On Fri, Apr 18, 2014 at 02:09:33PM +0200, Pavel Reichl wrote:
Hello,
we recently received following bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=1089098
Reporter is quite unhappy that setting access mode on sssd.conf to 0400
will result in SSSD's failure to start and error message requesting to
set access mode to 0600.
Does it matter what access mode is set for user if it is required that
user must be ROOT?
I didn't find out the original reason for requiring write permission for
user so it possible that it is needless. But I'm afraid that simple
changing the required access mode from 0600 to 0400 would cause failure
to start SSSD for users who upgrade SSSD to newer version.
Maybe we can allow both modes (0400 and 0600) but is it worth doing?
Thank you for your opinions.
I'll state the opinion I expressed in the bugzilla again -- we could
reverse the check and instead ensure that group and others have no
permission bits set, but I don't think it's worth doing, honestly.
Especially considering the tone the reporter chose in the bugzilla report.