[SSSD] sssd.conf ownership

Jakub Hrozek jhrozek at redhat.com
Tue Nov 25 09:41:50 UTC 2014


On Mon, Nov 24, 2014 at 07:28:56PM -0500, Stephen Gallagher wrote:
> > > Why exactly would it need to be chown()ed? I'm unclear on that point.
> > > Presumably, SSSD is still being launched as root and then dropping
> > > privileges (otherwise it wouldn't be able to perform the chown). So to
> > > me it seems like it makes sense to just open the file read-only prior to
> > > dropping privileges, then pass the filehandle along.
> > 
> > Passing a fd would be best, but infortunately the augeas API we use to
> > change the configuration only works with path names ...
> 
> Hmm, that seems problematic and racy. There's no way for augeas to take
> a descriptor? That seems like a pretty big oversight.

I didn't see a way for the aug_* functions to accept a fd. I can ask on
the upstream devel list -- or Pavel could, given he's more involved in
using augeas than me.



More information about the sssd-devel mailing list