>From 9f2a8116ab203e9c5b1b4c2ebd8741b844cc3801 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Sat, 11 Oct 2014 20:22:42 +0200 Subject: [PATCH 1/4] BUILD: Install ldap_child and as setuid if running under non-privileged user The ldap_child permissions should be 4750, owned by root.sssd, to make sure only root and sssd can execute the child and if executed by sssd, the child will run as root. --- Makefile.am | 5 +++++ contrib/sssd.spec.in | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/Makefile.am b/Makefile.am index 38d689bcef9f99b29da72fedda35056b83408ea9..405c5b281849d9a626c47da8e4f387093ffe68f7 100644 --- a/Makefile.am +++ b/Makefile.am @@ -2845,6 +2845,11 @@ else $(MKDIR_P) $(DESTDIR)$(initdir) endif +if SSSD_USER + chgrp $(SSSD_USER) $(sssdlibexecdir)/ldap_child + chmod 4750 $(sssdlibexecdir)/ldap_child +endif + install-data-hook: rm $(DESTDIR)/$(nsslibdir)/libnss_sss.so.2 \ $(DESTDIR)/$(nsslibdir)/libnss_sss.so diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index c1c76db25f738b5a41d63c2796d733255f8f7a94..1ffe09c9819b36bdd37cceba895e14affdc8dc3f 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -645,7 +645,7 @@ rm -rf $RPM_BUILD_ROOT %defattr(-,root,root,-) %doc COPYING %{_libdir}/%{name}/libsss_krb5_common.so -%{_libexecdir}/%{servicename}/ldap_child +%attr(4750,root,sssd) %{_libexecdir}/%{servicename}/ldap_child %{_libexecdir}/%{servicename}/krb5_child %files krb5 -f sssd_krb5.lang -- 1.9.3