>From a7d9e32cbcf3fc79c677632063bff7a0d1518ff1 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Sat, 11 Oct 2014 20:22:42 +0200 Subject: [PATCH 1/6] BUILD: Install ldap_child and krb5_child as setuid if running under non-privileged user The krb5_child and ldap_child permissions should be 4750, owned by root.sssd, to make sure only root and sssd can execute the child and if executed by sssd, the child will run as root. --- Makefile.am | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Makefile.am b/Makefile.am index 9fe0880109ff6fa72cf5b428f0ba7936cc5702f0..083837e4894c0bf3875ab09893cdc69903c10e06 100644 --- a/Makefile.am +++ b/Makefile.am @@ -2806,6 +2806,13 @@ else $(MKDIR_P) $(DESTDIR)$(initdir) endif +if SSSD_USER + chgrp $(SSSD_USER) $(sssdlibexecdir)/ldap_child + chgrp $(SSSD_USER) $(sssdlibexecdir)/krb5_child + chmod 4750 $(sssdlibexecdir)/ldap_child + chmod 4750 $(sssdlibexecdir)/krb5_child +endif + install-data-hook: rm $(DESTDIR)/$(nsslibdir)/libnss_sss.so.2 \ $(DESTDIR)/$(nsslibdir)/libnss_sss.so -- 1.9.3