[SSSD] [sssd] user's write permission on sssd.conf

Jakub Hrozek jhrozek at redhat.com
Mon Apr 28 20:03:57 UTC 2014


On Tue, Apr 22, 2014 at 07:00:38PM +0200, Pavel Reichl wrote:
> On Sat, 2014-04-19 at 17:23 -0400, Simo Sorce wrote:
> > On Sat, 2014-04-19 at 13:31 -0400, Dmitri Pal wrote:
> > > On 04/19/2014 12:42 PM, Rowland Penny wrote:
> > > > On 19/04/14 17:18, Dmitri Pal wrote:
> > > >> On 04/18/2014 10:39 AM, Jakub Hrozek wrote:
> > > >>> On Fri, Apr 18, 2014 at 02:09:33PM +0200, Pavel Reichl wrote:
> > > >>>> Hello,
> > > >>>>
> > > >>>> we recently received following bugzilla:
> > > >>>> https://bugzilla.redhat.com/show_bug.cgi?id=1089098
> > > >>>>
> > > >>>> Reporter is quite unhappy that setting access mode on sssd.conf to 
> > > >>>> 0400
> > > >>>> will result in SSSD's failure to start and error message requesting to
> > > >>>> set access mode to 0600.
> > > >>>>
> > > >>>> Does it matter what access mode is set for user if it is required that
> > > >>>> user must be ROOT?
> > > >>>>
> > > >>>> I didn't find out the original reason for requiring write 
> > > >>>> permission for
> > > >>>> user so it possible that it is needless. But I'm afraid that simple
> > > >>>> changing the required access mode from 0600 to 0400 would cause 
> > > >>>> failure
> > > >>>> to start SSSD for users who upgrade SSSD to newer version.
> > > >>>>
> > > >>>> Maybe we can allow both modes (0400 and 0600) but is it worth doing?
> > > >>>>
> > > >>>> Thank you for your opinions.
> > > >>> I'll state the opinion I expressed in the bugzilla again -- we could
> > > >>> reverse the check and instead ensure that group and others have no
> > > >>> permission bits set, but I don't think it's worth doing, honestly.
> > > >>>
> > > >>> Especially considering the tone the reporter chose in the bugzilla 
> > > >>> report.
> > > >>> _______________________________________________
> > > >>> sssd-devel mailing list
> > > >>> sssd-devel at lists.fedorahosted.org
> > > >>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> > > >>
> > > >>
> > > >> Let us focus on the core of the problem not on how it was conveyed.
> > > >> I think the reporter is right. I should not matter whether the file 
> > > >> is writable by owner.
> > > >> The tone of the bug is a different problem and while I agree that the 
> > > >> issue was expressed not in the best words it is still an issue.
> > > >>
> > > >>
> > > >>
> > > > Can I offer my opinion here?
> > > >
> > > > As long as the owner is root:root even if the permissions are 0400, 
> > > > root can still write to the file, so does it really matter if the 
> > > > permissions are 0600 or 0400 ? nobody else can read the file (or write 
> > > > to it) whatever the owners permissions are.
> > > >
> > > > As for the tone of that bug report, well I think he needs a lesson in 
> > > > manners.
> > > 
> > > I agree with the above so I think
> > > 1) We should ignore the difference between 0600 and 0400 and start in 
> > > both cases
> > 
> > Patches attached.
> > 
> > Tested only with make check though.
> > 
> > > 2) Is teaching lessons what we are best at? ;-) Is it what we really 
> > > should do? I would just give a sight and move on. Life is the best 
> > > teacher...
> > 
> > Just ignore rude people ...
> > 
> > 
> > Btw: In master sbus_tests and sbus_codegen_tests, seem to be failing for
> > me, but it is not related to these 2 patches.
> > 
> > Simo.
> > 
> > _______________________________________________
> > sssd-devel mailing list
> > sssd-devel at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> 
> Hello, 
> 
> I tested the patches and they seem to me to be working flawlessly (so
> ACK to both).

Pushed to master: 
    a5f79cce8abc74beec0c27c477c046bb6cbe7101
    9a592ee3fc195f20732c6b1f90894a0be25ccc19



More information about the sssd-devel mailing list