[SSSD] [PATCH] Monitor and sbus changes for running SSSD as a non-privileged user
Simo Sorce
ssorce at redhat.com
Wed Oct 15 22:17:55 UTC 2014
On Wed, 15 Oct 2014 22:24:04 +0200
Jakub Hrozek <jhrozek at redhat.com> wrote:
> From c0385561ee5e9d050d2222aa43ebf46514f37dad Mon Sep 17 00:00:00 2001
> From: Michal Zidek <mzidek at redhat.com>
> Date: Thu, 9 Oct 2014 17:15:56 +0200
> Subject: [PATCH 5/7] MONITOR: Allow confdb to be accessed by nonroot
> user
>
> ---
> src/monitor/monitor.c | 11 ++++++++++-
> 1 file changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
> index
> 44614be173325aa5b6f7ed03f00b6d4489ddf522..bd2c373008ef75ab46cf7dccdefd12468894f1ba
> 100644 --- a/src/monitor/monitor.c +++ b/src/monitor/monitor.c
> @@ -1718,7 +1718,6 @@ static errno_t load_configuration(TALLOC_CTX
> *mem_ctx, DEBUG(SSSDBG_FATAL_FAILURE, "Fatal error initializing
> confdb\n"); goto done;
> }
> - talloc_zfree(cdb_file);
>
> ret = confdb_init_db(config_file, ctx->cdb);
> if (ret != EOK) {
> @@ -1734,6 +1733,16 @@ static errno_t load_configuration(TALLOC_CTX
> *mem_ctx, goto done;
> }
>
> + /* Allow configuration database to be accessible
> + * when SSSD runs as nonroot */
> + ret = chown(cdb_file, ctx->uid, ctx->gid);
> + if (ret != EOK) {
> + DEBUG(SSSDBG_FATAL_FAILURE,
> + "chown failed for [%s]: [%d][%s].\n",
> + cdb_file, ret, sss_strerror(ret));
> + goto done;
> + }
> +
> *monitor = ctx;
>
> ret = EOK;
I wonder if we shouldn't be more cautious here.
Do we need to give the sssd user write access ?
I think probably not, sounds like a great way to prevent "accidental"
changes would be to chown to (0, gid) and chmod so that the group can
only read, while root can read/write.
This way non-root process will be allowed to read but not change the
database.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list