>From 8e75f70c8bd50d6f0ec509bd88f7d1c6a43b5d0e Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Fri, 24 Oct 2014 22:44:17 +0200 Subject: [PATCH 1/6] BUILD: Install krb5_child as suid if running under non-privileged user If sssd_be is running unprivileged, then krb5_child must be setuid to be able to access the keytab and become arbitrary user. --- Makefile.am | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Makefile.am b/Makefile.am index b53ec2fc533a118f2aa1306ecaeb96a70c9869ea..fc970e4877bf96ca0d26364e35e032d282e22531 100644 --- a/Makefile.am +++ b/Makefile.am @@ -2853,8 +2853,10 @@ endif if SSSD_USER chgrp $(SSSD_USER) $(sssdlibexecdir)/ldap_child chgrp $(SSSD_USER) $(sssdlibexecdir)/selinux_child + chgrp $(SSSD_USER) $(sssdlibexecdir)/krb5_child chmod 4750 $(sssdlibexecdir)/ldap_child chmod 4750 $(sssdlibexecdir)/selinux_child + chmod 4750 $(sssdlibexecdir)/krb5_child endif install-data-hook: -- 1.9.3