From 0cf737065b0024590e5e7be4e57855585b01bda7 Mon Sep 17 00:00:00 2001 From: Timo Aaltonen Date: Wed, 25 Jun 2025 12:25:33 +0300 Subject: [PATCH] patches: Map nobody group to nogroup on Debian. (Closes: #1012592) --- debian/changelog | 1 + ...ody-group-configurable-and-use-nogro.patch | 60 +++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 62 insertions(+) create mode 100644 debian/patches/Make-name-of-nobody-group-configurable-and-use-nogro.patch diff --git a/debian/changelog b/debian/changelog index 331c7fe46..ad233f6e8 100644 --- a/debian/changelog +++ b/debian/changelog @@ -2,6 +2,7 @@ freeipa (4.12.2-4) UNRELEASED; urgency=medium * control: Demote libnss-myhostname to Suggests. (ref. #1006829) * patches: Fix samba lock directory location. (Closes: #1012593) + * patches: Map nobody group to nogroup on Debian. (Closes: #1012592) -- Timo Aaltonen Wed, 05 Feb 2025 08:22:41 +0200 diff --git a/debian/patches/Make-name-of-nobody-group-configurable-and-use-nogro.patch b/debian/patches/Make-name-of-nobody-group-configurable-and-use-nogro.patch new file mode 100644 index 000000000..8c4a3bb6d --- /dev/null +++ b/debian/patches/Make-name-of-nobody-group-configurable-and-use-nogro.patch @@ -0,0 +1,60 @@ +From 8a9c5629214cd71e88a5ac9c1b639faad9fc4ec1 Mon Sep 17 00:00:00 2001 +From: Frederik Himpe +Date: Tue, 25 Feb 2025 13:49:23 +0100 +Subject: [PATCH] Make name of nobody group configurable and use nogroup on + Debian + +Fixes: https://pagure.io/freeipa/issue/9753 + +Signed-off-by: Frederik Himpe +Reviewed-By: Alexander Bokovoy +--- + ipaplatform/base/constants.py | 1 + + ipaplatform/debian/constants.py | 1 + + ipaserver/install/adtrustinstance.py | 6 ++++-- + 3 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/ipaplatform/base/constants.py b/ipaplatform/base/constants.py +index f1ef7efff..4c8038a84 100644 +--- a/ipaplatform/base/constants.py ++++ b/ipaplatform/base/constants.py +@@ -124,6 +124,7 @@ class BaseConstantsNamespace: + NAMED_OPTIONS_VAR = "OPTIONS" + NAMED_OPENSSL_ENGINE = None + NAMED_ZONE_COMMENT = "" ++ NOBODY_GROUP = Group("nobody") + PKI_USER = User("pkiuser") + PKI_GROUP = Group("pkiuser") + # ntpd init variable used for daemon options +diff --git a/ipaplatform/debian/constants.py b/ipaplatform/debian/constants.py +index 7216694ad..f8ee8cf9f 100644 +--- a/ipaplatform/debian/constants.py ++++ b/ipaplatform/debian/constants.py +@@ -29,5 +29,6 @@ class DebianConstantsNamespace(BaseConstantsNamespace): + ODS_USER = User("opendnssec") + ODS_GROUP = Group("opendnssec") + SECURE_NFS_VAR = "NEED_GSSD" ++ NOBODY_GROUP = Group("nogroup") + + constants = DebianConstantsNamespace() +diff --git a/ipaserver/install/adtrustinstance.py b/ipaserver/install/adtrustinstance.py +index fd5a5a282..df2586ef1 100644 +--- a/ipaserver/install/adtrustinstance.py ++++ b/ipaserver/install/adtrustinstance.py +@@ -123,9 +123,11 @@ def make_netbios_name(s): + def map_Guests_to_nobody(): + env = {'LC_ALL': 'C'} + args = [paths.NET, '-s', '/dev/null', 'groupmap', 'add', +- 'sid=S-1-5-32-546', 'unixgroup=nobody', 'type=builtin'] ++ 'sid=S-1-5-32-546', ++ 'unixgroup="' + constants.NOBODY_GROUP + '"', 'type=builtin'] + +- logger.debug("Map BUILTIN\\Guests to a group 'nobody'") ++ logger.debug("Map BUILTIN\\Guests to a group '%s'", ++ constants.NOBODY_GROUP) + ipautil.run(args, env=env, raiseonerr=False, capture_error=True) + + +-- +2.48.1 + diff --git a/debian/patches/series b/debian/patches/series index be73fab0f..4189f9bfc 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -7,3 +7,4 @@ fix-sssd-socket-activation.diff # send upstream map-ssh-service.diff Make-path-of-Samba-lock-directory-configurable-and-u.patch +Make-name-of-nobody-group-configurable-and-use-nogro.patch