[SSSD] [sssd] user's write permission on sssd.conf

Rowland Penny repenny241155 at gmail.com
Sat Apr 19 16:42:34 UTC 2014


On 19/04/14 17:18, Dmitri Pal wrote:
> On 04/18/2014 10:39 AM, Jakub Hrozek wrote:
>> On Fri, Apr 18, 2014 at 02:09:33PM +0200, Pavel Reichl wrote:
>>> Hello,
>>>
>>> we recently received following bugzilla:
>>> https://bugzilla.redhat.com/show_bug.cgi?id=1089098
>>>
>>> Reporter is quite unhappy that setting access mode on sssd.conf to 0400
>>> will result in SSSD's failure to start and error message requesting to
>>> set access mode to 0600.
>>>
>>> Does it matter what access mode is set for user if it is required that
>>> user must be ROOT?
>>>
>>> I didn't find out the original reason for requiring write permission 
>>> for
>>> user so it possible that it is needless. But I'm afraid that simple
>>> changing the required access mode from 0600 to 0400 would cause failure
>>> to start SSSD for users who upgrade SSSD to newer version.
>>>
>>> Maybe we can allow both modes (0400 and 0600) but is it worth doing?
>>>
>>> Thank you for your opinions.
>> I'll state the opinion I expressed in the bugzilla again -- we could
>> reverse the check and instead ensure that group and others have no
>> permission bits set, but I don't think it's worth doing, honestly.
>>
>> Especially considering the tone the reporter chose in the bugzilla 
>> report.
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>
>
> Let us focus on the core of the problem not on how it was conveyed.
> I think the reporter is right. I should not matter whether the file is 
> writable by owner.
> The tone of the bug is a different problem and while I agree that the 
> issue was expressed not in the best words it is still an issue.
>
>
>
Can I offer my opinion here?

As long as the owner is root:root even if the permissions are 0400, root 
can still write to the file, so does it really matter if the permissions 
are 0600 or 0400 ? nobody else can read the file (or write to it) 
whatever the owners permissions are.

As for the tone of that bug report, well I think he needs a lesson in 
manners.

Rowland




More information about the sssd-devel mailing list