On 11/25/2014 10:41 AM, Jakub Hrozek wrote:
On Mon, Nov 24, 2014 at 07:28:56PM -0500, Stephen Gallagher wrote:
>>> Why exactly would it need to be chown()ed? I'm unclear on that point.
>>> Presumably, SSSD is still being launched as root and then dropping
>>> privileges (otherwise it wouldn't be able to perform the chown). So to
>>> me it seems like it makes sense to just open the file read-only prior to
>>> dropping privileges, then pass the filehandle along.
>>
>> Passing a fd would be best, but infortunately the augeas API we use to
>> change the configuration only works with path names ...
>
> Hmm, that seems problematic and racy. There's no way for augeas to take
> a descriptor? That seems like a pretty big oversight.
I didn't see a way for the aug_* functions to accept a fd. I can ask on
the upstream devel list -- or Pavel could, given he's more involved in
using augeas than me.
AFAIK augeas can't do this, unfortunately. But it would be nice RFE.
I was suggested to try aug_text_retrieve/store when we would basically
read the config file ourselves and push it into augeas. But that doesn't
sound very comfy.