>From b3fed6d003ade30dab166cc9167388b99a6b317c Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Mon, 20 Oct 2014 13:59:49 +0200 Subject: [PATCH 2/6] SSSD: Chown the log files We need to chown the log files before dropping root to make sure they are usable by the SSSD user. Unfortunately, we can't just rely on passing the fd opened by root, because we need to be also able to rotate the log files. --- src/util/debug.c | 34 ++++++++++++++++++++++++++++++++++ src/util/server.c | 6 ++++++ src/util/util.h | 1 + 3 files changed, 41 insertions(+) diff --git a/src/util/debug.c b/src/util/debug.c index a99d5403a238f125010b9b309355b30f9f528c44..ac80285ef8ace182bd243b4844d5319ac79da3e4 100644 --- a/src/util/debug.c +++ b/src/util/debug.c @@ -297,6 +297,40 @@ void ldb_debug_messages(void *context, enum ldb_debug_level level, free(message); } +/* In cases SSSD used to run as the root user, but runs as the SSSD user now, + * we need to chown the log files + */ +int chown_debug_file(const char *filename, + uid_t uid, gid_t gid) +{ + char *logpath; + const char *log_file; + errno_t ret; + + if (filename == NULL) { + log_file = debug_log_file; + } else { + log_file = filename; + } + + ret = asprintf(&logpath, "%s/%s.log", LOG_PATH, log_file); + if (ret == -1) { + return ENOMEM; + } + + errno = 0; + ret = chown(logpath, uid, gid); + free(logpath); + if (ret != 0) { + ret = errno; + DEBUG(SSSDBG_FATAL_FAILURE, "chown failed for [%s]: [%d]\n", + log_file, ret); + return ret; + } + + return EOK; +} + int open_debug_file_ex(const char *filename, FILE **filep, bool want_cloexec) { FILE *f = NULL; diff --git a/src/util/server.c b/src/util/server.c index 3a84dee0cee06cb98c94a1d57209c2bcf7c4340a..a908470cdcf2cb85a6742e44905ae12d136c83d5 100644 --- a/src/util/server.c +++ b/src/util/server.c @@ -427,6 +427,12 @@ int server_setup(const char *name, int flags, struct tevent_signal *tes; struct logrotate_ctx *lctx; + ret = chown_debug_file(NULL, uid, gid); + if (ret != EOK) { + DEBUG(SSSDBG_MINOR_FAILURE, + "Cannot chown the debug files, debugging might not work!\n"); + } + ret = become_user(uid, gid); if (ret != EOK) { DEBUG(SSSDBG_FUNC_DATA, diff --git a/src/util/util.h b/src/util/util.h index 08cd144c1d7c165b37a2367ef6e0d6f86e137acd..63e472d20807937a6c2b57154767fdb66e9b672d 100644 --- a/src/util/util.h +++ b/src/util/util.h @@ -218,6 +218,7 @@ errno_t set_debug_file_from_fd(const int fd); /* From debug.c */ void ldb_debug_messages(void *context, enum ldb_debug_level level, const char *fmt, va_list ap); +int chown_debug_file(const char *filename, uid_t uid, gid_t gid); int open_debug_file_ex(const char *filename, FILE **filep, bool want_cloexec); int open_debug_file(void); int rotate_debug_files(void); -- 1.9.3