[SSSD] [sssd] user's write permission on sssd.conf

Simo Sorce simo at redhat.com
Fri Apr 18 14:00:29 UTC 2014


On Fri, 2014-04-18 at 14:09 +0200, Pavel Reichl wrote:
> Hello,
> 
> we recently received following bugzilla:
> https://bugzilla.redhat.com/show_bug.cgi?id=1089098
> 
> Reporter is quite unhappy that setting access mode on sssd.conf to 0400
> will result in SSSD's failure to start and error message requesting to
> set access mode to 0600. 
> 
> Does it matter what access mode is set for user if it is required that
> user must be ROOT?
> 
> I didn't find out the original reason for requiring write permission for
> user so it possible that it is needless. But I'm afraid that simple
> changing the required access mode from 0600 to 0400 would cause failure
> to start SSSD for users who upgrade SSSD to newer version. 
> 
> Maybe we can allow both modes (0400 and 0600) but is it worth doing?

What we want to check here is that group/other do not have access.

The check should be:
if ((stated_mode & 0077) != 0) { /* wrong perms */ }

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list