tests: adding gpo test case for traversal bug

[danlavu]

Depends on SSSD/sssd-test-framework#260

[gemini-code-assist]

Code Review

This pull request adds a new system test test_gpo__rejects_path_traversal_in_gpo_file_sys_path to verify that SSSD correctly rejects Group Policy Objects (GPOs) containing path traversal components in their gPCFileSysPath attribute, ensuring access is denied in enforcing mode. There are no review comments, so I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[jakub-vavra-cz]

Looks good, just make sure not to merge the temporary commit.

[danlavu]

Failures are not related, https://github.com/SSSD/sssd/actions/runs/29554224723/job/87802985201?pr=8952

Removing temporary commit.

[sssd-bot]

The pull request was accepted by @jakub-vavra-cz with the following PR CI status:

---

🟢 CodeQL (success)
🟢 osh-diff-scan:fedora-rawhide-x86_64:upstream (success)
🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 rpm-build:fedora-43-x86_64:upstream (success)
🟢 rpm-build:fedora-44-x86_64:upstream (success)
🟢 rpm-build:fedora-rawhide-x86_64:upstream (success)
🟢 testing-farm:centos-stream-10-x86_64:upstream (success)
🟢 testing-farm:fedora-43-x86_64:upstream (success)
🟢 testing-farm:fedora-44-x86_64:upstream (success)
🔴 testing-farm:fedora-rawhide-x86_64:upstream (failure)
➖ ci / intgcheck (skipped)
🔴 ci / prepare (failure)
➖ ci / system (skipped)
➖ Coverity scan / coverity (skipped)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / pre-commit (success)
🔴 Static code analysis / python-system-tests (failure)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.

[jakub-vavra-cz]

Static analysis screams now.