On Sat, 2014-04-19 at 17:23 -0400, Simo Sorce wrote:
> On Sat, 2014-04-19 at 13:31 -0400, Dmitri Pal wrote:
> > On 04/19/2014 12:42 PM, Rowland Penny wrote:
> > > On 19/04/14 17:18, Dmitri Pal wrote:
> > >> On 04/18/2014 10:39 AM, Jakub Hrozek wrote:
> > >>> On Fri, Apr 18, 2014 at 02:09:33PM +0200, Pavel Reichl wrote:
> > >>>> Hello,
> > >>>>
> > >>>> we recently received following bugzilla:
> > >>>>
https://bugzilla.redhat.com/show_bug.cgi?id=1089098
> > >>>>
> > >>>> Reporter is quite unhappy that setting access mode on
sssd.conf to
> > >>>> 0400
> > >>>> will result in SSSD's failure to start and error message
requesting to
> > >>>> set access mode to 0600.
> > >>>>
> > >>>> Does it matter what access mode is set for user if it is
required that
> > >>>> user must be ROOT?
> > >>>>
> > >>>> I didn't find out the original reason for requiring write
> > >>>> permission for
> > >>>> user so it possible that it is needless. But I'm afraid
that simple
> > >>>> changing the required access mode from 0600 to 0400 would
cause
> > >>>> failure
> > >>>> to start SSSD for users who upgrade SSSD to newer version.
> > >>>>
> > >>>> Maybe we can allow both modes (0400 and 0600) but is it worth
doing?
> > >>>>
> > >>>> Thank you for your opinions.
> > >>> I'll state the opinion I expressed in the bugzilla again -- we
could
> > >>> reverse the check and instead ensure that group and others have
no
> > >>> permission bits set, but I don't think it's worth doing,
honestly.
> > >>>
> > >>> Especially considering the tone the reporter chose in the bugzilla
> > >>> report.
> > >>> _______________________________________________
> > >>> sssd-devel mailing list
> > >>> sssd-devel(a)lists.fedorahosted.org
> > >>>
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> > >>
> > >>
> > >> Let us focus on the core of the problem not on how it was conveyed.
> > >> I think the reporter is right. I should not matter whether the file
> > >> is writable by owner.
> > >> The tone of the bug is a different problem and while I agree that the
> > >> issue was expressed not in the best words it is still an issue.
> > >>
> > >>
> > >>
> > > Can I offer my opinion here?
> > >
> > > As long as the owner is root:root even if the permissions are 0400,
> > > root can still write to the file, so does it really matter if the
> > > permissions are 0600 or 0400 ? nobody else can read the file (or write
> > > to it) whatever the owners permissions are.
> > >
> > > As for the tone of that bug report, well I think he needs a lesson in
> > > manners.
> >
> > I agree with the above so I think
> > 1) We should ignore the difference between 0600 and 0400 and start in
> > both cases
>
> Patches attached.
>
> Tested only with make check though.
>
> > 2) Is teaching lessons what we are best at? ;-) Is it what we really
> > should do? I would just give a sight and move on. Life is the best
> > teacher...
>
> Just ignore rude people ...
>
>
> Btw: In master sbus_tests and sbus_codegen_tests, seem to be failing for
> me, but it is not related to these 2 patches.
>
> Simo.
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
Hello,
I tested the patches and they seem to me to be working flawlessly (so
ACK to both).
Pushed to master:
a5f79cce8abc74beec0c27c477c046bb6cbe7101
9a592ee3fc195f20732c6b1f90894a0be25ccc19