmRfZG4gPSBETihsZGFwLmNv bm4ud2hvYW1pX3MoKVs0Ol0pCisrICAgICAgICBpZiBib3VuZF9kbiA9PSBETignY249RGlyZWN0 b3J5IE1hbmFnZXInKToKKyAgICAgICAgICAgICByZXR1cm4gVHJ1ZQorLSAgICBlbHNlOgorLSAg ICAgICAgZG5fb3JfcHJpbmMgPSBwcmluY2lwYWwKKysgICAgICAgIGZpbHRlciA9IGxkYXAubWFr ZV9maWx0ZXIoCisrICAgICAgICAgICAgeydtZW1iZXJvZic6IHByaXZpbGVnZV9kbn0sIHJ1bGVz PWxkYXAuTUFUQ0hfQUxMKQorKyAgICAgICAgdHJ5OgorKyAgICAgICAgICAgIGxkYXAuZmluZF9l bnRyaWVzKGJhc2VfZG49Ym91bmRfZG4sIHNjb3BlPWxkYXAuU0NPUEVfQkFTRSwKKysgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBmaWx0ZXI9ZmlsdGVyKQorKyAgICAgICAgICAgIHJldHVy biBUcnVlCisrICAgICAgICBleGNlcHQgZXJyb3JzLkV4ZWN1dGlvbkVycm9yOgorKyAgICAgICAg ICAgICMgTm90Rm91bmQgaXMgdGhlIG5vcm1hbCBuZWdhdGl2ZSByZXN1bHQgKG5vdCBhIG1lbWJl ciwgb3IgdGhlCisrICAgICAgICAgICAgIyBib3VuZCBlbnRyeSBkb2VzIG5vdCBleGlzdCkuIEFu eSBvdGhlciBleGVjdXRpb24gZXJyb3IgKGRhdGFiYXNlCisrICAgICAgICAgICAgIyBlcnJvciwg bGltaXRzLCAuLi4pIGNhbm5vdCBwb3NpdGl2ZWx5IGNvbmZpcm0gdGhlIHByaXZpbGVnZQorKyAg ICAgICAgICAgICMgZWl0aGVyLCBhbmQgdGhlcmUgaXMgbm8gS2VyYmVyb3MgcHJpbmNpcGFsIHRv IGZhbGwgYmFjayBvbiBmb3IKKysgICAgICAgICAgICAjIHRoZSBJRCBvdmVycmlkZSBjaGVjayBi ZWxvdywgc28gZmFpbCBjbG9zZWQ6IG5vdCBwcml2aWxlZ2VkLgorKyAgICAgICAgICAgIHJldHVy biBGYWxzZQorKworKyAgICBkbl9vcl9wcmluYyA9IHByaW5jaXBhbAorIAorICAgICAjIEZpcnN0 IHRyeTogQ2hlY2sgaWYgdGhlcmUgaXMgYSBwcmluY2lwYWwgdGhhdCBoYXMgdGhlIG5lZWRlZAor ICAgICAjIHByaXZpbGVnZS4KK0BAIC0xMTAsMTAgKzEyNyw2IEBAIGRlZiBwcmluY2lwYWxfaGFz X3ByaXZpbGVnZShhcGksIHByaW5jaXBhbCwgcHJpdmlsZWdlKToKKyAgICAgZXhjZXB0IGVycm9y cy5Ob3RGb3VuZDoKKyAgICAgICAgIHBhc3MKKyAKKy0gICAgIyBEbyBub3QgcnVuIElEIG92ZXJy aWRlIGNoZWNrIGZvciB0aGUgdXNlciB0aGF0IGhhcyBubyBLZXJiZXJvcyBwcmluY2lwYWwKKy0g ICAgaWYgcHJpbmNpcGFsIGlzIE5vbmU6CistICAgICAgICByZXR1cm4gRmFsc2UKKy0KKyAgICAg IyBTZWNvbmQgdHJ5OiBDaGVjayBpZiB0aGVyZSBpcyBhbiBpZG92ZXJyaWRlIGZvciB0aGUgcHJp bmNpcGFsIGFzCisgICAgICMgaXBhT3JpZ2luYWxVaWQgdGhhdCBoYXMgdGhlIG5lZWRlZCBwcml2 aWxlZ2UuCisgICAgIGZpbHRlciA9IGxkYXAubWFrZV9maWx0ZXIoCistLSAKKzIuNTUuMAorCgpk aWZmIC0tZ2l0IGEvZnJlZWlwYS5zcGVjIGIvZnJlZWlwYS5zcGVjCmluZGV4IGMwZTllODkuLjk4 ZjllN2IgMTAwNjQ0Ci0tLSBhL2ZyZWVpcGEuc3BlYworKysgYi9mcmVlaXBhLnNwZWMKQEAgLTIx MSw3ICsyMTEsNyBAQAogCiBOYW1lOiAgICAgICAgICAgJXtwYWNrYWdlX25hbWV9CiBWZXJzaW9u OiAgICAgICAgJXtJUEFfVkVSU0lPTn0KLVJlbGVhc2U6ICAgICAgICAxLjElez9yY192ZXJzaW9u Oi4lcmNfdmVyc2lvbn0lez9kaXN0fQorUmVsZWFzZTogICAgICAgIDEuMiV7P3JjX3ZlcnNpb246 LiVyY192ZXJzaW9ufSV7P2Rpc3R9CiBTdW1tYXJ5OiAgICAgICAgVGhlIElkZW50aXR5LCBQb2xp Y3kgYW5kIEF1ZGl0IHN5c3RlbQogCiBMaWNlbnNlOiAgICAgICAgR1BMLTMuMC1vci1sYXRlcgpA QCAtMjM2LDYgKzIzNiw3IEBAIFNvdXJjZTI6ICAgICAgICBncGdrZXktQjQwQTc4RkJBNTc2QzRB M0ZDN0Q3QkJDMzU5RkFGNzc3Mjk2RjY1My5hc2MKIAogUGF0Y2gwOiAgICAgICAgIGZyZWVpcGEt dmVyc2lvbi11cGdyYWRlLWZlZG9yYS1vbmx5LnBhdGNoCiBQYXRjaDE6ICAgICAgICAgZnJlZWlw YS1wci04NTU3LnBhdGNoCitQYXRjaDI6ICAgICAgICAgZnJlZWlwYS1wci04NTU4LnBhdGNoCiAK ICMgUkhFTCBzcGVjIGZpbGUgb25seTogU1RBUlQ6IENoYW5nZSBicmFuZGluZyB0byBJUEEgYW5k IElkZW50aXR5IE1hbmFnZW1lbnQKICMgTW92ZWQgYnJhbmRpbmcgbG9nb3MgYW5kIGJhY2tncm91 bmQgdG8gcmVkaGF0LWxvZ29zLWlwYS04MC40OgpAQCAtMTk3Myw2ICsxOTc0LDkgQEAgZmkKICVl bmRpZgogCiAlY2hhbmdlbG9nCisqIE1vbiBTZXAgMDcgMjAyNiBBbGV4YW5kZXIgQm9rb3ZveSA8 YWJva292b3lAcmVkaGF0LmNvbT4gLSA0LjEzLjQtMS4yCistIEZpbmUtdHVuZSBwcml2aWxlZ2Ug Y2hlY2tzICh1cHN0cmVhbSBQUiA4NTU4KQorCiAqIE1vbiBTZXAgMDcgMjAyNiBBbGV4YW5kZXIg Qm9rb3ZveSA8YWJva292b3lAcmVkaGF0LmNvbT4gLSA0LjEzLjQtMS4xCiAtIEZpeCBjcm9zcy1m b3Jlc3QgdHJ1c3QgaWRlbnRpdHkgY29uZnVzaW9uIHByb3RlY3Rpb24gKHVwc3RyZWFtIFBSIDg1 NTcpCiAK