[SSSD] [PATCH] Monitor and sbus changes for running SSSD as a non-privileged user
Simo Sorce
ssorce at redhat.com
Thu Oct 16 14:43:38 UTC 2014
On Thu, 16 Oct 2014 16:24:36 +0200
Jakub Hrozek <jhrozek at redhat.com> wrote:
> When on the topic of setuid child processes, we currently pass quite a
> lot of info through environment variables. Even though the variables
> are private and namespaced (SSS_DEFAULT_REALM for example), I still
> think we should get rid of the variables and either use a parameter
> (--default-realm) or just pass the info through the pipe..
Yes and we should use secure_getent() throughout the code or we risk
opening up attacks against setuid binaries.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list