[SSSD] Config file ownership and cwrap tests

Nikolai Kondrashov Nikolai.Kondrashov at redhat.com
Fri Jan 16 12:11:17 UTC 2015


On 01/15/2015 08:16 PM, Simo Sorce wrote:
> On Thu, 15 Jan 2015 19:43:18 +0200
> Nikolai Kondrashov <Nikolai.Kondrashov at redhat.com> wrote:
>> On 01/15/2015 06:41 PM, Simo Sorce wrote:
>>> On Thu, 15 Jan 2015 12:39:35 +0200
>>> Nikolai Kondrashov <Nikolai.Kondrashov at redhat.com> wrote:
>>>> Simo, do you have anything against this? I.e. allowing sssd.conf to
>>>> belong to sssd.sssd as well as to root.root?
>>>
>>> The reason why the file is owned by root.root is so that the
>>> unprivileged components can't touch it.
>>>
>>> Allowing sssd.sssd to own the file defeats this measure, so I do not
>>> really like it as the standard behavior, unless we decide we stop
>>> checking sssd.conf ownership and just let the admin do what they
>>> think is better.

I would be in support of that solution.

>>> If we do the latter then we can simply turn the check from a
>>> failure to a warning and we just ignore the warning in the tests.
>>
>> Got it, thank you Simo. However, wouldn't the unprivileged processes
>> still have most of the information from the configuration file?
>
> The problem is not about reading info, the problem is not being able to
> write it back and affect other services in a privilege escalation
> attack or similar.

Understood. Thank you.

Nick



More information about the sssd-devel mailing list