On Tue, 25 Nov 2014 12:44:01 +0100
Pavel Březina <pbrezina(a)redhat.com> wrote:
On 11/25/2014 10:41 AM, Jakub Hrozek wrote:
> On Mon, Nov 24, 2014 at 07:28:56PM -0500, Stephen Gallagher wrote:
>>>> Why exactly would it need to be chown()ed? I'm unclear on that
>>>> point. Presumably, SSSD is still being launched as root and then
>>>> dropping privileges (otherwise it wouldn't be able to perform
>>>> the chown). So to me it seems like it makes sense to just open
>>>> the file read-only prior to dropping privileges, then pass the
>>>> filehandle along.
>>> Passing a fd would be best, but infortunately the augeas API we
>>> use to change the configuration only works with path names ...
>> Hmm, that seems problematic and racy. There's no way for augeas to
>> take a descriptor? That seems like a pretty big oversight.
> I didn't see a way for the aug_* functions to accept a fd. I can
> ask on the upstream devel list -- or Pavel could, given he's more
> involved in using augeas than me.
AFAIK augeas can't do this, unfortunately. But it would be nice RFE.
I was suggested to try aug_text_retrieve/store when we would
basically read the config file ourselves and push it into augeas. But
that doesn't sound very comfy.
Actually it is not a nice RFE, it makes changing the file racy and
Most flat file based configuration is changed by writing a new file and
then atomically rename it.
And this is also the reason why I do not see any difficulty in keeping
the file as root.root, we do not even need a setuid helper to create
a new file. Just write a new one as sssd.sssd then ask the monitor to
atomically rename it on top of the existing one (the monitor runs as
root), change the perms to root.root and regenerate the confdb (as
long as we do this).
Simo Sorce * Red Hat, Inc * New York