[SSSD] [sssd] user's write permission on sssd.conf

Dmitri Pal dpal at redhat.com
Sat Apr 19 17:31:17 UTC 2014


On 04/19/2014 12:42 PM, Rowland Penny wrote:
> On 19/04/14 17:18, Dmitri Pal wrote:
>> On 04/18/2014 10:39 AM, Jakub Hrozek wrote:
>>> On Fri, Apr 18, 2014 at 02:09:33PM +0200, Pavel Reichl wrote:
>>>> Hello,
>>>>
>>>> we recently received following bugzilla:
>>>> https://bugzilla.redhat.com/show_bug.cgi?id=1089098
>>>>
>>>> Reporter is quite unhappy that setting access mode on sssd.conf to 
>>>> 0400
>>>> will result in SSSD's failure to start and error message requesting to
>>>> set access mode to 0600.
>>>>
>>>> Does it matter what access mode is set for user if it is required that
>>>> user must be ROOT?
>>>>
>>>> I didn't find out the original reason for requiring write 
>>>> permission for
>>>> user so it possible that it is needless. But I'm afraid that simple
>>>> changing the required access mode from 0600 to 0400 would cause 
>>>> failure
>>>> to start SSSD for users who upgrade SSSD to newer version.
>>>>
>>>> Maybe we can allow both modes (0400 and 0600) but is it worth doing?
>>>>
>>>> Thank you for your opinions.
>>> I'll state the opinion I expressed in the bugzilla again -- we could
>>> reverse the check and instead ensure that group and others have no
>>> permission bits set, but I don't think it's worth doing, honestly.
>>>
>>> Especially considering the tone the reporter chose in the bugzilla 
>>> report.
>>> _______________________________________________
>>> sssd-devel mailing list
>>> sssd-devel at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>>
>>
>> Let us focus on the core of the problem not on how it was conveyed.
>> I think the reporter is right. I should not matter whether the file 
>> is writable by owner.
>> The tone of the bug is a different problem and while I agree that the 
>> issue was expressed not in the best words it is still an issue.
>>
>>
>>
> Can I offer my opinion here?
>
> As long as the owner is root:root even if the permissions are 0400, 
> root can still write to the file, so does it really matter if the 
> permissions are 0600 or 0400 ? nobody else can read the file (or write 
> to it) whatever the owners permissions are.
>
> As for the tone of that bug report, well I think he needs a lesson in 
> manners.

I agree with the above so I think
1) We should ignore the difference between 0600 and 0400 and start in 
both cases
2) Is teaching lessons what we are best at? ;-) Is it what we really 
should do? I would just give a sight and move on. Life is the best 
teacher...

>
> Rowland
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.




More information about the sssd-devel mailing list