[SSSD] cwrap test roadblock

Simo Sorce simo at redhat.com
Thu Nov 27 14:25:09 UTC 2014


On Thu, 27 Nov 2014 15:09:32 +0200
Nikolai Kondrashov <Nikolai.Kondrashov at redhat.com> wrote:

> Hi everyone,
> 
> While trying to arrange running sssd under cwrap in "make check" I
> came upon this roadblock:
> 
> There doesn't seem to be a way to make libnsss_sss use server sockets
> in non-default location at runtime, only at build time. And it seems
> that doing it at runtime would be a security issue.

Why would it be a security issue ?

> That means that we can't include tests involving libnss_sss into
> "make check", as that is not guaranteed to be invoked on a build with
> a special location where the current user can write to.

We can use environment variables to find the socket as long as use
secure_getenv() (which means they will not work when running as a
setuid process, but otherwise will).

The other option is to have a configuration file that libnsss_sss
reads, we haven't gone this route so far as we wanted to avoid adding
file operations to find out sockets, but it wouldn't be very hard to do
if we keep the file format so simple we do not need a file format
parser. But then this would again be a system level setting not per
process, so perhaps the env var route is better for testing anyway.

> This leaves us with being able to run these tests under CI only,
> which can arrange for special configure options and thus locations.
> 
> Could there be another way? Am I missing something?

A last option would be to intercept unix socket calls in socket wrapper
too, and redirect them.

Simo.


-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-devel mailing list