[SSSD] [sssd] user's write permission on sssd.conf
Jakub Hrozek
jhrozek at redhat.com
Fri Apr 18 14:39:43 UTC 2014
On Fri, Apr 18, 2014 at 02:09:33PM +0200, Pavel Reichl wrote:
> Hello,
>
> we recently received following bugzilla:
> https://bugzilla.redhat.com/show_bug.cgi?id=1089098
>
> Reporter is quite unhappy that setting access mode on sssd.conf to 0400
> will result in SSSD's failure to start and error message requesting to
> set access mode to 0600.
>
> Does it matter what access mode is set for user if it is required that
> user must be ROOT?
>
> I didn't find out the original reason for requiring write permission for
> user so it possible that it is needless. But I'm afraid that simple
> changing the required access mode from 0600 to 0400 would cause failure
> to start SSSD for users who upgrade SSSD to newer version.
>
> Maybe we can allow both modes (0400 and 0600) but is it worth doing?
>
> Thank you for your opinions.
I'll state the opinion I expressed in the bugzilla again -- we could
reverse the check and instead ensure that group and others have no
permission bits set, but I don't think it's worth doing, honestly.
Especially considering the tone the reporter chose in the bugzilla report.
More information about the sssd-devel
mailing list