[SSSD] Config file ownership and cwrap tests

Nikolai Kondrashov Nikolai.Kondrashov at redhat.com
Wed Jan 14 12:49:05 UTC 2015


On 01/14/2015 02:47 PM, Lukas Slebodnik wrote:
> On (14/01/15 14:36), Nikolai Kondrashov wrote:
>> On 01/13/2015 05:36 PM, Lukas Slebodnik wrote:
>>> On (13/01/15 15:23), Nikolai Kondrashov wrote:
>>>> On 01/13/2015 03:09 PM, Lukas Slebodnik wrote:
>>>>> On (13/01/15 14:31), Nikolai Kondrashov wrote:
>>>>>> What do you think?
>>>>>>
>>>>> We will use lot of "hacks" with cwrap tests. So we can use yet another.
>>>>> We can mock(LD_PRELOAD own version) ini_config_access_check that it will return
>>>>> EOK for sssd.conf although owner is not root.
>>>>
>>>> Hm, that will work, but it seems to me a bit of an overkill.
>>>> Can we get away with just a code change?
>>>>
>>> There was a long discussion about ownership of the sssd configuration file
>>> few months ago.
>>> "[SSSD] sssd.conf ownership"
>>> https://lists.fedorahosted.org/pipermail/sssd-devel/2014-November/021628.html
>>> You can try to continue discussion there.
>>
>> I read it, but it seems this issue, although related, is independent of that
>> one. So, I'll try here.
>>
>>> The main reason why root need to be owner is that sssd.conf can contain
>>> password (ldap_default_authtok).
>>
>> If sssd runs as a non-root user, then there's not much added security in
>> keeping sssd.conf belonging to root, instead of that user. That user can
>> always attach a debugger to sssd, or dump its /proc/PID/mem and extract all
>> the passwords.
>>
> A)
> not all processes run as non-root. The main process (sssd) which load
> configuration file still run as root.

Alright.

> B)
> Other processes will run asa system user ("sssd") which does not have a shell
> orpassword.
> sssd:x:983:969:User for sssd:/:/sbin/nologin
>
> I'm not aware of way how other users could attach debugger to the processes
> of another user (or read /proc/PID/mem). It would be a security hole.

True, I missed that.

> So it is not a valid argument.

Still, for that matter, they won't be able to read the file either.

Nick



More information about the sssd-devel mailing list