[PATCH] SELINUX: Call setuid(0)/setgid(0) to also set the real IDs to root
by Jakub Hrozek
Hi,
Please see the commit message and the ticket description. Also please
note that if you're testing with a non-privileged user, you also need to
set:
allow sssd_selinux_manager_t self:capability setgid;
allow sssd_selinux_manager_t self:capability setuid;
Otherwise there will be AVC denials.
9 years, 1 month
[PATCH] Monitor and sbus changes for running SSSD as a non-privileged user
by Jakub Hrozek
Hi,
Attached are patches that perform changes in the monitor process and the
low-level sbus and sysdb code required to run the NSS responder as a
non-privileged user. Some of the patches call chmod/chown on files owned
by the SSSD, so I'd like to request a very careful review.
The patches depend on patches from threads:
* SSSD: Add the options to specify a UID and GID to run as
* Packaging fixes related to non-root SSSD
I tried to explain the changes well in the commit messages. See below
for some more and especially questions.
[PATCH 1/7] SSSD: Load a user to run a service as from configuration
Pretty much just loads the sssd user from configuration and stores the
uid/gid. One question -- should the individual services or domain have a
option to ignore the sssd user? For instance:
[sssd]
user = sssd
group = sssd
[nss]
# Would run as SSSD
[pam]
# Would run as root/whatever user monitor runs as
ignore_sssd_user = True
This would mostly be a fallback for cases where we introduce a bug. I
don't think this kind of granularity is needed, the user can just
run sssd as root completely:
[sssd]
user = root
group = root
[PATCH 2/7] SBUS: Chown the sbus socket if needed
Chowns the monitor sbus socket if a non-root sssd user is specified. I
don't think we allow more privileges than before, the monitor socket has
permissions 0600 and is owned by sssd.sssd, so only the private user and
root (who bypasses DAC checks anyway) can access it.
In sbus_new_server(), we can open the socket after dbus creates it and
call fchmod() and fchown() to avoid some kind of TOCTOU races. But I'm
not sure this is needed given that a privileged process will create the
pipes.
[PATCH 3/7] SBUS: Allow connections from other UIDs
A simple patch, allows connections from the sssd user. Please see the
commit message for more details.
This patch (and the previous) should have a unit test, but currently our
sbus tests are tightly tied to the check framework. I need to change the
common code to be test framework-agnostic, but I don't want to delay the
inclusion of these patches.
[PATCH 4/7] BE: Own the sbus socket as the SSSD user
Same as the two previous patches, just for the sssd_be process.
[PATCH 5/7] MONITOR: Allow confdb to be accessed by nonroot user
Confdb is created by the privileged monitor process, but needs to be
accessed by nonprivileged responder processes. chown it after creation.
[PATCH 6/7] SYSDB: Allow calling chown on the sysdb file from monitor
Same as the previous one, just for the sysdb.
[PATCH 7/7] NSS: Run as a user specified by monitor
With this patch, it's possible to run the NSS responder as a
non-privileged user.
9 years, 1 month
[PATCH] IPA: Use attr's dom for users, too
by Jakub Hrozek
Hi,
I found one bug while testing Sumit's patches. To reproduce, request a
universal group on an IPA client. The group must have members from two
different trusted AD domains.
9 years, 1 month
[PATCH] IPA: process_members() add ghosts only once
by Sumit Bose
Hi,
this patch fixes an issue caused by
https://fedorahosted.org/sssd/ticket/2567 on the IPA client side. If on
the IPA server side a group member is returned twice for a universal
group the extdom plugin will deliver this duplicated entry to the IPA
client. On the client side saving this list to the cache will fail with a
LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS error. With this patch the duplicated
entries are filtered out.
bye,
Sumit
9 years, 1 month
[PATCH] IPA: resolve IPA group-memberships for AD users
by Sumit Bose
Hi,
this patch is a follow-up for the recent HBAC fixes. It turned out that
the originalMemberOf attributes of AD users for IPA groups can be
removed by some user lookups. To reproduce call
# sss_cache -E
# id aduser(a)ad.domain
# ldbsearch -H /var/lib/sss/db/cache_ipa.domain.ldb name=aduser(a)ad.domain memberof originalMemberOf
here originalMemberOf should be available for all AD and IPA groups.
# sss_cache -E
# getent passwd aduser(a)ad.domain
# ldbsearch -H /var/lib/sss/db/cache_ipa.domain.ldb name=aduser(a)ad.domain memberof originalMemberOf
now originalMemberOf only show AD groups.
bye,
Sumit
9 years, 1 month
[PATCH] sysdb: remove ghosts in all sub-domains as well
by Sumit Bose
Hi,
this patch fixes an issue with the handling of universal groups. You can
reproduce it with the following steps either with the AD provider in an
AD forest with multiple domains or with the IPA provider and trust to an
AD forest with multiple domains and a universal group:
- start with an empty cache
- getent group universal_group(a)dom1.ad
- ldbsearch -H /path/to/cache name=universal_group(a)dom1.ad
the cached object only has ghost members because no users are resolved
- getent passwd group_member(a)dom2.ad
- ldbsearch -H /path/to/cache name=universal_group(a)dom1.ad
if a group member from a different domain than the group itself is
resolved the ghost entry is not removed.
bye,
Sumit
9 years, 1 month