On Mon, Mar 08, 2010 at 12:42:36PM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 03/08/2010 04:16 AM, Sumit Bose wrote:
> On Fri, Feb 26, 2010 at 04:43:56PM +0100, Sumit Bose wrote:
>> On Wed, Feb 24, 2010 at 09:56:47AM -0500, Simo Sorce wrote:
>>> On Wed, 24 Feb 2010 12:05:18 +0100
>>> Sumit Bose <sbose(a)redhat.com> wrote:
>>>
>>>> + old_umask = umask(0000);
>>>> + ret = mkdir(dirname, 01777);
>>>> + umask(old_umask);
>>>> + if (ret != EOK) {
>>>> + DEBUG(1, ("mkdir [%s] failed: [%d][%s].\n", dirname,
errno,
>>>> + strerror(errno)));
>>>> + return errno;
>>>> + }
>>>> +
>>>
>>> NACK.
>>> We do not want to give every user on the system freedom to write what
>>> they want in these directories.
>>>
>>> All parents need to be root.root 0755
>>>
>>> If the admins wants it differently they will have to pre-create the
>>> parent directories themselves.
>>>
>>> Simo.
>>
>> New version attached.
>>
>> Additionally to the issues mentions above the templates are only parsed
>> once and the expanded path is checked for suspicious patterns like
>> '/../'. If a private directory is created it is chown'd immediately
>> after its creation.
>>
>> There are two questions where I do not know a good answer:
>>
>> - The parent directories are always created with 0755 permissions and
>> the owner is root. Should we handle the case where the first existing
>> directory does not belong to root, e.g. if we have
>> /home/u1/a/b/c/ccache_dir/ccfile and a, b and c have to be created?
Yeah, if (and only if) the first existing directory belongs to the user
trying to create the cache file, then the directories it creates should
also belong to the user. If the highest existing directory is owned by
root, then the ownership should be retained.
If the highest existing directory is owned by some other user, it should
be an error.
>>
>> - The sequence '%P' is expanded to the client's PID. I think the
PID
>> does not qualify to be unique for a user and consequently a ccache
>> directory with only this sequence and no other user specific sequences
>> like '%u' is created as public directory. Do you agree?
>>
I personally contest that PID is a useful variable to handle here. I
can't really think of a time that you would really want a per-pid
credential cache.
I have disabled the '%P' sequence for the directory expansion and change
setting of the permissions as described above.
bye,
Sumit
>
> rebased to current master
>
> bye,
> Sumit
>
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkuVNwwACgkQeiVVYja6o6Mx5QCeMa+1jmIUgRXJVBKQME7q8S6z
+JIAoJAkvH5tAHxTLEeNGygY7CQjkBbm
=29w0
-----END PGP SIGNATURE-----
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel