Title: #183: More socket-activation fixes
lslebodn commented:
"""
On (10/03/17 09:45), fidencio wrote:
On Fri, Mar 10, 2017 at 5:54 PM, lslebodn
<notifications(a)github.com> wrote:
> On (10/03/17 05:50), fidencio wrote:
> >@sgallah, @lslebodn
> >
> >On Fri, Mar 10, 2017 at 2:22 PM, Stephen Gallagher <
> notifications(a)github.com
> >> wrote:
> >
> >> @lslebodn <
https://github.com/lslebodn>
> >>
> >> @sgallagher <
https://github.com/sgallagher> The purpose of calling
> chown
> >> in ExecStartPre is to allow starting responders as non-privileged from
> >> beginning. Systemd drops permissions before exec.
> >>
> >> Yeah, I get that. And I told @fidencio <
https://github.com/fidencio>
on
> >> IRC that we can live with the TOCTOU for the time being and figure out a
> >> better option later. That said, we cannot use /usr/bin/chown for this,
> >> because it unconditionally calls getpwnam()/getpwuid() in its execution,
> >> which causes a problem when socket-activating. I suggested that we might
> >> want to just create a reduced-functionality /usr/libexec/sssd/sss_chown
> >> that calls only the low-level system function.
> >>
> >
> >Well, considering we write our own sss_chown binary ... as we still don't
> >have a static uid for the sssd user we would end up calling
> >getpwnam()/getpwuid() for the unprivileged user.
> >
> we can call "getpwnam()/getpwuid()" in responders except
> sssd-nss (and monitor).
>
We can, for sure.
However, as far as I understand, @sgallagh would like to avoid SSSD having
a circular dependency.
There is not any circullar dependency between responders.
e.g. sssd-nss -> sssd-pam -> sssd-nss
If yes then please describe them.
LS
"""
See the full comment at