[SSSD] [sssd] user's write permission on sssd.conf

Jakub Hrozek jhrozek at redhat.com
Fri Apr 18 14:39:43 UTC 2014


On Fri, Apr 18, 2014 at 02:09:33PM +0200, Pavel Reichl wrote:
> Hello,
> 
> we recently received following bugzilla:
> https://bugzilla.redhat.com/show_bug.cgi?id=1089098
> 
> Reporter is quite unhappy that setting access mode on sssd.conf to 0400
> will result in SSSD's failure to start and error message requesting to
> set access mode to 0600. 
> 
> Does it matter what access mode is set for user if it is required that
> user must be ROOT?
> 
> I didn't find out the original reason for requiring write permission for
> user so it possible that it is needless. But I'm afraid that simple
> changing the required access mode from 0600 to 0400 would cause failure
> to start SSSD for users who upgrade SSSD to newer version. 
> 
> Maybe we can allow both modes (0400 and 0600) but is it worth doing?
> 
> Thank you for your opinions.

I'll state the opinion I expressed in the bugzilla again -- we could
reverse the check and instead ensure that group and others have no
permission bits set, but I don't think it's worth doing, honestly.

Especially considering the tone the reporter chose in the bugzilla report.



More information about the sssd-devel mailing list