[SSSD] Config file ownership and cwrap tests

Lukas Slebodnik lslebodn at redhat.com
Tue Jan 13 15:36:38 UTC 2015


On (13/01/15 15:23), Nikolai Kondrashov wrote:
>On 01/13/2015 03:09 PM, Lukas Slebodnik wrote:
>>On (13/01/15 14:31), Nikolai Kondrashov wrote:
>>>What do you think?
>>>
>>We will use lot of "hacks" with cwrap tests. So we can use yet another.
>>We can mock(LD_PRELOAD own version) ini_config_access_check that it will return
>>EOK for sssd.conf although owner is not root.
>
>Hm, that will work, but it seems to me a bit of an overkill.
>Can we get away with just a code change?
>
There was a long discussion about ownership of the sssd configuration file
few months ago.
"[SSSD] sssd.conf ownership"
https://lists.fedorahosted.org/pipermail/sssd-devel/2014-November/021628.html
You can try to continue discussion there.

The main reason why root need to be owner is that sssd.conf can contain
password (ldap_default_authtok).

We should not try to do any changes to this critical part of sssd.
This is a reason why we decided to use *_wraper

Jakub
Is it a candidate for another wrppper?

LS



More information about the sssd-devel mailing list