On Tue, Nov 10, 2015 at 12:03:56PM +0100, Sumit Bose wrote:
Hi,
this patch removes the requirement to install p11_child with SETUID or
SETGID bit set. The needed privileges can be tuned with the help of
policy-kit so p11_child can either run as root or as SSSD user depending
on the SSSD configuration without the need to gain extra user or group
privileges.
With this patch the needed policy-kit configuration snippet is created
if the --with-sssd-user configure option is used. Since the contributed
spec file implicitly assumes that the SSSD user is 'sssd' I added the
option here. I added 'Requires: polkit' as well to make sure
%{_datadir}/polkit-1/rules.d/ exists. This might not be the best
solution for minimal installations where e.g. only the SSSD LDAP
provider is needed. But distribution can modify it to suit their needs.
I did it this way because I'm not sure if all distribution allow
directories to be owned by multiple packages. If someone can confirm
that this is allowed by the majority of the distribution I'd be happy to
modify the patch so that the directory is created and owned by the SSSD
package and drop the polkit requirement.
I think all major RPM-based distributions use RPM from
rpm.org which
allows this for quite some time.
I don't think we need to worry too much here, the contrib/sssd.spec.in
file is Fedora-specific. We have a separate suse-specific specfile, but
I don't think it works (I think we might want to even remove it)
Since dropping the SETUID and SETGID bits improves the general security
it would be nice if this patch can be include in 1.13.x so the
distributions can pick it and improve already released packages.
Unfortunately I think to test the functionality, i.e. access a Smartcard
with p11_child as an unprivileged user, real hardware is needed.
Do you think it would be possible to test with Yubikey? If not, do you
know some cheap vendor that sells smartcards usable for testing?
If you
want to test it, please ping me, maybe we can arrange something.
bye,
Sumit
I like using polkit, but I also have some questions, see inline
From 38fb2635aaec4dca335227d532965dfbadbca2ef Mon Sep 17 00:00:00
2001
From: Sumit Bose <sbose(a)redhat.com>
Date: Fri, 30 Oct 2015 16:29:31 +0100
Subject: [PATCH] p11: allow p11_child to run completely unprivileged
To only operation of p11_child which requires special privileges is the
communication to pcscd which handles the Smartcard access. pcscd uses
policy-kit for access control so access can easily be configured by
dropping config snippets into the right directory.
If SSSD is configured to run as un-privileged user this patch creates
the needed config snippet for policy-kit and installs it in a suitable
directory. As a result p11_child does not have to be installed with
SETUID or SETGID bits set.
Resolves
https://fedorahosted.org/sssd/ticket/2755 by making it obsolete
---
Makefile.am | 8 ++++----
configure.ac | 1 +
contrib/sssd-pcsc.rules.in | 15 +++++++++++++++
contrib/sssd.spec.in | 6 +++++-
src/p11_child/p11_child_nss.c | 27 ++++++---------------------
5 files changed, 31 insertions(+), 26 deletions(-)
create mode 100644 contrib/sssd-pcsc.rules.in
diff --git a/Makefile.am b/Makefile.am
index ee97d095e07f6d485232a1afd87f9e4057688f22..57bece64c5fca058dcf57efffb149770ac3b773e
100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -150,6 +150,10 @@ sssdlibexec_PROGRAMS += selinux_child
endif
if HAVE_NSS
sssdlibexec_PROGRAMS += p11_child
+if SSSD_USER
+polkit_rulesdir = $(datadir)/polkit-1/rules.d
+dist_polkit_rules_DATA = contrib/sssd-pcsc.rules
Since the polkit rules are something this patch uses undonditionally,
do you think they might fit better into src/p11_child?
Or did you put them into contrib because the polkit syntax changed to
the javascript-based one not too long ago and not all distributions
might be able to use it? (In that case, I wonder if we should change
p11_child being setuid conditionally)
In general, what is the oldest OS/release where you think the SC
functionality and the smartcard auth should work?