[SSSD] sssd.conf ownership

Pavel Březina pbrezina at redhat.com
Tue Nov 25 11:44:01 UTC 2014


On 11/25/2014 10:41 AM, Jakub Hrozek wrote:
> On Mon, Nov 24, 2014 at 07:28:56PM -0500, Stephen Gallagher wrote:
>>>> Why exactly would it need to be chown()ed? I'm unclear on that point.
>>>> Presumably, SSSD is still being launched as root and then dropping
>>>> privileges (otherwise it wouldn't be able to perform the chown). So to
>>>> me it seems like it makes sense to just open the file read-only prior to
>>>> dropping privileges, then pass the filehandle along.
>>>
>>> Passing a fd would be best, but infortunately the augeas API we use to
>>> change the configuration only works with path names ...
>>
>> Hmm, that seems problematic and racy. There's no way for augeas to take
>> a descriptor? That seems like a pretty big oversight.
>
> I didn't see a way for the aug_* functions to accept a fd. I can ask on
> the upstream devel list -- or Pavel could, given he's more involved in
> using augeas than me.
>


AFAIK augeas can't do this, unfortunately. But it would be nice RFE.

I was suggested to try aug_text_retrieve/store when we would basically 
read the config file ourselves and push it into augeas. But that doesn't 
sound very comfy.




More information about the sssd-devel mailing list