diff --git a/SOURCES/0091-RESPONDER-don-t-execute-sss_dp_callback_destructor-i.patch b/SOURCES/0091-RESPONDER-don-t-execute-sss_dp_callback_destructor-i.patch
new file mode 100644
index 0000000..5623960
--- /dev/null
+++ b/SOURCES/0091-RESPONDER-don-t-execute-sss_dp_callback_destructor-i.patch
@@ -0,0 +1,56 @@
+From ecbc3329788de254346d7ea84770e09cc22dbc9c Mon Sep 17 00:00:00 2001
+From: Alexey Tikhonov <atikhono@redhat.com>
+Date: Mon, 18 Jul 2022 21:59:03 +0200
+Subject: [PATCH] RESPONDER: don't execute sss_dp_callback_destructor() if
+ responder is being shut down.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Resolves: https://github.com/SSSD/sssd/issues/6270
+
+Reviewed-by: Pavel Březina <pbrezina@redhat.com>
+Reviewed-by: Tomáš Halman <thalman@redhat.com>
+---
+ src/responder/common/responder_dp.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/src/responder/common/responder_dp.c b/src/responder/common/responder_dp.c
+index a49b31528..0cc5c5424 100644
+--- a/src/responder/common/responder_dp.c
++++ b/src/responder/common/responder_dp.c
+@@ -35,6 +35,7 @@ struct sss_dp_callback {
+ struct sss_dp_callback *prev;
+ struct sss_dp_callback *next;
+
++ struct resp_ctx *rctx;
+ struct tevent_req *req;
+ struct sss_dp_req *sdp_req;
+ };
+@@ -58,9 +59,14 @@ static int sss_dp_callback_destructor(void *ptr)
+ struct sss_dp_callback *cb =
+ talloc_get_type(ptr, struct sss_dp_callback);
+
++ /* `sdp_req` might be already freed if responder is being shut down */
++ if (cb->rctx->shutting_down) {
++ return 0;
++ }
++
+ DLIST_REMOVE(cb->sdp_req->cb_list, cb);
+
+- return EOK;
++ return 0;
+ }
+
+ static int sss_dp_req_destructor(void *ptr)
+@@ -396,6 +402,7 @@ sss_dp_issue_request(TALLOC_CTX *mem_ctx, struct resp_ctx *rctx,
+ goto fail;
+ }
+
++ cb->rctx = rctx;
+ cb->req = nreq;
+ cb->sdp_req = sdp_req;
+
+--
+2.37.3
+
diff --git a/SOURCES/0092-IFP-reset-idle-timer-on-any-DBUS-activity.patch b/SOURCES/0092-IFP-reset-idle-timer-on-any-DBUS-activity.patch
new file mode 100644
index 0000000..a3b5d35
--- /dev/null
+++ b/SOURCES/0092-IFP-reset-idle-timer-on-any-DBUS-activity.patch
@@ -0,0 +1,57 @@
+From 352544558cef26c9ef4a7393cbf98776155efcdb Mon Sep 17 00:00:00 2001
+From: Alexey Tikhonov <atikhono@redhat.com>
+Date: Tue, 19 Jul 2022 12:50:35 +0200
+Subject: [PATCH] IFP: reset idle timer on any DBUS activity
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Resolves: https://github.com/SSSD/sssd/issues/6269
+
+Reviewed-by: Alejandro Lopez <allopez@redhat.com>
+Reviewed-by: Pavel Březina <pbrezina@redhat.com>
+---
+ src/responder/ifp/ifpsrv.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/src/responder/ifp/ifpsrv.c b/src/responder/ifp/ifpsrv.c
+index 2bd4e3703..97034d9d0 100644
+--- a/src/responder/ifp/ifpsrv.c
++++ b/src/responder/ifp/ifpsrv.c
+@@ -94,7 +94,7 @@ static errno_t
+ sysbus_init(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev,
+ const char *dbus_name,
+- void *pvt,
++ struct ifp_ctx *ifp_ctx,
+ struct sysbus_ctx **sysbus)
+ {
+ DBusError dbus_error;
+@@ -138,20 +138,21 @@ sysbus_init(TALLOC_CTX *mem_ctx,
+ /* Integrate with tevent loop */
+ ret = sbus_init_connection(system_bus, ev, conn,
+ SBUS_CONN_TYPE_SYSBUS,
+- NULL, NULL, &system_bus->conn);
++ &ifp_ctx->rctx->last_request_time,
++ NULL, &system_bus->conn);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "Could not integrate D-BUS into mainloop.\n");
+ goto fail;
+ }
+
+- ret = ifp_register_sbus_interface(system_bus->conn, pvt);
++ ret = ifp_register_sbus_interface(system_bus->conn, ifp_ctx);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "Could not register interfaces\n");
+ goto fail;
+ }
+
+- ifp_register_nodes(pvt, system_bus->conn);
++ ifp_register_nodes(ifp_ctx, system_bus->conn);
+
+ *sysbus = system_bus;
+ return EOK;
+--
+2.37.3
+
diff --git a/SOURCES/0093-RESPONDER-fixed-condition-in-responder_idle_handler.patch b/SOURCES/0093-RESPONDER-fixed-condition-in-responder_idle_handler.patch
new file mode 100644
index 0000000..bb8a5dc
--- /dev/null
+++ b/SOURCES/0093-RESPONDER-fixed-condition-in-responder_idle_handler.patch
@@ -0,0 +1,44 @@
+From f37e15e9134ff22d03c4997fd1c76754b67d3539 Mon Sep 17 00:00:00 2001
+From: Alexey Tikhonov <atikhono@redhat.com>
+Date: Tue, 19 Jul 2022 14:28:35 +0200
+Subject: [PATCH] RESPONDER: fixed condition in responder_idle_handler()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Man page says about `responder_idle_timeout` the following:
+```
+number of seconds that an SSSD responder process can be up without being used.
+```
+Idle timer fires every responder_idle_timeout/2 seconds and checks if
+current_time > (last_request_time + timeout).
+In a trivial case - no additional requests after initial one / startup -
+condition will became 'true' only when timer fires for a 3rd time, i.e.
+after 3*(timeout/2) seconds. This contradicts man page statement.
+
+This patch changes condition to '>=' so that responder would be terminated
+in 2*(timeout/2) seconds.
+
+Reviewed-by: Alejandro Lopez <allopez@redhat.com>
+Reviewed-by: Pavel Březina <pbrezina@redhat.com>
+(cherry picked from commit 473752e261d8d166b16f95fe4ddc8d320ae0faf4)
+---
+ src/responder/common/responder_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/responder/common/responder_common.c b/src/responder/common/responder_common.c
+index fb2a31bb0..4c6445311 100644
+--- a/src/responder/common/responder_common.c
++++ b/src/responder/common/responder_common.c
+@@ -374,7 +374,7 @@ static void responder_idle_handler(struct tevent_context *ev,
+ goto end;
+ }
+
+- if ((now - rctx->last_request_time) > rctx->idle_timeout) {
++ if ((now - rctx->last_request_time) >= rctx->idle_timeout) {
+ /* This responder is idle. Terminate it */
+ DEBUG(SSSDBG_TRACE_INTERNAL,
+ "Terminating idle responder [%p]\n", rctx);
+--
+2.37.3
+
diff --git a/SOURCES/0094-SUDO-Fix-timezone-issues-with-sudoNotBefore-and-sudo.patch b/SOURCES/0094-SUDO-Fix-timezone-issues-with-sudoNotBefore-and-sudo.patch
new file mode 100644
index 0000000..9b9830c
--- /dev/null
+++ b/SOURCES/0094-SUDO-Fix-timezone-issues-with-sudoNotBefore-and-sudo.patch
@@ -0,0 +1,122 @@
+From 1bb93f70de9907d88b2ebc5c6ffee14417d90fee Mon Sep 17 00:00:00 2001
+From: Anton Bobrov <antbob@users.noreply.github.com>
+Date: Mon, 19 Sep 2022 17:51:07 +0200
+Subject: [PATCH] SUDO: Fix timezone issues with sudoNotBefore and sudoNotAfter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The current code does not respect generalized time as specified in related before/after attributes.
+The problem with the current implementation is that it essentially treats them as local time,
+with no regard to TZ and DST.
+
+This patch is using timegm(3) instead of mktime(3) to address said timezone issues and some bare
+minimum static unit tests with known verified values to make sure the API is consitent with them.
+
+Resolves:
+https://github.com/SSSD/sssd/issues/6354
+
+Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
+Reviewed-by: Pavel Březina <pbrezina@redhat.com>
+(cherry picked from commit 0198f64ce231e9608b14152c64426fb9e015fd33)
+---
+ configure.ac | 3 +++
+ src/db/sysdb_sudo.c | 11 ++++++++++-
+ src/tests/cmocka/test_sysdb_sudo.c | 29 +++++++++++++++++++++++++++++
+ 3 files changed, 42 insertions(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 89abddef4..a90e16642 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -92,6 +92,9 @@ LIBS=$SAVE_LIBS
+ AC_CHECK_FUNCS([ utimensat \
+ futimens ])
+
++# Check for the timegm() function (not part of POSIX / Open Group specs)
++AC_CHECK_FUNC([timegm], [], [AC_MSG_ERROR([timegm() function not found])])
++
+ #Check for endian headers
+ AC_CHECK_HEADERS([endian.h sys/endian.h byteswap.h])
+
+diff --git a/src/db/sysdb_sudo.c b/src/db/sysdb_sudo.c
+index 59d6824c0..3a918e9c6 100644
+--- a/src/db/sysdb_sudo.c
++++ b/src/db/sysdb_sudo.c
+@@ -60,9 +60,18 @@ static errno_t sysdb_sudo_convert_time(const char *str, time_t *unix_time)
+ for (format = formats; *format != NULL; format++) {
+ /* strptime() may leave some fields uninitialized */
+ memset(&tm, 0, sizeof(struct tm));
++ /* Let underlying implementation figure out DST */
++ tm.tm_isdst = -1;
+ tret = strptime(str, *format, &tm);
+ if (tret != NULL && *tret == '\0') {
+- *unix_time = mktime(&tm);
++ /* Convert broken-down time to local time */
++ if (tm.tm_gmtoff == 0) {
++ *unix_time = timegm(&tm);
++ } else {
++ long offset = tm.tm_gmtoff;
++ tm.tm_gmtoff = 0;
++ *unix_time = timegm(&tm) - offset;
++ }
+ return EOK;
+ }
+ }
+diff --git a/src/tests/cmocka/test_sysdb_sudo.c b/src/tests/cmocka/test_sysdb_sudo.c
+index fc6a47a16..f852427fd 100644
+--- a/src/tests/cmocka/test_sysdb_sudo.c
++++ b/src/tests/cmocka/test_sysdb_sudo.c
+@@ -44,6 +44,12 @@
+ #define OVERRIDE_GROUP_NAME "group_sudo_test"
+ #define OVERRIDE_UID 2112
+
++/* sysdb_sudo_convert_time function is static */
++extern char *strptime(const char *__restrict __s,
++ const char *__restrict __fmt,
++ struct tm *__tp);
++#include "src/db/sysdb_sudo.c"
++
+ struct test_user {
+ const char *name;
+ uid_t uid;
+@@ -949,6 +955,26 @@ void test_filter_rules_by_time(void **state)
+ talloc_zfree(_rules);
+ }
+
++void test_sudo_convert_time(void **state)
++{
++ /* Each ctime should map to its corresponding utime */
++ const char *ctimes[] = {"20220715090000Z",
++ "20220715090000+0200",
++ "20220715090000-0200"};
++ const time_t utimes[] = {1657875600,
++ 1657868400,
++ 1657882800};
++ const int ntimes = sizeof(ctimes) / sizeof(ctimes[0]);
++ time_t converted;
++ errno_t ret;
++
++ for (int i = 0; i < ntimes; i++) {
++ ret = sysdb_sudo_convert_time(ctimes[i], &converted);
++ assert_int_equal(ret, EOK);
++ assert_int_equal(converted, utimes[i]);
++ }
++}
++
+ int main(int argc, const char *argv[])
+ {
+ int rv;
+@@ -1029,6 +1055,9 @@ int main(int argc, const char *argv[])
+ cmocka_unit_test_setup_teardown(test_filter_rules_by_time,
+ test_sysdb_setup,
+ test_sysdb_teardown),
++
++ /* sysdb_sudo_convert_time() */
++ cmocka_unit_test(test_sudo_convert_time)
+ };
+
+ /* Set debug level to invalid value so we can decide if -d 0 was used. */
+--
+2.37.3
+
diff --git a/SOURCES/0095-BACKEND-Reload-resolv.conf-after-initialization.patch b/SOURCES/0095-BACKEND-Reload-resolv.conf-after-initialization.patch
new file mode 100644
index 0000000..ed67840
--- /dev/null
+++ b/SOURCES/0095-BACKEND-Reload-resolv.conf-after-initialization.patch
@@ -0,0 +1,59 @@
+From c52a5a640f0574f28281dd62238ffc7303eb4391 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Alejandro=20L=C3=B3pez?= <allopez@redhat.com>
+Date: Fri, 4 Nov 2022 12:18:50 +0100
+Subject: [PATCH] BACKEND: Reload resolv.conf after initialization
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Once the backend initialization is finished, in particular after D-Bus
+is initialized, reload the resolv.conf file to reload any change
+signaled through D-Bus before its initializiation.
+
+Resolves: https://github.com/SSSD/sssd/issues/6383
+
+Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
+Reviewed-by: Pavel Březina <pbrezina@redhat.com>
+---
+ src/monitor/monitor_sbus.c | 5 +++++
+ src/providers/data_provider_be.c | 8 ++++++++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/src/monitor/monitor_sbus.c b/src/monitor/monitor_sbus.c
+index 9d3cd478e..cf70552b3 100644
+--- a/src/monitor/monitor_sbus.c
++++ b/src/monitor/monitor_sbus.c
+@@ -156,6 +156,11 @@ int monitor_common_res_init(struct sbus_request *dbus_req, void *data)
+ return EIO;
+ }
+
++ if (dbus_req == NULL) {
++ /* No reply needed */
++ return EOK;
++ }
++
+ /* Send an empty reply to acknowledge receipt */
+ return sbus_request_return_and_finish(dbus_req, DBUS_TYPE_INVALID);
+ }
+diff --git a/src/providers/data_provider_be.c b/src/providers/data_provider_be.c
+index fb72d99e3..2699f3b3a 100644
+--- a/src/providers/data_provider_be.c
++++ b/src/providers/data_provider_be.c
+@@ -549,6 +549,14 @@ errno_t be_process_init(TALLOC_CTX *mem_ctx,
+ goto done;
+ }
+
++ /* Load the resolv.conf file in case a call to dbus' resInit() was missed */
++ if (monitor_be_methods.resInit != NULL) {
++ ret = monitor_be_methods.resInit(NULL, (void *) be_ctx);
++ if (ret != EOK) {
++ DEBUG(SSSDBG_MINOR_FAILURE, "Unable to reload resolv.conf\n");
++ }
++ }
++
+ ret = EOK;
+
+ done:
+--
+2.37.3
+
diff --git a/SPECS/sssd.spec b/SPECS/sssd.spec
index b8f71fa..28908f9 100644
--- a/SPECS/sssd.spec
+++ b/SPECS/sssd.spec
@@ -50,7 +50,7 @@
Name: sssd
Version: 1.16.5
-Release: 10%{?dist}.13
+Release: 10%{?dist}.14
Group: Applications/System
Summary: System Security Services Daemon
License: GPLv3+
@@ -149,6 +149,11 @@ Patch0087: 0087-pam-better-SC-fallback-message.patch
Patch0088: 0088-pam_sss-fix-for-old-GDM-screen-lock.patch
Patch0089: 0089-ad-use-right-sdap_domain-in-ad_domain_info_send.patch
Patch0090: 0090-ad-add-fallback-in-ad_domain_info_send.patch
+Patch0091: 0091-RESPONDER-don-t-execute-sss_dp_callback_destructor-i.patch
+Patch0092: 0092-IFP-reset-idle-timer-on-any-DBUS-activity.patch
+Patch0093: 0093-RESPONDER-fixed-condition-in-responder_idle_handler.patch
+Patch0094: 0094-SUDO-Fix-timezone-issues-with-sudoNotBefore-and-sudo.patch
+Patch0095: 0095-BACKEND-Reload-resolv.conf-after-initialization.patch
#Those patches should not be removed in RHEL-7
Patch0999: 0999-NOUPSTREAM-Default-to-root-if-sssd-user-is-not-spec
@@ -1324,6 +1329,11 @@ systemctl try-restart sssd >/dev/null 2>&1 || :
}
%changelog
+* Tue Nov 15 2022 Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.14
+- Resolves: rhbz#2097014 - SSSD -> sssd_be and sssd_ifp coredump [rhel-7.9.z]
+- Resolves: rhbz#2107380 - sssd timezone issues sudonotafter [rhel-7.9.z]
+- Resolves: rhbz#2116207 - SSSD starting offline after reboot [rhel-7.9.z]
+
* Fri Jun 10 2022 Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.13
- Resolves: rhbz#2079441 - SSSD update prompts for smartcard pin twice - After update to 7.9 [rhel-7.9.z]
- Resolves: rhbz#2073352 - Use right sdap_domain in ad_domain_info_send [rhel-7.9.z]