From e1c693d22e8bf9ee45d9b95b2097dfa382cd70ea Mon Sep 17 00:00:00 2001
From: William Brown <william@blackhats.net.au>
Date: Oct 19 2018 23:34:54 +0000
Subject: [PATCH 1/2] Issue 49939 - Fix ldapi path in lib389


Lib389 uses a .replace rather than a path join, causing dirsrv to be replaced in
the path. This breaks if the prefix is "/opt/dirsrv".

This should use path join instead.

https://pagure.io/389-ds-base/issue/49939

Author: William Brown <william@blackhats.net.au>

---

diff --git a/src/lib389/lib389/instance/setup.py b/src/lib389/lib389/instance/setup.py
index 9335613..5b0c421 100644
--- a/src/lib389/lib389/instance/setup.py
+++ b/src/lib389/lib389/instance/setup.py
@@ -226,6 +226,7 @@ class SetupDs(object):
                  'sysconf_dir': ds_paths.sysconf_dir,
                  'data_dir': ds_paths.data_dir,
                  'local_state_dir': ds_paths.local_state_dir,
+                 'ldapi' : ds_paths.ldapi,
                  'lib_dir': ds_paths.lib_dir,
                  'run_dir': ds_paths.run_dir,
                  'tmp_dir': ds_paths.tmp_dir,
@@ -781,7 +782,7 @@ class SetupDs(object):
             ds_instance.backends.create(properties=backend)
 
         # Initialise ldapi socket information. IPA expects this ....
-        ldapi_path = slapd['run_dir'].replace('dirsrv', 'slapd-' + slapd['instance_name'] + '.socket')
+        ldapi_path = os.path.join(slapd['local_state_dir'], "run/slapd-%s.socket" % slapd['instance_name'])
         ds_instance.config.set('nsslapd-ldapifilepath', ldapi_path)
         ds_instance.config.set('nsslapd-ldapilisten', 'on')
         ds_instance.config.set('nsslapd-ldapiautobind', 'on')

From 364b85484a00cc00d55e1daf39e46f9da4eb0d61 Mon Sep 17 00:00:00 2001
From: William Brown <william@blackhats.net.au>
Date: Oct 19 2018 23:34:54 +0000
Subject: [PATCH 2/2] Ticket 49975 - SUSE rpmlint issues


The package maintainer at SUSE kindly pointed out a number of issues
detected by rpmlint. Of the three issues, this resolves two of them.

The first is calling setgroups with an empty group list before setgid
so that we guarantee we only have the target user group remaining
in our permission set when we drop privileges. The second is to remove
a superfluous shebang line from python

https://pagure.io/389-ds-base/issue/49975

Author: William Brown <william@blackhats.net.au>

---

diff --git a/ldap/servers/slapd/main.c b/ldap/servers/slapd/main.c
index 1b38875..f50b320 100644
--- a/ldap/servers/slapd/main.c
+++ b/ldap/servers/slapd/main.c
@@ -384,6 +384,22 @@ main_setuid(char *username)
             slapi_log_err(SLAPI_LOG_ERR, "main_setuid", "getpwnam(%s) == NULL, error %d (%s)\n",
                           username, oserr, slapd_system_strerror(oserr));
         } else {
+            /*
+             * According to https://pagure.io/389-ds-base/issue/49975 and
+             * POS36-C. Observe correct revocation order while relinquishing privileges
+             * setgroups must be called to ensure our supplemental group list is
+             * correctly limited. Because we only care about our single group
+             * dirsrv for the target user, we set that.
+             *
+             * In the future this may change however.
+             */
+            if (setgroups(0, NULL) != 0) {
+                int oserr = errno;
+
+                slapi_log_err(SLAPI_LOG_ERR, "main_setuid", "setgroups(0, NULL) != 0, error %d (%s)\n",
+                              oserr, slapd_system_strerror(oserr));
+                return -1;
+            }
             if (setgid(pw->pw_gid) != 0) {
                 int oserr = errno;
 
diff --git a/src/lib389/lib389/clitools/__init__.py b/src/lib389/lib389/clitools/__init__.py
index cd66ce1..a183f45 100755
--- a/src/lib389/lib389/clitools/__init__.py
+++ b/src/lib389/lib389/clitools/__init__.py
@@ -1,5 +1,3 @@
-#!/usr/bin/env python
-
 # --- BEGIN COPYRIGHT BLOCK ---
 # Copyright (C) 2015 Red Hat, Inc.
 # All rights reserved.