Fleet Commander: design changes due to the drop of DAC_OVERRIDE capability
by Fabiano Fidêncio
People,
Let's start with the context of this email:
https://bugzilla.redhat.com/show_bug.cgi?id=1536854
So, seems that even without knowing that, I've relied on CAP_DAC_OVERRIDE
in order to have the Fleet Commander integration working as expected and in
the implementation details of this feature.
The desktop profiles are stored in a dir like:
/var/lib/sss/deskprofile/$domain/$user/$profile.
Currently, the way I've been creating those are:
$domain = 755 (root:root)
$user = 600 ($user:$user_group)
$profile = 600 ($user:$user_group)
Now, as mentioned in the bugzilla linked in this email, the current code
fails with an EACCES.
With all this background, I'd like to discuss what's the best approach to
take. I've opened a PR (https://github.com/SSSD/sssd/pull/498) which makes
everything work again, but does the following changes:
$domain = 755 (root:root) -- NO changes here
$user = 770 ($user:root) --> changed from 600 ($user:$user_group)
$profile = 660 ($user:root) --> changed from 600 ($user:$user_group)
This is one way to solve the issue suggested at
https://bugzilla.redhat.com/show_bug.cgi?id=1536854#c5.
Another suggestion, also mentioned in the bugzilla, would be to only
fchown()/fchmod() the files/dirs *after* all the operations we do are over.
Is there any other suggestion? Whatever comes out of this discussion will
be used to update the feature's design page accordingly.
Best Regards,
--
Fabiano Fidêncio
6 years, 2 months
[sssd PR#502][opened] BUILD: Add missing libs found by -Wl,-z,defs
by lslebodn
URL: https://github.com/SSSD/sssd/pull/502
Author: lslebodn
Title: #502: BUILD: Add missing libs found by -Wl,-z,defs
Action: opened
PR body:
"""
It is not possible to fully build sssd with -Wl,-z,defs
because we are using sssd_be as a "library" in some cases
e.g.
src/providers/krb5/.libs/libsss_krb5_common_la-krb5_init_shared.o: In function `krb5_child_init':
src/providers/krb5/krb5_init_shared.c:38: undefined reference to `_dp_opt_get_bool'
src/providers/krb5/krb5_init_shared.c:47: undefined reference to `_dp_opt_get_string'
src/providers/krb5/krb5_init_shared.c:94: undefined reference to `_dp_opt_get_cstring'
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/502/head:pr502
git checkout pr502
6 years, 2 months
SSSD Virtual Test Suite
by Pavel Březina
Hello,
It took me a lot longer than I expected but here it is at last. This is
my set of scripts that use vagrant and Ansible to automatically
provision virtual environment that I use to develop and test SSSD.
To create this environment you only need to run one command:
$ ./setup.sh
and after a while you have several machines provisioned and ready. This
machines include LDAP, IPA and AD servers with one machine dedicated to
SSSD. This machine is already enrolled to those servers.
To start building and/or testing SSSD with all available providers, you
can just run:
$ vagrant ssh client
Additionally, it allows you to automatically source your set of scripts
on each login and access IPA web-ui from your browser.
I tried to make the provisioning as fast as possible but it still takes
approximately one hour on my machine. So be patient.
Any ideas and patches for improvements are welcomed.
The source is available at:
https://github.com/pbrezina/sssd-test-suite
6 years, 2 months
Is there an alternative other than sss_nss_getsidbyid that can deal with UID == GID?
by Richard Sharpe
Hi folks,
We have a customer who seems to do what RHEL does with respects users
and groups.
That is:
1. User A has a SID of S-1-5-21-x-y-z-1234
2. They also have a primary group SID of S-1-5-21-x-y-x-1235 (usually adjacent).
3. They are also using RFC2703bis and they have the UID property set
to 21234 and the GID property set to 21234.
Now, when the Samba idmap_sss.c calls sss_nss_getsidbyid looking for
the SID associated with the GID it often gets back the SID associated
with the UID, probably because we just asked for the SID associated
with the UID.
Is there a different function I can call to get both/all? I looked at
the code for sss_nss_getsidbyid and it just calls sss_nss_getyyybyxxx
and that function seems to only hand back the first SID returned.
Also, as an aside, it seems like a bad decision to place fixed CERTs
in the repos because if you need to rebuild the package after the CERT
expires you are SOL.
--
Regards,
Richard Sharpe
(何以解憂?唯有杜康。--曹操)
6 years, 2 months