[SSSD] [PATCH] BUILD: restrict perms. when installing from source

Pavel Reichl preichl at redhat.com
Mon Dec 1 15:02:32 UTC 2014


On 11/26/2014 01:36 PM, Lukas Slebodnik wrote:
> On (25/11/14 17:31), Jakub Hrozek wrote:
>> On Tue, Nov 25, 2014 at 04:39:02PM +0100, Lukas Slebodnik wrote:
>>> On (25/11/14 15:52), Pavel Reichl wrote:
>>>> On 11/25/2014 03:48 PM, Pavel Reichl wrote:
>>>>> On 11/25/2014 03:38 PM, Lukas Slebodnik wrote:
>>>>>> On (25/11/14 14:26), Pavel Reichl wrote:
>>>>>>> On 11/19/2014 10:45 AM, Jakub Hrozek wrote:
>>>>>>>
>>>>>>> Thanks.
>>>>>> >From 649aae0d47299229f2afe51fa27e6c315d967ae1 Mon Sep 17 00:00:00 2001
>>>>>>> From: Pavel Reichl <preichl at redhat.com>
>>>>>>> Date: Thu, 30 Oct 2014 10:13:54 +0000
>>>>>>> Subject: [PATCH] BUILD: restrict perms. when installing from source
>>>>>>>
>>>>>>> Resolves:
>>>>>>> https://fedorahosted.org/sssd/ticket/2467
>>>>>>> ---
>>>>>>> Makefile.am | 3 +++
>>>>>>> 1 file changed, 3 insertions(+)
>>>>>>>
>>>>>>> diff --git a/Makefile.am b/Makefile.am
>>>>>>> index 56a562c761d39ff5f54bc034ede563c40bf21ef8..21f02388efe360ecea9cdd157f91ffe172b08f91
>>>>>>> 100644
>>>>>>> --- a/Makefile.am
>>>>>>> +++ b/Makefile.am
>>>>>>> @@ -2831,6 +2831,9 @@ if SSSD_USER
>>>>>>>     -chown $(SSSD_USER):$(SSSD_USER) \
>>>>>>>     $(SSSD_USER_DIRS)
>>>>>>> endif
>>>>>>> +    $(INSTALL) -d -m 0700 $(DESTDIR)$(dbpath) $(DESTDIR)$(logpath)
>>>>>>> $(DESTDIR)$(pipepath)/private
>>>>>>> +    $(INSTALL) -d -m 0755 $(DESTDIR)$(mcpath) $(DESTDIR)$(pipepath)
>>>>>>> $(DESTDIR)$(pubconfpath) $(DESTDIR)$(pubconfpath)/krb5.include.d
>>>>>>> $(DESTDIR)$(gpocachepath)
>>>>>> I would like to apologize for nitpicking but previous two lines are
>>>>>> longer
>>>>>> than 80 characters.
>>>>>>
>>>>>> LS
>>>>> No need to apologize, I just hope you like the formatting of continuous
>>>>> lines.
>>>>>
>>>>>
>>>> Sorry, I used tab instead of spaces on one of the continuous lines, updated
>>>> patch attached.
>>> >From 4364ca79d714105082057806f320b73ef1fc1a67 Mon Sep 17 00:00:00 2001
>>>> From: Pavel Reichl <preichl at redhat.com>
>>>> Date: Thu, 30 Oct 2014 10:13:54 +0000
>>>> Subject: [PATCH] BUILD: restrict perms. when installing from source
>>>>
>>>> Resolves:
>>>> https://fedorahosted.org/sssd/ticket/2467
>>>> ---
>>>> Makefile.am | 6 ++++++
>>>> 1 file changed, 6 insertions(+)
>>>>
>>>> diff --git a/Makefile.am b/Makefile.am
>>>> index 56a562c761d39ff5f54bc034ede563c40bf21ef8..84f22fd0ce7bb59dd90609ced3c26a3b91c3c74d 100644
>>>> --- a/Makefile.am
>>>> +++ b/Makefile.am
>>>> @@ -2831,6 +2831,12 @@ if SSSD_USER
>>>> 	-chown $(SSSD_USER):$(SSSD_USER) \
>>>> 	$(SSSD_USER_DIRS)
>>>> endif
>>>> +	$(INSTALL) -d -m 0700 $(DESTDIR)$(dbpath) $(DESTDIR)$(logpath) \
>>>> +            $(DESTDIR)$(pipepath)/private
>>>> +	$(INSTALL) -d -m 0755 $(DESTDIR)$(mcpath) $(DESTDIR)$(pipepath) \
>>>> +            $(DESTDIR)$(pubconfpath) \
>>>> +            $(DESTDIR)$(pubconfpath)/krb5.include.d $(DESTDIR)$(gpocachepath)
>>>> +	$(INSTALL) -d -m 0711 $(DESTDIR)$(sssdconfdir)
>>> Two directories has different permissions with and without patch.
>>>
>>> Before:
>>> [root at e6078a90f933 /]# ls -ld /var/log/sssd/
>>> drwxr-x---. 2 root root 4096 Sep 25 08:54 /var/log/sssd/
>> I would prefer to lock down the logfiles as much as possible, even
>> though 'others' have no access here.
> I don't have problem with this change.
>
>>> [root at e6078a90f933 /]# ls -ld /etc/sssd/
>>> drwx------. 2 root root 4096 Sep 25 08:54 /etc/sssd/
>>>
>>> After:
>>> [root at bd7fb00d6a7a /usr/local]# ls -ld ./var/log/sssd/
>>> drwx------. 2 root root 40 Nov 25 16:15 ./var/log/sssd/
>>> [root at bd7fb00d6a7a /usr/local]# ls -ld ./etc/sssd/
>>> drwx--x--x. 2 root root 40 Nov 25 16:15 ./etc/sssd/
>>>
>>> I don't want to say it's wrong
>>> Could you explain it?
>> I think I know what's going on. In the specfiles, we relaxed the
>> /etc/sssd/ permissions so that the configAPI files are accessible for
>> non-root.
>>
> Why it should be accessible for other if they cannot read it?
> only owner can read/modify sssd.conf
Stephen's explanation:
> The idea was that we could allow non-root users to read the API
> configuration (*not*  the sssd.conf) and be able to generate prototype
> sssd.conf files. It still required root to be able to put the file in
> place.



>
>> Check out the permissions in Fedora in RHEL, I would expect them to be
>> 711 as well.
> centos 6.6:
> bash-4.1# ls -ld /etc/sssd/
> drwx------. 2 root root 4096 Oct 16 14:31 /etc/sssd/
>
> centos 7.0:
> bash-4.2# ls -ld /etc/sssd/
> drwx------. 2 root root 4096 Nov  6 14:09 /etc/sssd/
>
> fedora 19:
> sh-4.2# ls -ld /etc/sssd
> drwx------. 2 root root 4096 Apr 11  2014 /etc/sssd
>
> fedora 20:
> sh-4.2# ls -ld /etc/sssd
> drwx------. 2 root root 4096 Sep 25 08:54 /etc/sssd
>
> fedora 21:
> sh-4.3# ls -ld /etc/sssd
> drwx------. 2 root root 4096 Oct 22 11:26 /etc/sssd
>
> LS
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20141201/a10d5f74/attachment.html>


More information about the sssd-devel mailing list