[SSSD] Using ACLs to deal with sssd.conf ownership ? / was: Re: sssd.conf ownership

Roland Mainz rmainz at redhat.com
Thu Nov 27 14:05:23 UTC 2014



----- Original Message -----
> From: "Jakub Hrozek" <jhrozek at redhat.com>
> To: sssd-devel at lists.fedorahosted.org
> Sent: Friday, November 21, 2014 8:03:01 PM
> Subject: [SSSD] sssd.conf ownership
> 
> Hi,
> 
> I was going through our design page that describes the rootless sssd and
> I'd like to discuss the default ownership of sssd.conf a bit more.
> 
> In the design document we proposed to change the default ownership to
> sssd.sssd. This wouldn't widen sssd.conf access as only root and the sssd
> user could read the config. One reason for the change was the dbus helper
> to change the config, which would otherwise run privileged.
> 
> But I wonder whether it's really the best approach. If we changed the
> ownership to sssd.sssd, then we'd have to be careful about chowning the
> file each time on startup because tools like authconfig or even customer's
> puppet modules or whatnot will keep writing out the file as root.root. We
> can't reasonably change all the external tools and chowning on each
> startup seems a bit fragile (as opposed to chowning the databases which
> is a one-time operation).
> 
> Also, if we kept the the config file owned by root, then making the
> confdb read-only for worker processes would mean the worker processes
> have no means of altering the config file even if they were taken over.
> 
> The downside of keeping the sssd.conf as root is that the augeas calls
> would have to be moved to a setuid process -- and a new setuid process is
> always a bit of a burden.
> 
> To sum up:
>     * sssd.sssd
>         (+) don't need any privileged code to access sssd.conf
>         (-) need to chown the file on each startup
>     * root.root
>         (+) config file is only writable by privileged processes
>         (+) we're able to make the confdb read-only
>         (-) need privileged code to perform sssd.conf changes
> 
> I do realize that the complexity of creating the setuid helpers is much
> larger than the complexity of writing a function to chown a file, but
> for some reason the chowning feels a bit fragile to me and my gut
> feeling is that the config file would better be only accessible by
> root...
> 
> What do the other developers think?

What about using ACLs (careful... there two flavours: 1. the (never ratified) draft POSIX ACLs and 2. the NFSv4 ACLs (which are compatible to the Windows ACLs)) ?

----

Bye,
Roland

-- 
  __ .  . __
 (o.\ \/ /.o) rmainz at redhat.com
  \__\/\/__/  IPA/Kerberos5 team
  /O /==\ O\  
 (;O/ \/ \O;)
 



More information about the sssd-devel mailing list