On Tue, Nov 17, 2015 at 10:41:57AM +0100, Jakub Hrozek wrote:
On Tue, Nov 10, 2015 at 12:03:56PM +0100, Sumit Bose wrote:
> Hi,
>
> this patch removes the requirement to install p11_child with SETUID or
> SETGID bit set. The needed privileges can be tuned with the help of
> policy-kit so p11_child can either run as root or as SSSD user depending
> on the SSSD configuration without the need to gain extra user or group
> privileges.
>
> With this patch the needed policy-kit configuration snippet is created
> if the --with-sssd-user configure option is used. Since the contributed
> spec file implicitly assumes that the SSSD user is 'sssd' I added the
> option here. I added 'Requires: polkit' as well to make sure
> %{_datadir}/polkit-1/rules.d/ exists. This might not be the best
> solution for minimal installations where e.g. only the SSSD LDAP
> provider is needed. But distribution can modify it to suit their needs.
> I did it this way because I'm not sure if all distribution allow
> directories to be owned by multiple packages. If someone can confirm
> that this is allowed by the majority of the distribution I'd be happy to
> modify the patch so that the directory is created and owned by the SSSD
> package and drop the polkit requirement.
I think all major RPM-based distributions use RPM from
rpm.org which
allows this for quite some time.
I don't think we need to worry too much here, the contrib/sssd.spec.in
file is Fedora-specific. We have a separate suse-specific specfile, but
I don't think it works (I think we might want to even remove it)
ok, great, then I'll drop the Requires.
>
> Since dropping the SETUID and SETGID bits improves the general security
> it would be nice if this patch can be include in 1.13.x so the
> distributions can pick it and improve already released packages.
>
> Unfortunately I think to test the functionality, i.e. access a Smartcard
> with p11_child as an unprivileged user, real hardware is needed.
Do you think it would be possible to test with Yubikey? If not, do you
know some cheap vendor that sells smartcards usable for testing?
If you have a Neo it might work, OpenSC should support it. As an
alternative you can setup a test VM where you would like to run the test
and then I can connect with spice and share a USB reader with an
inserted card.
> If you
> want to test it, please ping me, maybe we can arrange something.
>
> bye,
> Sumit
I like using polkit, but I also have some questions, see inline
> From 38fb2635aaec4dca335227d532965dfbadbca2ef Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose(a)redhat.com>
> Date: Fri, 30 Oct 2015 16:29:31 +0100
> Subject: [PATCH] p11: allow p11_child to run completely unprivileged
>
> To only operation of p11_child which requires special privileges is the
> communication to pcscd which handles the Smartcard access. pcscd uses
> policy-kit for access control so access can easily be configured by
> dropping config snippets into the right directory.
>
> If SSSD is configured to run as un-privileged user this patch creates
> the needed config snippet for policy-kit and installs it in a suitable
> directory. As a result p11_child does not have to be installed with
> SETUID or SETGID bits set.
>
> Resolves
https://fedorahosted.org/sssd/ticket/2755 by making it obsolete
> ---
> Makefile.am | 8 ++++----
> configure.ac | 1 +
> contrib/sssd-pcsc.rules.in | 15 +++++++++++++++
> contrib/sssd.spec.in | 6 +++++-
> src/p11_child/p11_child_nss.c | 27 ++++++---------------------
> 5 files changed, 31 insertions(+), 26 deletions(-)
> create mode 100644 contrib/sssd-pcsc.rules.in
>
> diff --git a/Makefile.am b/Makefile.am
> index
ee97d095e07f6d485232a1afd87f9e4057688f22..57bece64c5fca058dcf57efffb149770ac3b773e 100644
> --- a/Makefile.am
> +++ b/Makefile.am
> @@ -150,6 +150,10 @@ sssdlibexec_PROGRAMS += selinux_child
> endif
> if HAVE_NSS
> sssdlibexec_PROGRAMS += p11_child
> +if SSSD_USER
> +polkit_rulesdir = $(datadir)/polkit-1/rules.d
> +dist_polkit_rules_DATA = contrib/sssd-pcsc.rules
Since the polkit rules are something this patch uses undonditionally,
what do you mean by 'unconditionally'?
do you think they might fit better into src/p11_child?
Or did you put them into contrib because the polkit syntax changed to
the javascript-based one not too long ago and not all distributions
might be able to use it? (In that case, I wonder if we should change
p11_child being setuid conditionally)
yes, I wasn't sure if the config snippet works everywhere. Additionally
the polkit support in pcscd is configurable at build time so there might
be platforms where pcscd does not use polkit at all.
I would prefer to never set the setuid/gid bit on p11_child just to
remove the chance that it can be exploited to get higher privileges this
way. Otherwise we won't win anything with using polkit because we still
have to be specially careful for the setuid bit case. I think it would
be better to say that if you want to run SSSD as un-privileged user and
use Smartcard authentication you have to make sure that the SSSD user
can access pcscd to talk to the Smartcard.
In general, what is the oldest OS/release where you think the SC
functionality and the smartcard auth should work?
I guess RHEL/CentOS 6.
bye,
Sumit
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org