General hardening

[alexey-tikhonov]

Clear env of privileged 'sssd_pam' as a security hardening measure.

[alexey-tikhonov]

Looks like clearing 'LDB_MODULES_PATH' breaks a lot of integration tests:

sssd/Makefile.am

Line 2050 in af65c00

TESTS_ENVIRONMENT = LDB_MODULES_PATH=$(abs_top_builddir)/ldb_mod_test_dir \

so I've split this PR into two (see #7774)

This one will be probably blocked until we get rid of intg-tests...

[jengelh]

Ironically, I did spot that previously and applied it in cc675eb in part.

[eslerm]

This PR is mentioned in a vulnerability report. By not assigning CVEs, downstream maintainers (like distros) will not know which security patches are required for backporting to make downstream users of SSSD secure.

https://www.openwall.com/lists/oss-security/2024/12/19/1

[alexey-tikhonov]

This PR is mentioned in a vulnerability report.

Not a "vulnerability" but a "weaknesses".
No way to exploit it was presented thus no CVEs were assigned.