On 10/15/2014 10:24 PM, Jakub Hrozek wrote:
0006-SYSDB-Allow-calling-chown-on-the-sysdb-file-from-mon.patch

From 15386564a33d1461918b3f03a6eee0138a690055 Mon Sep 17 00:00:00 2001
From: Michal Zidek <mzidek@redhat.com>
Date: Thu, 9 Oct 2014 17:21:30 +0200
Subject: [PATCH 6/7] SYSDB: Allow calling chown on the sysdb file from monitor

Sysdb must be accessible for the nonroot sssd
processes.
---
 src/db/sysdb.c        | 17 +++++++++++++++++
 src/db/sysdb.h        |  9 +++++++++
 src/monitor/monitor.c |  3 ++-
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/src/db/sysdb.c b/src/db/sysdb.c
index 88cff241fab9022c3fed45dbb409393dbe01a590..2a7d38b372c4cbd69311d03f7cb5ca98f7057d19 100644
--- a/src/db/sysdb.c
+++ b/src/db/sysdb.c
@@ -1286,6 +1286,16 @@ int sysdb_init(TALLOC_CTX *mem_ctx,
                struct sss_domain_info *domains,
                bool allow_upgrade)
 {
+    return sysdb_init_ext(mem_ctx, domains, allow_upgrade, false, 0, 0);
+}
+
+int sysdb_init_ext(TALLOC_CTX *mem_ctx,
+                   struct sss_domain_info *domains,
+                   bool allow_upgrade,
+                   bool chown_dbfile,
+                   uid_t uid,
+                   gid_t gid)
+{
     struct sss_domain_info *dom;
     struct sysdb_ctx *sysdb;
     int ret;
@@ -1307,6 +1317,13 @@ int sysdb_init(TALLOC_CTX *mem_ctx,
             return ret;
         }
 
+        if (chown_dbfile) {
+            chown(sysdb->ldb_file, uid, gid);

missing check on return value?

+            if (ret != EOK) {
+                return ret;
+            }
+        }
+
         dom->sysdb = talloc_move(dom, &sysdb);
     }
 
diff --git a/src/db/sysdb.h b/src/db/sysdb.h
index c93119cf15a6ed0e2b0f026a67ab48e926151a0b..dfef1b5857c024e4a4c06d828650586acc33cc6f 100644
--- a/src/db/sysdb.h
+++ b/src/db/sysdb.h
@@ -418,6 +418,15 @@ errno_t sysdb_update_ranges(struct sysdb_ctx *sysdb,
 int sysdb_init(TALLOC_CTX *mem_ctx,
                struct sss_domain_info *domains,
                bool allow_upgrade);
+
+/* Same as sysdb_init, but additionally allows to change
+ * file ownership of the sysdb databases. */
+int sysdb_init_ext(TALLOC_CTX *mem_ctx,
+                   struct sss_domain_info *domains,
+                   bool allow_upgrade,
+                   bool chown_dbfile,
+                   uid_t uid, gid_t gid);
+
 /* used to initialize only one domain database.
  * Do NOT use if sysdb_init has already been called */
 int sysdb_domain_init(TALLOC_CTX *mem_ctx,
diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
index bd2c373008ef75ab46cf7dccdefd12468894f1ba..19f0db0830353015fb240033414f1d9b4ffc7dc0 100644
--- a/src/monitor/monitor.c
+++ b/src/monitor/monitor.c
@@ -2332,7 +2332,8 @@ static int monitor_process_init(struct mt_ctx *ctx,
     if (!tmp_ctx) {
         return ENOMEM;
     }
-    ret = sysdb_init(tmp_ctx, ctx->domains, true);
+    ret = sysdb_init_ext(tmp_ctx, ctx->domains, true,
+                         true, ctx->uid, ctx->gid);
     if (ret != EOK) {
         SYSDB_VERSION_ERROR_DAEMON(ret);
         return ret;
-- 1.9.3