[SSSD] [PATCH] Monitor and sbus changes for running SSSD as a non-privileged user
Pavel Reichl
preichl at redhat.com
Tue Oct 21 11:59:31 UTC 2014
Just last nitpicks before I dive into testing:
> Date: Tue, 5 Aug 2014 13:53:20 +0200
> Subject: [PATCH 03/19] RPM: Change file ownership to sssd.sssd
>
> Adds a private SSSD user in the %pre section of SSSD specfile. Also
> changes the ownsership of SSSD private directories to sssd.sssd.
s/ownsership/ownership
> Subject: [PATCH 05/19] SBUS: Chown the sbus socket if needed
[snip]
> @@ -268,6 +269,17 @@ int sbus_new_server(TALLOC_CTX *mem_ctx,
> }
> }
>
> + if (stat_buf.st_uid != uid || stat_buf.st_gid != gid) {
> + ret = chown(filename, uid, gid);
> + if (ret != EOK) {
> + DEBUG(SSSDBG_CRIT_FAILURE,
> + "chown failed for [%s]: [%d][%s].\n", filename, errno,
> + strerror(errno));
It would be nice to not use errno directly as strerror() itself may
change errno value.
Just calling ret = errno and passing ret to strerror() would make me happy.
You may also consider using sss_strerror instead of strerror.
> + ret = EIO;
> + goto done;
> + }
> + }
> +
> From a19db5f165a1d96fe159201df71b1b7d0f3aa1ff Mon Sep 17 00:00:00 2001
> From: Michal Zidek <mzidek at redhat.com>
> Date: Thu, 9 Oct 2014 17:15:56 +0200
> Subject: [PATCH 08/19] MONITOR: Allow confdb to be accessed by nonroot
> user
>
> ---
> src/monitor/monitor.c | 12 +++++++++++-
> 1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
> index
> 905e66f25601d155557487ae9c7eb6d3145d3a83..d430f96c5af9b45c9641d700d9fbcd3590bdaae6
> 100644
> --- a/src/monitor/monitor.c
> +++ b/src/monitor/monitor.c
> @@ -1696,7 +1696,6 @@ static errno_t load_configuration(TALLOC_CTX
> *mem_ctx,
> DEBUG(SSSDBG_FATAL_FAILURE, "Fatal error initializing confdb\n");
> goto done;
> }
> - talloc_zfree(cdb_file);
OK, cdf_file is used later in this function but still it should be freed
in the end.
>
> ret = confdb_init_db(config_file, ctx->cdb);
> if (ret != EOK) {
> @@ -1712,6 +1711,17 @@ static errno_t load_configuration(TALLOC_CTX
> *mem_ctx,
> goto done;
> }
>
> + /* Allow configuration database to be accessible
> + * when SSSD runs as nonroot */
> + ret = chown(cdb_file, ctx->uid, ctx->gid);
> + if (ret != 0) {
> + ret = errno;
> + DEBUG(SSSDBG_FATAL_FAILURE,
> + "chown failed for [%s]: [%d][%s].\n",
> + cdb_file, ret, sss_strerror(ret));
> + goto done;
> + }
> +
> *monitor = ctx;
>
> ret = EOK;
> --
> 1.9.3
> Subject: [PATCH 14/19] PAM: Create pipe file descriptors before
> priviledges
> are dropped
s/priviledges/privileges
> @@ -347,6 +350,24 @@ int main(int argc, const char *argv[])
> /* set up things like debug, signals, daemonization, etc... */
> debug_log_file = "sssd_pam";
>
> + /* Crate pipe file descriptors here before priviledges are dropped
same typo
> + * in server_setup() */
> + ret = create_pipe_fd(SSS_PAM_SOCKET_NAME, &pipe_fd, 0111);
> + if (ret != EOK) {
> + DEBUG(SSSDBG_FATAL_FAILURE,
> + "create_pipe_fd failed [%d]: %s.\n",
> + ret, sss_strerror(ret));
> + return 2;
> + }
> +
> + ret = create_pipe_fd(SSS_PAM_PRIV_SOCKET_NAME, &priv_pipe_fd, 0177);
> + if (ret != EOK) {
> + DEBUG(SSSDBG_FATAL_FAILURE,
> + "create_pipe_fd failed (priviledged pipe) [%d]: %s.\n",
same typo
> + ret, sss_strerror(ret));
> + return 2;
> + }
More information about the sssd-devel
mailing list