[SSSD] [PATCH] Monitor and sbus changes for running SSSD as a non-privileged user

Simo Sorce ssorce at redhat.com
Thu Oct 16 14:43:38 UTC 2014


On Thu, 16 Oct 2014 16:24:36 +0200
Jakub Hrozek <jhrozek at redhat.com> wrote:

> When on the topic of setuid child processes, we currently pass quite a
> lot of info through environment variables. Even though the variables
> are private and namespaced (SSS_DEFAULT_REALM for example), I still
> think we should get rid of the variables and either use a parameter
> (--default-realm) or just pass the info through the pipe..

Yes and we should use secure_getent() throughout the code or we risk
opening up attacks against setuid binaries.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-devel mailing list