From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Alexander Bokovoy To: git-commits@fedoraproject.org Subject: [rpms/freeipa] f43: Fine-tune permissions checks Date: Mon, 07 Sep 2026 13:21:57 GMT Message-ID: <178878731774.1.2213439408211175163.rpms-freeipa-9909e601b5d1@fedoraproject.org> List-ID: X-Git-Repo: rpms/freeipa X-Git-Branch: f43 X-Git-Rev: 9909e601b5d1371452dd91d9002b5ba945c7c6ee ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvZnJlZWlwYQogICAgICAgICAgICBCcmFuY2ggOiBmNDMKICAgICAgICAgICAg Q29tbWl0IDogOTkwOWU2MDFiNWQxMzcxNDUyZGQ5MWQ5MDAyYjViYTk0NWM3YzZlZQogICAgICAg ICAgICBBdXRob3IgOiBBbGV4YW5kZXIgQm9rb3ZveSA8YWJva292b3lAcmVkaGF0LmNvbT4KICAg ICAgICAgICAgRGF0ZSAgIDogMjAyNi0wOS0wN1QxNjoyMTo0OCswMzowMAogICAgICAgICAgICBT dGF0cyAgOiArMTIzLy0xIGluIDIgZmlsZShzKQogICAgICAgICAgICBVUkwgICAgOiBodHRwczov L3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL2ZyZWVpcGEvYy85OTA5ZTYwMWI1ZDEzNzE0NTJk ZDkxZDkwMDJiNWJhOTQ1YzdjNmVlP2JyYW5jaD1mNDMKCiAgICAgICAgICAgIExvZzoKICAgICAg ICAgICAgRmluZS10dW5lIHBlcm1pc3Npb25zIGNoZWNrcwoKVXBzdHJlYW0gUFIjODU1ODogaHR0 cHM6Ly9naXRodWIuY29tL2ZyZWVpcGEvZnJlZWlwYS9wdWxsLzg1NTgKClNpZ25lZC1vZmYtYnk6 IEFsZXhhbmRlciBCb2tvdm95IDxhYm9rb3ZveUByZWRoYXQuY29tPgoKLS0tCmRpZmYgLS1naXQg YS9mcmVlaXBhLXByLTg1NTgucGF0Y2ggYi9mcmVlaXBhLXByLTg1NTgucGF0Y2gKbmV3IGZpbGUg bW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uYTlhYTQ5NAotLS0gL2Rldi9udWxsCisrKyBiL2Zy ZWVpcGEtcHItODU1OC5wYXRjaApAQCAtMCwwICsxLDExOCBAQAorRnJvbSAzYzM3YjVhYjliZGIw ZDE3ODgxODBiNTg2YjVmODE0NTM1ZDg5MmNmIE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQorRnJv bTogQWxleGFuZGVyIEJva292b3kgPGFib2tvdm95QHJlZGhhdC5jb20+CitEYXRlOiBNb24sIDcg U2VwIDIwMjYgMTY6MTI6MzMgKzAzMDAKK1N1YmplY3Q6IFtQQVRDSF0gQWxsb3cgZmluZSB0dW5l ZCBwcml2aWxlZ2UgY2hlY2sKKworTGV0IHVzZXJzIHBhc3MgdGhyb3VnaCB0aGUgcHJpdmlsZWdl IGNoZWNrIGlmIGVpdGhlcgorLSB3aG9sZSBlbnRyeSByZWFkIGdyYW50ZWQgKCd2JyBpbiB0aGUg R0VSIHJlc3BvbnNlKQorLSBhdCBsZWFzdCBvbmUgYXR0cmlidXRlIHJlYWQgZ3JhbnRlZAorCitU aGlzIGlzIGVub3VnaCB0byBhbGxvdyBMREFQUmV0cmlldmUgdG8gcGFzcywgYmVjYXVzZSB0aGUg cmVzdCBpcworY29udHJvbGxlZCBieSB0aGUgZXhwbGljaXQgQUNJcyBpbiBMREFQLgorCitSZWxh dGVkOiBDVkUtMjAyNi03OTY3OAorCitTaWduZWQtb2ZmLWJ5OiBBbGV4YW5kZXIgQm9rb3ZveSA8 YWJva292b3lAcmVkaGF0LmNvbT4KKy0tLQorIGlwYXNlcnZlci9wbHVnaW5zL2Jhc2VsZGFwLnB5 ICB8IDI3ICsrKysrKysrKysrKysrKysrKysrKystLS0tLQorIGlwYXNlcnZlci9wbHVnaW5zL3By aXZpbGVnZS5weSB8IDI5ICsrKysrKysrKysrKysrKysrKysrKy0tLS0tLS0tCisgMiBmaWxlcyBj aGFuZ2VkLCA0MyBpbnNlcnRpb25zKCspLCAxMyBkZWxldGlvbnMoLSkKKworZGlmZiAtLWdpdCBh L2lwYXNlcnZlci9wbHVnaW5zL2Jhc2VsZGFwLnB5IGIvaXBhc2VydmVyL3BsdWdpbnMvYmFzZWxk YXAucHkKK2luZGV4IGQ2OTNjNzExMi4uZTc1MWRjNjczIDEwMDY0NAorLS0tIGEvaXBhc2VydmVy L3BsdWdpbnMvYmFzZWxkYXAucHkKKysrKyBiL2lwYXNlcnZlci9wbHVnaW5zL2Jhc2VsZGFwLnB5 CitAQCAtMTA1NCwxMSArMTA1NCwyMiBAQCBsYXN0LCBhZnRlciBhbGwgc2V0cyBhbmQgYWRkcy4i IiIpLAorICAgICAgICAgICAgICAgICBpZiBub3QgYXR0cnM6CisgICAgICAgICAgICAgICAgICAg ICByZXR1cm4gVHJ1ZQorICAgICAgICAgICAgICAgICByZXR1cm4gYW55KCd3JyBpbiBhdHRyX3Jp Z2h0cy5nZXQoYSwgJycpIGZvciBhIGluIGF0dHJzKQorLSAgICAgICAgICAgICMgcmVhZCAvIHNl YXJjaCAvIGNvbXBhcmUKKy0gICAgICAgICAgICBhdHRycyA9IHthLmxvd2VyKCkgZm9yIGEgaW4g cGVybS5nZXQoJ2lwYXBlcm1kZWZhdWx0YXR0cicsICgpKX0KKy0gICAgICAgICAgICBpZiBub3Qg YXR0cnM6CisrICAgICAgICAgICAgIyByZWFkIC8gc2VhcmNoIC8gY29tcGFyZTogYSByZWFkIGlz IG5ldmVyIGRlbmllZCB3aG9sZXNhbGUgYnkKKysgICAgICAgICAgICAjIDM4OS1kcyAtLSBpdCBy ZXR1cm5zIHRoZSBlbnRyeSBhbmQgc2lsZW50bHkgZmlsdGVycyBvdXQgdGhlCisrICAgICAgICAg ICAgIyBpbmRpdmlkdWFsIGF0dHJpYnV0ZXMgdGhlIGNhbGxlciBtYXkgbm90IHNlZS4gIFBlcm1p dCB0aGUKKysgICAgICAgICAgICAjIG9wZXJhdGlvbiB3aGVuZXZlciB0aGUgY2FsbGVyIGNhbiB2 aWV3IHRoZSBlbnRyeSAoZW50cnktbGV2ZWwKKysgICAgICAgICAgICAjICd2Jykgb3IgcmVhZCAq YW55KiBvZiBpdHMgYXR0cmlidXRlcy4gIElQQSdzIHJlYWQgQUNJcyBhcmUKKysgICAgICAgICAg ICAjIGF0dHJpYnV0ZS1zY29wZWQsIHNvIGFuIHVucHJpdmlsZWdlZCBjYWxsZXIgcmVhZGluZyBp dHMgb3duIGVudHJ5CisrICAgICAgICAgICAgIyBnZXRzICdlbnRyeUxldmVsUmlnaHRzOiBub25l JyB5ZXQgY2FuIHN0aWxsIHJlYWQgY24vc24vbWFpbC8uLi47CisrICAgICAgICAgICAgIyByZXF1 aXJpbmcgcmVhZCBvbiB0aGlzIHBlcm1pc3Npb24ncyBzcGVjaWZpYyBhdHRyaWJ1dGVzIHdvdWxk CisrICAgICAgICAgICAgIyB3cm9uZ2x5IHR1cm4gc3VjaCBhIGxlZ2l0aW1hdGUgcGFydGlhbCBy ZWFkIGludG8gYSB0b3RhbCBkZW5pYWwuCisrICAgICAgICAgICAgIyBBdHRyaWJ1dGUtbGV2ZWwg Y29uZmlkZW50aWFsaXR5IChlLmcuIHRoZSBhZG1pbi1vbmx5IEtlcmJlcm9zCisrICAgICAgICAg ICAgIyBsb2dpbiBhdHRyaWJ1dGVzKSBzdGF5cyBlbmZvcmNlZCBieSAzODktZHMgb24gdGhlIHJl YWQgdGhhdAorKyAgICAgICAgICAgICMgZm9sbG93cy4gIFRoZSBwcm9iZSBhbHdheXMgcmVxdWVz dHMgJyonIChzZWUKKysgICAgICAgICAgICAjIF9wcm9iZV9lZmZlY3RpdmVfcmlnaHRzKSwgc28g YXR0cl9yaWdodHMgcmVmbGVjdHMgZXZlcnkgYXR0cmlidXRlLgorKyAgICAgICAgICAgIGlmICd2 JyBpbiBlbnRyeV9yaWdodHM6CisgICAgICAgICAgICAgICAgIHJldHVybiBUcnVlCistICAgICAg ICAgICAgcmV0dXJuIGFueSgncicgaW4gYXR0cl9yaWdodHMuZ2V0KGEsICcnKSBmb3IgYSBpbiBh dHRycykKKysgICAgICAgICAgICByZXR1cm4gYW55KCdyJyBpbiByIGZvciByIGluIGF0dHJfcmln aHRzLnZhbHVlcygpKQorIAorICAgICAgICAgbW9kaWZpZWRfYXR0cnMgPSBOb25lICAjIGNvbXB1 dGVkIGxhemlseSwgb25seSBmb3IgJ3dyaXRlJworICAgICAgICAgZm9yIG0gaW4gbXAua2V5cygp OgorQEAgLTEyMTQsOCArMTIyNSwxNCBAQCBsYXN0LCBhZnRlciBhbGwgc2V0cyBhbmQgYWRkcy4i IiIpLAorICAgICAgICAgICAgICAgICBjb250aW51ZQorICAgICAgICAgICAgIG5lZWRlZC51cGRh dGUoYS5sb3dlcigpIGZvciBhIGluIHBlcm0uZ2V0KCdpcGFwZXJtZGVmYXVsdGF0dHInLCAoKSkp CisgCisrICAgICAgICAjIEFsd2F5cyBpbmNsdWRlICcqJyBzbyB0aGUgZWZmZWN0aXZlIHJpZ2h0 cyBjb3ZlciBldmVyeSBhdHRyaWJ1dGUgb2YKKysgICAgICAgICMgdGhlIGVudHJ5LCBub3Qgb25s eSB0aGUgZ2F0ZWQgb25lcy4gIFRoZSByZWFkL3NlYXJjaC9jb21wYXJlIGNoZWNrCisrICAgICAg ICAjIG5lZWRzIHRvIGtub3cgd2hldGhlciB0aGUgY2FsbGVyIGNhbiByZWFkICphbnkqIGF0dHJp YnV0ZSAoYW4KKysgICAgICAgICMgdW5wcml2aWxlZ2VkIGNhbGxlciBtYXkgcmVhZCBpdHMgb3du IGVudHJ5IHdpdGhvdXQgaG9sZGluZyB0aGUKKysgICAgICAgICMgb2JqZWN0J3MgcmVhZCBwcml2 aWxlZ2UpLCB3aGljaCBjYW5ub3QgYmUgYW5zd2VyZWQgZnJvbSB0aGUgZ2F0ZWQKKysgICAgICAg ICMgYXR0cmlidXRlcyBhbG9uZS4KKyAgICAgICAgIHRyeToKKy0gICAgICAgICAgICByaWdodHMg PSBsZGFwLmdldF9lZmZlY3RpdmVfcmlnaHRzKGRuLCBzb3J0ZWQobmVlZGVkKSBvciBbJyonXSkK KysgICAgICAgICAgICByaWdodHMgPSBsZGFwLmdldF9lZmZlY3RpdmVfcmlnaHRzKGRuLCBzb3J0 ZWQobmVlZGVkIHwgeycqJ30pKQorICAgICAgICAgZXhjZXB0IGVycm9ycy5Ob3RGb3VuZDoKKyAg ICAgICAgICAgICByZXR1cm4gTm9uZQorIAorZGlmZiAtLWdpdCBhL2lwYXNlcnZlci9wbHVnaW5z L3ByaXZpbGVnZS5weSBiL2lwYXNlcnZlci9wbHVnaW5zL3ByaXZpbGVnZS5weQoraW5kZXggNDdm MjdmMTJjLi42NTE5OWFkYzAgMTAwNjQ0CistLS0gYS9pcGFzZXJ2ZXIvcGx1Z2lucy9wcml2aWxl Z2UucHkKKysrKyBiL2lwYXNlcnZlci9wbHVnaW5zL3ByaXZpbGVnZS5weQorQEAgLTkyLDExICs5 MiwyOCBAQCBkZWYgcHJpbmNpcGFsX2hhc19wcml2aWxlZ2UoYXBpLCBwcmluY2lwYWwsIHByaXZp bGVnZSk6CisgICAgIHByaXZpbGVnZV9kbiA9IGFwaS5PYmplY3QucHJpdmlsZWdlLmdldF9kbihw cml2aWxlZ2UpCisgICAgIGxkYXAgPSBhcGkuQmFja2VuZC5sZGFwMgorICAgICBpZiBwcmluY2lw YWwgaXMgTm9uZToKKy0gICAgICAgIGRuX29yX3ByaW5jID0gRE4obGRhcC5jb25uLndob2FtaV9z KClbNDpdKQorLSAgICAgICAgaWYgZG5fb3JfcHJpbmMgPT0gRE4oJ2NuPURpcmVjdG9yeSBNYW5h Z2VyJyk6CisrICAgICAgICAjIHdob2FtaSByZXBvcnRzIHRoZSBib3VuZCBpZGVudGl0eSBhcyBh biBlbnRyeSBETiwgbm90IGEgS2VyYmVyb3MKKysgICAgICAgICMgcHJpbmNpcGFsIG5hbWUuIENo ZWNrIGl0cyBwcml2aWxlZ2UgbWVtYmVyc2hpcCBkaXJlY3RseSBieSBETjogYQorKyAgICAgICAg IyAna3JicHJpbmNpcGFsbmFtZT08RE4+JyBmaWx0ZXIgY2FuIG5ldmVyIG1hdGNoIGFuZCB3b3Vs ZCBhbHdheXMKKysgICAgICAgICMgKHdyb25nbHkpIHJlcG9ydCB0aGUgY2FsbGVyIGFzIGxhY2tp bmcgdGhlIHByaXZpbGVnZS4KKysgICAgICAgIGJvdW5kX2RuID0gRE4obGRhcC5jb25uLndob2Ft aV9zKClbNDpdKQorKyAgICAgICAgaWYgYm91bmRfZG4gPT0gRE4oJ2NuPURpcmVjdG9yeSBNYW5h Z2VyJyk6CisgICAgICAgICAgICAgcmV0dXJuIFRydWUKKy0gICAgZWxzZToKKy0gICAgICAgIGRu X29yX3ByaW5jID0gcHJpbmNpcGFsCisrICAgICAgICBmaWx0ZXIgPSBsZGFwLm1ha2VfZmlsdGVy KAorKyAgICAgICAgICAgIHsnbWVtYmVyb2YnOiBwcml2aWxlZ2VfZG59LCBydWxlcz1sZGFwLk1B VENIX0FMTCkKKysgICAgICAgIHRyeToKKysgICAgICAgICAgICBsZGFwLmZpbmRfZW50cmllcyhi YXNlX2RuPWJvdW5kX2RuLCBzY29wZT1sZGFwLlNDT1BFX0JBU0UsCisrICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgZmlsdGVyPWZpbHRlcikKKysgICAgICAgICAgICByZXR1cm4gVHJ1ZQor KyAgICAgICAgZXhjZXB0IGVycm9ycy5FeGVjdXRpb25FcnJvcjoKKysgICAgICAgICAgICAjIE5v dEZvdW5kIGlzIHRoZSBub3JtYWwgbmVnYXRpdmUgcmVzdWx0IChub3QgYSBtZW1iZXIsIG9yIHRo ZQorKyAgICAgICAgICAgICMgYm91bmQgZW50cnkgZG9lcyBub3QgZXhpc3QpLiBBbnkgb3RoZXIg ZXhlY3V0aW9uIGVycm9yIChkYXRhYmFzZQorKyAgICAgICAgICAgICMgZXJyb3IsIGxpbWl0cywg Li4uKSBjYW5ub3QgcG9zaXRpdmVseSBjb25maXJtIHRoZSBwcml2aWxlZ2UKKysgICAgICAgICAg ICAjIGVpdGhlciwgYW5kIHRoZXJlIGlzIG5vIEtlcmJlcm9zIHByaW5jaXBhbCB0byBmYWxsIGJh Y2sgb24gZm9yCisrICAgICAgICAgICAgIyB0aGUgSUQgb3ZlcnJpZGUgY2hlY2sgYmVsb3csIHNv IGZhaWwgY2xvc2VkOiBub3QgcHJpdmlsZWdlZC4KKysgICAgICAgICAgICByZXR1cm4gRmFsc2UK KysKKysgICAgZG5fb3JfcHJpbmMgPSBwcmluY2lwYWwKKyAKKyAgICAgIyBGaXJzdCB0cnk6IENo ZWNrIGlmIHRoZXJlIGlzIGEgcHJpbmNpcGFsIHRoYXQgaGFzIHRoZSBuZWVkZWQKKyAgICAgIyBw cml2aWxlZ2UuCitAQCAtMTEwLDEwICsxMjcsNiBAQCBkZWYgcHJpbmNpcGFsX2hhc19wcml2aWxl Z2UoYXBpLCBwcmluY2lwYWwsIHByaXZpbGVnZSk6CisgICAgIGV4Y2VwdCBlcnJvcnMuTm90Rm91 bmQ6CisgICAgICAgICBwYXNzCisgCistICAgICMgRG8gbm90IHJ1biBJRCBvdmVycmlkZSBjaGVj ayBmb3IgdGhlIHVzZXIgdGhhdCBoYXMgbm8gS2VyYmVyb3MgcHJpbmNpcGFsCistICAgIGlmIHBy aW5jaXBhbCBpcyBOb25lOgorLSAgICAgICAgcmV0dXJuIEZhbHNlCistCisgICAgICMgU2Vjb25k IHRyeTogQ2hlY2sgaWYgdGhlcmUgaXMgYW4gaWRvdmVycmlkZSBmb3IgdGhlIHByaW5jaXBhbCBh cworICAgICAjIGlwYU9yaWdpbmFsVWlkIHRoYXQgaGFzIHRoZSBuZWVkZWQgcHJpdmlsZWdlLgor ICAgICBmaWx0ZXIgPSBsZGFwLm1ha2VfZmlsdGVyKAorLS0gCisyLjU1LjAKKwoKZGlmZiAtLWdp dCBhL2ZyZWVpcGEuc3BlYyBiL2ZyZWVpcGEuc3BlYwppbmRleCBiZTY4NmQ0Li40Mjg4ZDllIDEw MDY0NAotLS0gYS9mcmVlaXBhLnNwZWMKKysrIGIvZnJlZWlwYS5zcGVjCkBAIC0yMTEsNyArMjEx LDcgQEAKIAogTmFtZTogICAgICAgICAgICV7cGFja2FnZV9uYW1lfQogVmVyc2lvbjogICAgICAg ICV7SVBBX1ZFUlNJT059Ci1SZWxlYXNlOiAgICAgICAgMS4xJXs/cmNfdmVyc2lvbjouJXJjX3Zl cnNpb259JXs/ZGlzdH0KK1JlbGVhc2U6ICAgICAgICAxLjIlez9yY192ZXJzaW9uOi4lcmNfdmVy c2lvbn0lez9kaXN0fQogU3VtbWFyeTogICAgICAgIFRoZSBJZGVudGl0eSwgUG9saWN5IGFuZCBB dWRpdCBzeXN0ZW0KIAogTGljZW5zZTogICAgICAgIEdQTC0zLjAtb3ItbGF0ZXIKQEAgLTIzNiw2 ICsyMzYsNyBAQCBTb3VyY2UyOiAgICAgICAgZ3Bna2V5LUI0MEE3OEZCQTU3NkM0QTNGQzdEN0JC QzM1OUZBRjc3NzI5NkY2NTMuYXNjCiAKIFBhdGNoMDogICAgICAgICBmcmVlaXBhLXZlcnNpb24t dXBncmFkZS1mZWRvcmEtb25seS5wYXRjaAogUGF0Y2gxOiAgICAgICAgIGZyZWVpcGEtcHItODU1 Ny5wYXRjaAorUGF0Y2gyOiAgICAgICAgIGZyZWVpcGEtcHItODU1OC5wYXRjaAogCiAjIFJIRUwg c3BlYyBmaWxlIG9ubHk6IFNUQVJUOiBDaGFuZ2UgYnJhbmRpbmcgdG8gSVBBIGFuZCBJZGVudGl0 eSBNYW5hZ2VtZW50CiAjIE1vdmVkIGJyYW5kaW5nIGxvZ29zIGFuZCBiYWNrZ3JvdW5kIHRvIHJl ZGhhdC1sb2dvcy1pcGEtODAuNDoKQEAgLTE5NzUsNiArMTk3Niw5IEBAIGZpCiAlZW5kaWYKIAog JWNoYW5nZWxvZworKiBNb24gU2VwIDA3IDIwMjYgQWxleGFuZGVyIEJva292b3kgPGFib2tvdm95 QHJlZGhhdC5jb20+IC0gNC4xMy40LTEuMgorLSBGaW5lLXR1bmUgcHJpdmlsZWdlIGNoZWNrcyAo dXBzdHJlYW0gUFIgODU1OCkKKwogKiBNb24gU2VwIDA3IDIwMjYgQWxleGFuZGVyIEJva292b3kg PGFib2tvdm95QHJlZGhhdC5jb20+IC0gNC4xMy40LTEuMQogLSBGaXggY3Jvc3MtZm9yZXN0IHRy dXN0IGlkZW50aXR5IGNvbmZ1c2lvbiBwcm90ZWN0aW9uICh1cHN0cmVhbSBQUiA4NTU3KQogCg==