[SSSD] sssd.conf ownership

Lukas Slebodnik lslebodn at redhat.com
Mon Nov 24 09:12:20 UTC 2014


On (21/11/14 20:03), Jakub Hrozek wrote:
>Hi,
>
>I was going through our design page that describes the rootless sssd and
>I'd like to discuss the default ownership of sssd.conf a bit more.
>
>In the design document we proposed to change the default ownership to
>sssd.sssd. This wouldn't widen sssd.conf access as only root and the sssd
>user could read the config. One reason for the change was the dbus helper
>to change the config, which would otherwise run privileged.
>
>But I wonder whether it's really the best approach. If we changed the
>ownership to sssd.sssd, then we'd have to be careful about chowning the
>file each time on startup because tools like authconfig or even customer's
>puppet modules or whatnot will keep writing out the file as root.root.
SSSD will be running as root for sme time. Meanwhile we can file tickets
to other projects.

If the sssd will not start and there be error in syslog(journald) it will be
very easy to change puppet modules. The more problematic situation can happen
if users does not use any configuration management system. They would need to
change ownership manually or we should do it after update
(post section in spec file)

To sum up: I would prefer to get rid of root from as many places as possible.

LS



More information about the sssd-devel mailing list