On (26/08/16 15:18), Jakub Hrozek wrote:
>On Fri, Aug 26, 2016 at 03:17:07PM +0200, Jakub Hrozek wrote:
>> On Fri, Aug 26, 2016 at 10:23:59AM +0200, Jakub Hrozek wrote:
>> > On Fri, Aug 19, 2016 at 12:30:40PM +0200, Lukas Slebodnik wrote:
>> > > ehlo,
>> > >
>> > > Root can read anything from any directory even with permissions 000.
>> > >
>> > > However SELinux checks discretionary access control (DAC)
>> > > and deny access if access is not allowed for root by DAC.
>> > > The pam_sss use different unix socket /var/lib/sss/pipes/private/pam
>> > > for user with uid 0. Therefore root need to be able read content
>> > > of directory with private pipes.
>> > >
>> > > type=AVC msg=audit(08/19/2016 10:58:34.081:3369) : avc: denied
>> > > { dac_read_search } for pid=20257 comm=vsftpd
capability=dac_read_search
>> > > scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
>> > > tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability
>> > >
>> > > type=AVC msg=audit(08/19/2016 10:58:34.081:3369) : avc: denied
>> > > { dac_override } for pid=20257 comm=vsftpd capability=dac_override
>> > > scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
>> > > tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability
>> > >
>> > > LS
>> >
>> > ACK, will push when CI finishes.
>>
>> CI:
http://sssd-ci.duckdns.org/logs/job/52/41/summary.html
>>
>> * master: f49724cd6b3e0e3274302c3d475e93f7a7094f40
>
>hmm, do we want to fix this issue in 1.13 as well?
We can it's a oneliner :-)
Ahh, I forgot that it was not just a spec file change
but also the same change in makefile.
sssd-1-13:
* 69bd842b046f7b53aef0cc03f2cb68a41068fa2e
LS