[SSSD] Config file ownership and cwrap tests

Nikolai Kondrashov Nikolai.Kondrashov at redhat.com
Tue Jan 13 15:42:13 UTC 2015


On 01/13/2015 05:36 PM, Lukas Slebodnik wrote:
> On (13/01/15 15:23), Nikolai Kondrashov wrote:
>> On 01/13/2015 03:09 PM, Lukas Slebodnik wrote:
>>> On (13/01/15 14:31), Nikolai Kondrashov wrote:
>>>> What do you think?
>>>>
>>> We will use lot of "hacks" with cwrap tests. So we can use yet another.
>>> We can mock(LD_PRELOAD own version) ini_config_access_check that it will return
>>> EOK for sssd.conf although owner is not root.
>>
>> Hm, that will work, but it seems to me a bit of an overkill.
>> Can we get away with just a code change?
>>
> There was a long discussion about ownership of the sssd configuration file
> few months ago.
> "[SSSD] sssd.conf ownership"
> https://lists.fedorahosted.org/pipermail/sssd-devel/2014-November/021628.html
> You can try to continue discussion there.
>
> The main reason why root need to be owner is that sssd.conf can contain
> password (ldap_default_authtok).
>
> We should not try to do any changes to this critical part of sssd.
> This is a reason why we decided to use *_wraper

Ah, thank you, Lukas. I thought I found a discussion of this, but it was the
wrong one. I'll take a look.

Nick



More information about the sssd-devel mailing list