>From e9de1136c6126a35d70940d47d17e8bb2a3717c8 Mon Sep 17 00:00:00 2001 From: Michal Zidek Date: Thu, 9 Oct 2014 17:21:30 +0200 Subject: [PATCH 09/19] SYSDB: Allow calling chown on the sysdb file from monitor Sysdb must be accessible for the nonroot sssd processes. --- src/db/sysdb.c | 21 +++++++++++++++++++++ src/db/sysdb.h | 9 +++++++++ src/monitor/monitor.c | 3 ++- 3 files changed, 32 insertions(+), 1 deletion(-) diff --git a/src/db/sysdb.c b/src/db/sysdb.c index 8d6f00b52976228bfc9dfdc93503148837677346..1f02585e747dda6aadde772f76f30d3d69c4cfc0 100644 --- a/src/db/sysdb.c +++ b/src/db/sysdb.c @@ -1322,6 +1322,16 @@ int sysdb_init(TALLOC_CTX *mem_ctx, struct sss_domain_info *domains, bool allow_upgrade) { + return sysdb_init_ext(mem_ctx, domains, allow_upgrade, false, 0, 0); +} + +int sysdb_init_ext(TALLOC_CTX *mem_ctx, + struct sss_domain_info *domains, + bool allow_upgrade, + bool chown_dbfile, + uid_t uid, + gid_t gid) +{ struct sss_domain_info *dom; struct sysdb_ctx *sysdb; int ret; @@ -1343,6 +1353,17 @@ int sysdb_init(TALLOC_CTX *mem_ctx, return ret; } + if (chown_dbfile) { + ret = chown(sysdb->ldb_file, uid, gid); + if (ret != 0) { + ret = errno; + DEBUG(SSSDBG_CRIT_FAILURE, + "Cannot set sysdb ownership to %"SPRIuid":%"SPRIgid"\n", + uid, gid); + return ret; + } + } + dom->sysdb = talloc_move(dom, &sysdb); } diff --git a/src/db/sysdb.h b/src/db/sysdb.h index 0d0971d98dd684e47ae8ec067447169f41ebba67..ebb1bbedaf2df3030a012f1f0be8c5a069399cc3 100644 --- a/src/db/sysdb.h +++ b/src/db/sysdb.h @@ -533,6 +533,15 @@ uint64_t sss_view_ldb_msg_find_attr_as_uint64(struct sss_domain_info *dom, int sysdb_init(TALLOC_CTX *mem_ctx, struct sss_domain_info *domains, bool allow_upgrade); + +/* Same as sysdb_init, but additionally allows to change + * file ownership of the sysdb databases. */ +int sysdb_init_ext(TALLOC_CTX *mem_ctx, + struct sss_domain_info *domains, + bool allow_upgrade, + bool chown_dbfile, + uid_t uid, gid_t gid); + /* used to initialize only one domain database. * Do NOT use if sysdb_init has already been called */ int sysdb_domain_init(TALLOC_CTX *mem_ctx, diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c index 37f6e928be3508762e1c3afadbb67762f5cc1d38..04702428c4ed7fd1d77c6f18e491fa69b3700f4f 100644 --- a/src/monitor/monitor.c +++ b/src/monitor/monitor.c @@ -2312,7 +2312,8 @@ static int monitor_process_init(struct mt_ctx *ctx, if (!tmp_ctx) { return ENOMEM; } - ret = sysdb_init(tmp_ctx, ctx->domains, true); + ret = sysdb_init_ext(tmp_ctx, ctx->domains, true, + true, ctx->uid, ctx->gid); if (ret != EOK) { SYSDB_VERSION_ERROR_DAEMON(ret); return ret; -- 1.9.3