[SSSD] [sssd] user's write permission on sssd.conf

Simo Sorce simo at redhat.com
Sat Apr 19 21:23:47 UTC 2014


On Sat, 2014-04-19 at 13:31 -0400, Dmitri Pal wrote:
> On 04/19/2014 12:42 PM, Rowland Penny wrote:
> > On 19/04/14 17:18, Dmitri Pal wrote:
> >> On 04/18/2014 10:39 AM, Jakub Hrozek wrote:
> >>> On Fri, Apr 18, 2014 at 02:09:33PM +0200, Pavel Reichl wrote:
> >>>> Hello,
> >>>>
> >>>> we recently received following bugzilla:
> >>>> https://bugzilla.redhat.com/show_bug.cgi?id=1089098
> >>>>
> >>>> Reporter is quite unhappy that setting access mode on sssd.conf to 
> >>>> 0400
> >>>> will result in SSSD's failure to start and error message requesting to
> >>>> set access mode to 0600.
> >>>>
> >>>> Does it matter what access mode is set for user if it is required that
> >>>> user must be ROOT?
> >>>>
> >>>> I didn't find out the original reason for requiring write 
> >>>> permission for
> >>>> user so it possible that it is needless. But I'm afraid that simple
> >>>> changing the required access mode from 0600 to 0400 would cause 
> >>>> failure
> >>>> to start SSSD for users who upgrade SSSD to newer version.
> >>>>
> >>>> Maybe we can allow both modes (0400 and 0600) but is it worth doing?
> >>>>
> >>>> Thank you for your opinions.
> >>> I'll state the opinion I expressed in the bugzilla again -- we could
> >>> reverse the check and instead ensure that group and others have no
> >>> permission bits set, but I don't think it's worth doing, honestly.
> >>>
> >>> Especially considering the tone the reporter chose in the bugzilla 
> >>> report.
> >>> _______________________________________________
> >>> sssd-devel mailing list
> >>> sssd-devel at lists.fedorahosted.org
> >>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >>
> >>
> >> Let us focus on the core of the problem not on how it was conveyed.
> >> I think the reporter is right. I should not matter whether the file 
> >> is writable by owner.
> >> The tone of the bug is a different problem and while I agree that the 
> >> issue was expressed not in the best words it is still an issue.
> >>
> >>
> >>
> > Can I offer my opinion here?
> >
> > As long as the owner is root:root even if the permissions are 0400, 
> > root can still write to the file, so does it really matter if the 
> > permissions are 0600 or 0400 ? nobody else can read the file (or write 
> > to it) whatever the owners permissions are.
> >
> > As for the tone of that bug report, well I think he needs a lesson in 
> > manners.
> 
> I agree with the above so I think
> 1) We should ignore the difference between 0600 and 0400 and start in 
> both cases

Patches attached.

Tested only with make check though.

> 2) Is teaching lessons what we are best at? ;-) Is it what we really 
> should do? I would just give a sight and move on. Life is the best 
> teacher...

Just ignore rude people ...


Btw: In master sbus_tests and sbus_codegen_tests, seem to be failing for
me, but it is not related to these 2 patches.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-util-Change-file-check-fns-to-use-a-mode-mask.patch
Type: text/x-patch
Size: 16146 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140419/a9bd1256/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-confdb-Change-file-checks-for-config-file.patch
Type: text/x-patch
Size: 1868 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140419/a9bd1256/attachment-0001.bin>


More information about the sssd-devel mailing list