[SSSD] [PATCH] Monitor and sbus changes for running SSSD as a non-privileged user

Pavel Reichl preichl at redhat.com
Tue Oct 21 11:59:31 UTC 2014


Just last nitpicks before I dive into testing:

> Date: Tue, 5 Aug 2014 13:53:20 +0200
> Subject: [PATCH 03/19] RPM: Change file ownership to sssd.sssd
>
> Adds a private SSSD user in the %pre section of SSSD specfile. Also
> changes the ownsership of SSSD private directories to sssd.sssd.
s/ownsership/ownership

> Subject: [PATCH 05/19] SBUS: Chown the sbus socket if needed
[snip]
> @@ -268,6 +269,17 @@ int sbus_new_server(TALLOC_CTX *mem_ctx,
>          }
>      }
>
> +    if (stat_buf.st_uid != uid || stat_buf.st_gid != gid) {
> +        ret = chown(filename, uid, gid);
> +        if (ret != EOK) {
> +            DEBUG(SSSDBG_CRIT_FAILURE,
> +                  "chown failed for [%s]: [%d][%s].\n", filename, errno,
> + strerror(errno));
It would be nice to not use errno directly as strerror() itself may 
change errno value.
Just calling ret = errno and passing ret to strerror() would make me happy.
You may also consider using sss_strerror  instead of strerror.
> +            ret = EIO;
> +            goto done;
> +        }
> +    }
> +


> From a19db5f165a1d96fe159201df71b1b7d0f3aa1ff Mon Sep 17 00:00:00 2001
> From: Michal Zidek <mzidek at redhat.com>
> Date: Thu, 9 Oct 2014 17:15:56 +0200
> Subject: [PATCH 08/19] MONITOR: Allow confdb to be accessed by nonroot 
> user
>
> ---
>  src/monitor/monitor.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
> index 
> 905e66f25601d155557487ae9c7eb6d3145d3a83..d430f96c5af9b45c9641d700d9fbcd3590bdaae6 
> 100644
> --- a/src/monitor/monitor.c
> +++ b/src/monitor/monitor.c
> @@ -1696,7 +1696,6 @@ static errno_t load_configuration(TALLOC_CTX 
> *mem_ctx,
>          DEBUG(SSSDBG_FATAL_FAILURE, "Fatal error initializing confdb\n");
>          goto done;
>      }
> -    talloc_zfree(cdb_file);
OK, cdf_file is used later in this function but still it should be freed 
in the end.
>
>      ret = confdb_init_db(config_file, ctx->cdb);
>      if (ret != EOK) {
> @@ -1712,6 +1711,17 @@ static errno_t load_configuration(TALLOC_CTX 
> *mem_ctx,
>          goto done;
>      }
>
> +    /* Allow configuration database to be accessible
> +     * when SSSD runs as nonroot */
> +    ret = chown(cdb_file, ctx->uid, ctx->gid);
> +    if (ret != 0) {
> +        ret = errno;
> +        DEBUG(SSSDBG_FATAL_FAILURE,
> +              "chown failed for [%s]: [%d][%s].\n",
> +              cdb_file, ret, sss_strerror(ret));
> +        goto done;
> +    }
> +
>      *monitor = ctx;
>
>      ret = EOK;
> -- 
> 1.9.3

> Subject: [PATCH 14/19] PAM: Create pipe file descriptors before 
> priviledges
>  are dropped
s/priviledges/privileges
> @@ -347,6 +350,24 @@ int main(int argc, const char *argv[])
>      /* set up things like debug, signals, daemonization, etc... */
>      debug_log_file = "sssd_pam";
>
> +    /* Crate pipe file descriptors here before priviledges are dropped
same typo
> +     * in server_setup() */
> +    ret = create_pipe_fd(SSS_PAM_SOCKET_NAME, &pipe_fd, 0111);
> +    if (ret != EOK) {
> +        DEBUG(SSSDBG_FATAL_FAILURE,
> +              "create_pipe_fd failed [%d]: %s.\n",
> +              ret, sss_strerror(ret));
> +        return 2;
> +    }
> +
> +    ret = create_pipe_fd(SSS_PAM_PRIV_SOCKET_NAME, &priv_pipe_fd, 0177);
> +    if (ret != EOK) {
> +        DEBUG(SSSDBG_FATAL_FAILURE,
> +              "create_pipe_fd failed (priviledged pipe) [%d]: %s.\n",
same typo
> +              ret, sss_strerror(ret));
> +        return 2;
> +    }





More information about the sssd-devel mailing list