To test, run: rpm -qf /var/lib/sss/secrets/ the directory was unowned before and should be owned by sssd-common now.
On Tue, Aug 16, 2016 at 05:01:55PM +0200, Jakub Hrozek wrote:
To test, run: rpm -qf /var/lib/sss/secrets/ the directory was unowned before and should be owned by sssd-common now.
CI: http://sssd-ci.duckdns.org/logs/job/51/74/summary.html
By the way Fabiano asked on IRC why I owned the directory as root.root and not sssd.sssd. The reasons are: - this is compatible with how the SECDB directory is created in Makefile.am - we never tested (AFAIK) the secrets responder as non-root - the secrets should be accessible to root mostly anyway
Jakub,
On Tue, Aug 16, 2016 at 8:29 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Tue, Aug 16, 2016 at 05:01:55PM +0200, Jakub Hrozek wrote:
To test, run: rpm -qf /var/lib/sss/secrets/ the directory was unowned before and should be owned by sssd-common now.
CI: http://sssd-ci.duckdns.org/logs/job/51/74/summary.html
By the way Fabiano asked on IRC why I owned the directory as root.root and not sssd.sssd. The reasons are: - this is compatible with how the SECDB directory is created in Makefile.am - we never tested (AFAIK) the secrets responder as non-root - the secrets should be accessible to root mostly anyway _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org
I wonder if your patch also doesn't solve: https://fedorahosted.org/sssd/ticket/3125 Can you check and, if it does, mention it in the commit message?
Best Regards, -- Fabiano Fidêncio
On Wed, Aug 17, 2016 at 12:23:17PM +0200, Fabiano Fidêncio wrote:
Jakub,
On Tue, Aug 16, 2016 at 8:29 PM, Jakub Hrozek jhrozek@redhat.com wrote:
On Tue, Aug 16, 2016 at 05:01:55PM +0200, Jakub Hrozek wrote:
To test, run: rpm -qf /var/lib/sss/secrets/ the directory was unowned before and should be owned by sssd-common now.
CI: http://sssd-ci.duckdns.org/logs/job/51/74/summary.html
By the way Fabiano asked on IRC why I owned the directory as root.root and not sssd.sssd. The reasons are: - this is compatible with how the SECDB directory is created in Makefile.am - we never tested (AFAIK) the secrets responder as non-root - the secrets should be accessible to root mostly anyway _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org
I wonder if your patch also doesn't solve: https://fedorahosted.org/sssd/ticket/3125 Can you check and, if it does, mention it in the commit message?
No, that's a separate bug.
On (16/08/16 17:01), Jakub Hrozek wrote:
To test, run: rpm -qf /var/lib/sss/secrets/ the directory was unowned before and should be owned by sssd-common now.
From a398c91ef196be680f6c2d5b2d5251e060005ec0 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek jhrozek@redhat.com Date: Tue, 16 Aug 2016 16:45:36 +0200 Subject: [PATCH] SPEC: Own the secrets DB path
contrib/sssd.spec.in | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b58eebba54a82a041f72507b430ceca708a34632..05bb83b57015da5e730dd9b0d9eae5d760596597 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -106,6 +106,7 @@ Requires: python-sssdconfig = %{version}-%{release} %global mcpath %{sssdstatedir}/mc %global pubconfpath %{sssdstatedir}/pubconf %global gpocachepath %{sssdstatedir}/gpo_cache +%global secdbpath %{sssdstatedir}/secrets
### Build Dependencies ###
@@ -619,6 +620,7 @@ autoreconf -ivf --with-pubconf-path=%{pubconfpath} \ --with-gpo-cache-path=%{gpocachepath} \ --with-init-dir=%{_initrddir} \
- --with-secrets-db-path=%{secdbpath} \
Is there a reason to call configure with this option? "%{secdbpath}" is already a default.
--with-krb5-rcache-dir=%{_localstatedir}/cache/krb5rcache \ --enable-nsslibdir=/%{_lib} \ --enable-pammoddir=/%{_lib}/security \@@ -785,6 +787,7 @@ done %dir %{_localstatedir}/cache/krb5rcache %attr(700,sssd,sssd) %dir %{dbpath} %attr(755,sssd,sssd) %dir %{mcpath} +%attr(700,root,root) %dir %{secdbpath} %ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/passwd %ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/group %ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/initgroups -- 2.4.11
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org
On Wed, Aug 17, 2016 at 09:40:38AM +0200, Lukas Slebodnik wrote:
On (16/08/16 17:01), Jakub Hrozek wrote:
To test, run: rpm -qf /var/lib/sss/secrets/ the directory was unowned before and should be owned by sssd-common now.
From a398c91ef196be680f6c2d5b2d5251e060005ec0 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek jhrozek@redhat.com Date: Tue, 16 Aug 2016 16:45:36 +0200 Subject: [PATCH] SPEC: Own the secrets DB path
contrib/sssd.spec.in | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b58eebba54a82a041f72507b430ceca708a34632..05bb83b57015da5e730dd9b0d9eae5d760596597 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -106,6 +106,7 @@ Requires: python-sssdconfig = %{version}-%{release} %global mcpath %{sssdstatedir}/mc %global pubconfpath %{sssdstatedir}/pubconf %global gpocachepath %{sssdstatedir}/gpo_cache +%global secdbpath %{sssdstatedir}/secrets
### Build Dependencies ###
@@ -619,6 +620,7 @@ autoreconf -ivf --with-pubconf-path=%{pubconfpath} \ --with-gpo-cache-path=%{gpocachepath} \ --with-init-dir=%{_initrddir} \
- --with-secrets-db-path=%{secdbpath} \
Is there a reason to call configure with this option? "%{secdbpath}" is already a default.
No, I just wanted to be consistent with how we set the other paths, like gpo cache or even the db, that's all.
I'm fine with dropping this line if you prefer.
On Wed, Aug 17, 2016 at 09:47:36AM +0200, Jakub Hrozek wrote:
On Wed, Aug 17, 2016 at 09:40:38AM +0200, Lukas Slebodnik wrote:
On (16/08/16 17:01), Jakub Hrozek wrote:
To test, run: rpm -qf /var/lib/sss/secrets/ the directory was unowned before and should be owned by sssd-common now.
From a398c91ef196be680f6c2d5b2d5251e060005ec0 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek jhrozek@redhat.com Date: Tue, 16 Aug 2016 16:45:36 +0200 Subject: [PATCH] SPEC: Own the secrets DB path
contrib/sssd.spec.in | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b58eebba54a82a041f72507b430ceca708a34632..05bb83b57015da5e730dd9b0d9eae5d760596597 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -106,6 +106,7 @@ Requires: python-sssdconfig = %{version}-%{release} %global mcpath %{sssdstatedir}/mc %global pubconfpath %{sssdstatedir}/pubconf %global gpocachepath %{sssdstatedir}/gpo_cache +%global secdbpath %{sssdstatedir}/secrets
### Build Dependencies ###
@@ -619,6 +620,7 @@ autoreconf -ivf --with-pubconf-path=%{pubconfpath} \ --with-gpo-cache-path=%{gpocachepath} \ --with-init-dir=%{_initrddir} \
- --with-secrets-db-path=%{secdbpath} \
Is there a reason to call configure with this option? "%{secdbpath}" is already a default.
No, I just wanted to be consistent with how we set the other paths, like gpo cache or even the db, that's all.
I'm fine with dropping this line if you prefer.
OK, attached is a patch w/o the explicit configure line.
On (17/08/16 13:48), Jakub Hrozek wrote:
On Wed, Aug 17, 2016 at 09:47:36AM +0200, Jakub Hrozek wrote:
On Wed, Aug 17, 2016 at 09:40:38AM +0200, Lukas Slebodnik wrote:
On (16/08/16 17:01), Jakub Hrozek wrote:
To test, run: rpm -qf /var/lib/sss/secrets/ the directory was unowned before and should be owned by sssd-common now.
From a398c91ef196be680f6c2d5b2d5251e060005ec0 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek jhrozek@redhat.com Date: Tue, 16 Aug 2016 16:45:36 +0200 Subject: [PATCH] SPEC: Own the secrets DB path
contrib/sssd.spec.in | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b58eebba54a82a041f72507b430ceca708a34632..05bb83b57015da5e730dd9b0d9eae5d760596597 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -106,6 +106,7 @@ Requires: python-sssdconfig = %{version}-%{release} %global mcpath %{sssdstatedir}/mc %global pubconfpath %{sssdstatedir}/pubconf %global gpocachepath %{sssdstatedir}/gpo_cache +%global secdbpath %{sssdstatedir}/secrets
### Build Dependencies ###
@@ -619,6 +620,7 @@ autoreconf -ivf --with-pubconf-path=%{pubconfpath} \ --with-gpo-cache-path=%{gpocachepath} \ --with-init-dir=%{_initrddir} \
- --with-secrets-db-path=%{secdbpath} \
Is there a reason to call configure with this option? "%{secdbpath}" is already a default.
No, I just wanted to be consistent with how we set the other paths, like gpo cache or even the db, that's all.
I'm fine with dropping this line if you prefer.
OK, attached is a patch w/o the explicit configure line.
From f7a69a27b11186d03e080f75b879067e395fdec8 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek jhrozek@redhat.com Date: Tue, 16 Aug 2016 16:45:36 +0200 Subject: [PATCH] SPEC: Own the secrets DB path
contrib/sssd.spec.in | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b58eebba54a82a041f72507b430ceca708a34632..ec0ab2d1aac59f511a0edf383c9cb91d40e970f6 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -106,6 +106,7 @@ Requires: python-sssdconfig = %{version}-%{release} %global mcpath %{sssdstatedir}/mc %global pubconfpath %{sssdstatedir}/pubconf %global gpocachepath %{sssdstatedir}/gpo_cache +%global secdbpath %{sssdstatedir}/secrets
### Build Dependencies ###
@@ -785,6 +786,7 @@ done %dir %{_localstatedir}/cache/krb5rcache %attr(700,sssd,sssd) %dir %{dbpath} %attr(755,sssd,sssd) %dir %{mcpath} +%attr(700,root,root) %dir %{secdbpath} %ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/passwd %ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/group %ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/initgroups -- 2.4.11
http://sssd-ci.duckdns.org/logs/job/51/85/summary.html
ACK++
LS
On Wed, Aug 17, 2016 at 03:41:54PM +0200, Lukas Slebodnik wrote:
On (17/08/16 13:48), Jakub Hrozek wrote:
On Wed, Aug 17, 2016 at 09:47:36AM +0200, Jakub Hrozek wrote:
On Wed, Aug 17, 2016 at 09:40:38AM +0200, Lukas Slebodnik wrote:
On (16/08/16 17:01), Jakub Hrozek wrote:
To test, run: rpm -qf /var/lib/sss/secrets/ the directory was unowned before and should be owned by sssd-common now.
From a398c91ef196be680f6c2d5b2d5251e060005ec0 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek jhrozek@redhat.com Date: Tue, 16 Aug 2016 16:45:36 +0200 Subject: [PATCH] SPEC: Own the secrets DB path
contrib/sssd.spec.in | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b58eebba54a82a041f72507b430ceca708a34632..05bb83b57015da5e730dd9b0d9eae5d760596597 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -106,6 +106,7 @@ Requires: python-sssdconfig = %{version}-%{release} %global mcpath %{sssdstatedir}/mc %global pubconfpath %{sssdstatedir}/pubconf %global gpocachepath %{sssdstatedir}/gpo_cache +%global secdbpath %{sssdstatedir}/secrets
### Build Dependencies ###
@@ -619,6 +620,7 @@ autoreconf -ivf --with-pubconf-path=%{pubconfpath} \ --with-gpo-cache-path=%{gpocachepath} \ --with-init-dir=%{_initrddir} \
- --with-secrets-db-path=%{secdbpath} \
Is there a reason to call configure with this option? "%{secdbpath}" is already a default.
No, I just wanted to be consistent with how we set the other paths, like gpo cache or even the db, that's all.
I'm fine with dropping this line if you prefer.
OK, attached is a patch w/o the explicit configure line.
From f7a69a27b11186d03e080f75b879067e395fdec8 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek jhrozek@redhat.com Date: Tue, 16 Aug 2016 16:45:36 +0200 Subject: [PATCH] SPEC: Own the secrets DB path
contrib/sssd.spec.in | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index b58eebba54a82a041f72507b430ceca708a34632..ec0ab2d1aac59f511a0edf383c9cb91d40e970f6 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -106,6 +106,7 @@ Requires: python-sssdconfig = %{version}-%{release} %global mcpath %{sssdstatedir}/mc %global pubconfpath %{sssdstatedir}/pubconf %global gpocachepath %{sssdstatedir}/gpo_cache +%global secdbpath %{sssdstatedir}/secrets
### Build Dependencies ###
@@ -785,6 +786,7 @@ done %dir %{_localstatedir}/cache/krb5rcache %attr(700,sssd,sssd) %dir %{dbpath} %attr(755,sssd,sssd) %dir %{mcpath} +%attr(700,root,root) %dir %{secdbpath} %ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/passwd %ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/group %ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/initgroups -- 2.4.11
http://sssd-ci.duckdns.org/logs/job/51/85/summary.html
ACK++
* master: b72bf8cf70f8973d805c73a02ec681156ac9396d
sssd-devel@lists.fedorahosted.org
-
Fabiano Fidêncio -
Jakub Hrozek -
Lukas Slebodnik