Just last nitpicks before I dive into testing:
Date: Tue, 5 Aug 2014 13:53:20 +0200
Subject: [PATCH 03/19] RPM: Change file ownership to sssd.sssd
Adds a private SSSD user in the %pre section of SSSD specfile. Also
changes the ownsership of SSSD private directories to sssd.sssd.
s/ownsership/ownership
Subject: [PATCH 05/19] SBUS: Chown the sbus socket if needed
[snip]
@@ -268,6 +269,17 @@ int sbus_new_server(TALLOC_CTX *mem_ctx,
}
}
+ if (stat_buf.st_uid != uid || stat_buf.st_gid != gid) {
+ ret = chown(filename, uid, gid);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "chown failed for [%s]: [%d][%s].\n", filename, errno,
+ strerror(errno));
It would be nice to not use errno directly as strerror() itself
may
change errno value.
Just calling ret = errno and passing ret to strerror() would make me happy.
You may also consider using sss_strerror instead of strerror.
+ ret = EIO;
+ goto done;
+ }
+ }
+
From a19db5f165a1d96fe159201df71b1b7d0f3aa1ff Mon Sep 17 00:00:00
2001
From: Michal Zidek <mzidek(a)redhat.com>
Date: Thu, 9 Oct 2014 17:15:56 +0200
Subject: [PATCH 08/19] MONITOR: Allow confdb to be accessed by nonroot
user
---
src/monitor/monitor.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
index
905e66f25601d155557487ae9c7eb6d3145d3a83..d430f96c5af9b45c9641d700d9fbcd3590bdaae6
100644
--- a/src/monitor/monitor.c
+++ b/src/monitor/monitor.c
@@ -1696,7 +1696,6 @@ static errno_t load_configuration(TALLOC_CTX
*mem_ctx,
DEBUG(SSSDBG_FATAL_FAILURE, "Fatal error initializing confdb\n");
goto done;
}
- talloc_zfree(cdb_file);
OK, cdf_file is used later in this function but still
it should be freed
in the end.
ret = confdb_init_db(config_file, ctx->cdb);
if (ret != EOK) {
@@ -1712,6 +1711,17 @@ static errno_t load_configuration(TALLOC_CTX
*mem_ctx,
goto done;
}
+ /* Allow configuration database to be accessible
+ * when SSSD runs as nonroot */
+ ret = chown(cdb_file, ctx->uid, ctx->gid);
+ if (ret != 0) {
+ ret = errno;
+ DEBUG(SSSDBG_FATAL_FAILURE,
+ "chown failed for [%s]: [%d][%s].\n",
+ cdb_file, ret, sss_strerror(ret));
+ goto done;
+ }
+
*monitor = ctx;
ret = EOK;
--
1.9.3
Subject: [PATCH 14/19] PAM: Create pipe file descriptors before
priviledges
are dropped
s/priviledges/privileges
@@ -347,6 +350,24 @@ int main(int argc, const char *argv[])
/* set up things like debug, signals, daemonization, etc... */
debug_log_file = "sssd_pam";
+ /* Crate pipe file descriptors here before priviledges are dropped
same typo
+ * in server_setup() */
+ ret = create_pipe_fd(SSS_PAM_SOCKET_NAME, &pipe_fd, 0111);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_FATAL_FAILURE,
+ "create_pipe_fd failed [%d]: %s.\n",
+ ret, sss_strerror(ret));
+ return 2;
+ }
+
+ ret = create_pipe_fd(SSS_PAM_PRIV_SOCKET_NAME, &priv_pipe_fd, 0177);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_FATAL_FAILURE,
+ "create_pipe_fd failed (priviledged pipe) [%d]: %s.\n",
same typo
+ ret, sss_strerror(ret));
+ return 2;
+ }