>From 11c1db91ba9d036f73167b2d74012d3f0ada60fd Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Sat, 11 Oct 2014 20:22:42 +0200 Subject: [PATCH 1/4] BUILD: Install ldap_child and as setuid if running under non-privileged user The ldap_child permissions should be 4750, owned by root.sssd, to make sure only root and sssd can execute the child and if executed by sssd, the child will run as root. --- Makefile.am | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Makefile.am b/Makefile.am index 61bf5cf957d4024b67f48cf42f5735b5fa368945..a913cc9c8206b8e95c6c16ff0beb09acefa1a606 100644 --- a/Makefile.am +++ b/Makefile.am @@ -2825,6 +2825,11 @@ else $(MKDIR_P) $(DESTDIR)$(initdir) endif +if SSSD_USER + chgrp $(SSSD_USER) $(sssdlibexecdir)/ldap_child + chmod 4750 $(sssdlibexecdir)/ldap_child +endif + install-data-hook: rm $(DESTDIR)/$(nsslibdir)/libnss_sss.so.2 \ $(DESTDIR)/$(nsslibdir)/libnss_sss.so -- 1.9.3