>From 130eff379725ddacc82bd843594ae284745735d1 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Mon, 20 Oct 2014 13:59:49 +0200 Subject: [PATCH 2/6] SSSD: Chown the log files We need to chown the log files before dropping root to make sure they are usable by the SSSD user. Unfortunately, we can't just rely on passing the fd opened by root, because we need to be also able to rotate the log files. --- src/util/debug.c | 33 +++++++++++++++++++++++++++++++++ src/util/server.c | 6 ++++++ src/util/util.h | 1 + 3 files changed, 40 insertions(+) diff --git a/src/util/debug.c b/src/util/debug.c index a99d5403a238f125010b9b309355b30f9f528c44..41375709170abe33b0c7fd90e3b1244299ed0241 100644 --- a/src/util/debug.c +++ b/src/util/debug.c @@ -297,6 +297,39 @@ void ldb_debug_messages(void *context, enum ldb_debug_level level, free(message); } +/* In cases SSSD used to run as the root user, but runs as the SSSD user now, + * we need to chown the log files + */ +int chown_debug_file(const char *filename, + uid_t uid, gid_t gid) +{ + char *logpath; + const char *log_file; + errno_t ret; + + if (filename == NULL) { + log_file = debug_log_file; + } else { + log_file = filename; + } + + ret = asprintf(&logpath, "%s/%s.log", LOG_PATH, log_file); + if (ret == -1) { + return ENOMEM; + } + + ret = chown(logpath, uid, gid); + free(logpath); + if (ret != 0) { + ret = errno; + DEBUG(SSSDBG_FATAL_FAILURE, "chown failed for [%s]: [%d]\n", + log_file, ret); + return ret; + } + + return EOK; +} + int open_debug_file_ex(const char *filename, FILE **filep, bool want_cloexec) { FILE *f = NULL; diff --git a/src/util/server.c b/src/util/server.c index 3a84dee0cee06cb98c94a1d57209c2bcf7c4340a..a908470cdcf2cb85a6742e44905ae12d136c83d5 100644 --- a/src/util/server.c +++ b/src/util/server.c @@ -427,6 +427,12 @@ int server_setup(const char *name, int flags, struct tevent_signal *tes; struct logrotate_ctx *lctx; + ret = chown_debug_file(NULL, uid, gid); + if (ret != EOK) { + DEBUG(SSSDBG_MINOR_FAILURE, + "Cannot chown the debug files, debugging might not work!\n"); + } + ret = become_user(uid, gid); if (ret != EOK) { DEBUG(SSSDBG_FUNC_DATA, diff --git a/src/util/util.h b/src/util/util.h index 544ca02aef5095ca89deb688f309462d22d02d9c..2a7934234f083d49706ee983af770d6157328dec 100644 --- a/src/util/util.h +++ b/src/util/util.h @@ -218,6 +218,7 @@ errno_t set_debug_file_from_fd(const int fd); /* From debug.c */ void ldb_debug_messages(void *context, enum ldb_debug_level level, const char *fmt, va_list ap); +int chown_debug_file(const char *filename, uid_t uid, gid_t gid); int open_debug_file_ex(const char *filename, FILE **filep, bool want_cloexec); int open_debug_file(void); int rotate_debug_files(void); -- 1.9.3