On 10/15/2014 10:24 PM, Jakub Hrozek wrote:
0006-SYSDB-Allow-calling-chown-on-the-sysdb-file-from-mon.patch
From 15386564a33d1461918b3f03a6eee0138a690055 Mon Sep 17 00:00:00 2001
From: Michal Zidek<mzidek(a)redhat.com>
Date: Thu, 9 Oct 2014 17:21:30 +0200
Subject: [PATCH 6/7] SYSDB: Allow calling chown on the sysdb file from monitor
Sysdb must be accessible for the nonroot sssd
processes.
---
src/db/sysdb.c | 17 +++++++++++++++++
src/db/sysdb.h | 9 +++++++++
src/monitor/monitor.c | 3 ++-
3 files changed, 28 insertions(+), 1 deletion(-)
diff --git a/src/db/sysdb.c b/src/db/sysdb.c
index 88cff241fab9022c3fed45dbb409393dbe01a590..2a7d38b372c4cbd69311d03f7cb5ca98f7057d19
100644
--- a/src/db/sysdb.c
+++ b/src/db/sysdb.c
@@ -1286,6 +1286,16 @@ int sysdb_init(TALLOC_CTX *mem_ctx,
struct sss_domain_info *domains,
bool allow_upgrade)
{
+ return sysdb_init_ext(mem_ctx, domains, allow_upgrade, false, 0, 0);
+}
+
+int sysdb_init_ext(TALLOC_CTX *mem_ctx,
+ struct sss_domain_info *domains,
+ bool allow_upgrade,
+ bool chown_dbfile,
+ uid_t uid,
+ gid_t gid)
+{
struct sss_domain_info *dom;
struct sysdb_ctx *sysdb;
int ret;
@@ -1307,6 +1317,13 @@ int sysdb_init(TALLOC_CTX *mem_ctx,
return ret;
}
+ if (chown_dbfile) {
+ chown(sysdb->ldb_file, uid, gid);
missing check on return value?
+ if (ret != EOK) {
+ return ret;
+ }
+ }
+
dom->sysdb = talloc_move(dom, &sysdb);
}
diff --git a/src/db/sysdb.h b/src/db/sysdb.h
index c93119cf15a6ed0e2b0f026a67ab48e926151a0b..dfef1b5857c024e4a4c06d828650586acc33cc6f
100644
--- a/src/db/sysdb.h
+++ b/src/db/sysdb.h
@@ -418,6 +418,15 @@ errno_t sysdb_update_ranges(struct sysdb_ctx *sysdb,
int sysdb_init(TALLOC_CTX *mem_ctx,
struct sss_domain_info *domains,
bool allow_upgrade);
+
+/* Same as sysdb_init, but additionally allows to change
+ * file ownership of the sysdb databases. */
+int sysdb_init_ext(TALLOC_CTX *mem_ctx,
+ struct sss_domain_info *domains,
+ bool allow_upgrade,
+ bool chown_dbfile,
+ uid_t uid, gid_t gid);
+
/* used to initialize only one domain database.
* Do NOT use if sysdb_init has already been called */
int sysdb_domain_init(TALLOC_CTX *mem_ctx,
diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
index bd2c373008ef75ab46cf7dccdefd12468894f1ba..19f0db0830353015fb240033414f1d9b4ffc7dc0
100644
--- a/src/monitor/monitor.c
+++ b/src/monitor/monitor.c
@@ -2332,7 +2332,8 @@ static int monitor_process_init(struct mt_ctx *ctx,
if (!tmp_ctx) {
return ENOMEM;
}
- ret = sysdb_init(tmp_ctx, ctx->domains, true);
+ ret = sysdb_init_ext(tmp_ctx, ctx->domains, true,
+ true, ctx->uid, ctx->gid);
if (ret != EOK) {
SYSDB_VERSION_ERROR_DAEMON(ret);
return ret;
-- 1.9.3