[SSSD] [PATCH] Packaging fixes related to non-root SSSD

Jakub Hrozek jhrozek at redhat.com
Wed Oct 15 19:55:07 UTC 2014


Hi,

attached are two patches that change the file ownership when SSSD runs
as as a non-root user. Please see the commit messages for more details.

I have one question -- is it wise to also set the permissions of
directories we create when we "install -d" them? Or is this something
typically done by the downstream?
-------------- next part --------------
>From 47ff1a0762ed8353f1fead8f5afa991dc10e1284 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 1 Oct 2014 14:47:09 +0200
Subject: [PATCH 1/2] BUILD: Add a config option for sssd user, own private
 directories as the user

Adds two new configure-time options that let you select the user to run
SSSD as. The default is 'root' for backwards compatibility. If user is
specified, but the group is not, the user is also used as group name.

The directories the deamon stores its private data at are also created
as owned by this user during install time.
---
 Makefile.am        | 24 ++++++++++++++++++------
 configure.ac       |  1 +
 src/conf_macros.m4 | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 021498ff5793381397282089d4b44e9bb9bb0e3a..457acce7d9bcc88090a819cf2f0c28f747b333f6 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -78,6 +78,15 @@ sudolibdir = @sudolibpath@
 UNICODE_LIBS=@UNICODE_LIBS@
 
 MKDIR_P = @MKDIR_P@
+INSTALL = @INSTALL@
+
+SSSD_USER = @SSSD_USER@
+SSSD_GROUP = @SSSD_GROUP@
+
+INSTALL_USER_DIR_FLAGS = -d
+if SSSD_USER
+INSTALL_USER_DIR_FLAGS += -o $(SSSD_USER) -g $(SSSD_GROUP)
+endif
 
 AM_CFLAGS =
 if WANT_AUX_INFO
@@ -2719,24 +2728,27 @@ installsssddirs::
     $(DESTDIR)$(bindir) \
     $(DESTDIR)$(sbindir) \
     $(DESTDIR)$(mandir) \
+    $(DESTDIR)$(pidpath) \
     $(DESTDIR)$(pluginpath) \
     $(DESTDIR)$(libdir)/ldb \
     $(DESTDIR)$(dbuspolicydir) \
     $(DESTDIR)$(dbusservicedir) \
-    $(DESTDIR)$(pipepath)/private \
     $(DESTDIR)$(sssdlibdir) \
     $(DESTDIR)$(pkglibdir) \
-    $(DESTDIR)$(sssdconfdir) \
     $(DESTDIR)$(sssddatadir) \
+    $(DESTDIR)$(sudolibdir) \
+    $(DESTDIR)$(autofslibdir) \
+    $(NULL); \
+	$(INSTALL) $(INSTALL_USER_DIR_FLAGS) \
     $(DESTDIR)$(dbpath) \
     $(DESTDIR)$(mcpath) \
-    $(DESTDIR)$(pidpath) \
-    $(DESTDIR)$(logpath) \
+    $(DESTDIR)$(pipepath) \
+    $(DESTDIR)$(pipepath)/private \
     $(DESTDIR)$(pubconfpath) \
     $(DESTDIR)$(pubconfpath)/krb5.include.d \
     $(DESTDIR)$(gpocachepath) \
-    $(DESTDIR)$(sudolibdir) \
-    $(DESTDIR)$(autofslibdir) \
+    $(DESTDIR)$(sssdconfdir) \
+    $(DESTDIR)$(logpath) \
     $(NULL)
 
 if HAVE_DOXYGEN
diff --git a/configure.ac b/configure.ac
index e6745cb454624d1d62e1a827c2fbf557f6502ae9..e5ec204ad9671d15deb1830c60168e066a66f198 100644
--- a/configure.ac
+++ b/configure.ac
@@ -137,6 +137,7 @@ WITH_SAMBA
 WITH_NFS
 WITH_NFS_LIB_PATH
 WITH_LIBWBCLIENT
+WITH_SSSD_USER
 
 m4_include([src/external/pkg.m4])
 m4_include([src/external/libpopt.m4])
diff --git a/src/conf_macros.m4 b/src/conf_macros.m4
index 4aa58138c85db9266fd3f1765fc357b3fd104941..0ab929acc2969b522b413a4bde2a65e2e8b9fe9b 100644
--- a/src/conf_macros.m4
+++ b/src/conf_macros.m4
@@ -737,3 +737,37 @@ AC_DEFUN([WITH_NFS_LIB_PATH],
     fi
     AC_SUBST(nfslibpath)
   ])
+
+AC_DEFUN([WITH_SSSD_USER],
+  [ AC_ARG_WITH([sssd-user],
+                [AS_HELP_STRING([--with-sssd-user=<user>],
+                                [User for running SSSD (root)]
+                               )
+                ]
+               )
+
+    AC_ARG_WITH([sssd-group],
+                [AS_HELP_STRING([--with-sssd-group=<group>],
+                                [Group for running SSSD (root)]
+                               )
+                ]
+               )
+
+    SSSD_USER=root
+    SSSD_GROUP=root
+
+    if test x"$with_sssd_user" != x; then
+        SSSD_USER=$with_sssd_user
+        if test -z "$with_sssd_group"; then
+            SSSD_GROUP=$with_sssd_user
+        else
+            SSSD_GROUP=$with_sssd_group
+        fi
+    fi
+
+    AC_SUBST(SSSD_USER)
+    AC_SUBST(SSSD_GROUP)
+    AC_DEFINE_UNQUOTED(SSSD_USER, "$SSSD_USER", ["The default user to run SSSD as"])
+    AC_DEFINE_UNQUOTED(SSSD_GROUP, "$SSSD_GROUP", ["The default group to run SSSD as"])
+    AM_CONDITIONAL([SSSD_USER], [test x"$with_sssd_user" != x])
+  ])
-- 
1.9.3

-------------- next part --------------
>From 77e217b071ba3629a92e26c8f55361ef0264fcc4 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Tue, 5 Aug 2014 13:53:20 +0200
Subject: [PATCH 2/2] RPM: Change file ownership to sssd.sssd

Adds a private SSSD user in the %pre section of SSSD specfile. Also
changes the ownsership of SSSD private directories to sssd.sssd.

Does not change the configure time default, so SSSD will still run as
root. The file and directory ownership does not widen, because the
directories are still only accessible by the private user (whose shell
is /sbin/nologin) and of course the root user.
---
 contrib/sssd.spec.in | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 529304205274ad39e4281e3d298222420d5eb439..e3161d723e04ebb25dec768c92be6079042ce9b4 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -603,17 +603,17 @@ rm -rf $RPM_BUILD_ROOT
 
 %dir %{sssdstatedir}
 %dir %{_localstatedir}/cache/krb5rcache
-%attr(700,root,root) %dir %{dbpath}
-%attr(755,root,root) %dir %{mcpath}
-%ghost %attr(0644,root,root) %verify(not md5 size mtime) %{mcpath}/passwd
-%ghost %attr(0644,root,root) %verify(not md5 size mtime) %{mcpath}/group
-%attr(755,root,root) %dir %{pipepath}
-%attr(755,root,root) %dir %{pubconfpath}
-%attr(755,root,root) %dir %{gpocachepath}
-%attr(700,root,root) %dir %{pipepath}/private
-%attr(750,root,root) %dir %{_var}/log/%{name}
-%attr(711,root,root) %dir %{_sysconfdir}/sssd
-%ghost %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/sssd/sssd.conf
+%attr(700,sssd,sssd) %dir %{dbpath}
+%attr(755,sssd,sssd) %dir %{mcpath}
+%ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/passwd
+%ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/group
+%attr(755,sssd,sssd) %dir %{pipepath}
+%attr(755,sssd,sssd) %dir %{pubconfpath}
+%attr(755,sssd,sssd) %dir %{gpocachepath}
+%attr(700,sssd,sssd) %dir %{pipepath}/private
+%attr(750,sssd,sssd) %dir %{_var}/log/%{name}
+%attr(711,sssd,sssd) %dir %{_sysconfdir}/sssd
+%ghost %attr(0600,sssd,sssd) %config(noreplace) %{_sysconfdir}/sssd/sssd.conf
 %if (0%{?use_systemd} == 1)
 %attr(755,root,root) %dir %{_sysconfdir}/systemd/system/sssd.service.d
 %config(noreplace) %{_sysconfdir}/systemd/system/sssd.service.d/journal.conf
@@ -802,6 +802,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/%{name}/modules/libwbclient.so
 %{_libdir}/pkgconfig/wbclient_sssd.pc
 
+%pre common
+getent group sssd >/dev/null || groupadd -r sssd
+getent passwd sssd >/dev/null || useradd -r -g sssd -d / -s /sbin/nologin -c "User for sssd" sssd
+
 %if (0%{?use_systemd} == 1)
 # systemd
 %post common
-- 
1.9.3



More information about the sssd-devel mailing list