>From d607d5c4baaba142a7e1fddd62a333e84091f6e9 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Sun, 21 Sep 2014 13:52:05 +0200 Subject: [PATCH 7/7] NSS: Run as a user specified by monitor Adds the NSS responder to the list of services known to work as a non-root user and becomes the specified user after starting the NSS responder. --- src/monitor/monitor.c | 3 +++ src/responder/nss/nsssrv.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c index 19f0db0830353015fb240033414f1d9b4ffc7dc0..8d8a1392628b505a6d61c4e82a32cbfdcac9e90e 100644 --- a/src/monitor/monitor.c +++ b/src/monitor/monitor.c @@ -1084,6 +1084,9 @@ static errno_t get_ping_config(struct mt_ctx *ctx, const char *path, */ static bool svc_supported_as_nonroot(const char *svc_name) { + if (strcmp(svc_name, "nss") == 0) { + return true; + } return false; } diff --git a/src/responder/nss/nsssrv.c b/src/responder/nss/nsssrv.c index 420fd3d316959a67737f23e9a8b3d1c797583ea3..dbbdb4f844410eabe01f184ccdf8d9deb41833f4 100644 --- a/src/responder/nss/nsssrv.c +++ b/src/responder/nss/nsssrv.c @@ -568,7 +568,8 @@ int main(int argc, const char *argv[]) /* set up things like debug, signals, daemonization, etc... */ debug_log_file = "sssd_nss"; - ret = server_setup("sssd[nss]", 0, 0, 0, CONFDB_NSS_CONF_ENTRY, &main_ctx); + ret = server_setup("sssd[nss]", 0, uid, gid, CONFDB_NSS_CONF_ENTRY, + &main_ctx); if (ret != EOK) return 2; ret = die_if_parent_died(); -- 1.9.3