[SSSD] [PATCH] PROXY: proxy_child should work in non-root mode
Lukas Slebodnik
lslebodn at redhat.com
Wed May 27 13:06:51 UTC 2015
ehlo,
BTW crash in sssd_be (#2654) was cased by missing setuid bit in proxy_child.
Attached patch fixes proxy_child in non-root mode
so now design page and reality are the same in this case. :-)
LS
-------------- next part --------------
>From 9481f29a264526fc91ae97b99cadc9b11f92afc2 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Wed, 27 May 2015 14:49:14 +0200
Subject: [PATCH] PROXY: proxy_child should work in non-root mode
According to design page[1], proxy_child should run
with root privileges in non-root mode however proxy_child
did not have setuid bit.
After setting setuid bit proxy_child will be executed with extra privileges.
The effective user ID will be 0 but effective group ID will be still
the same as egid of sssd_be. Therefore gid of private pipe for
proxy_child should be the same. Otherwise proxy_child will fail
due to wrong permissions of unix pipe (sbus_client_init -> check_file)
[1] https://fedorahosted.org/sssd/wiki/DesignDocs/NotRootSSSD
Resolves:
https://fedorahosted.org/sssd/ticket/2655
---
contrib/sssd.spec.in | 2 +-
src/providers/proxy/proxy_init.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 3cae1178783f7043ed31365e22abe5e884fa58b9..d4b2a93000ffa03cb135a4595a9669d008313836 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -780,7 +780,7 @@ rm -rf $RPM_BUILD_ROOT
%files proxy
%defattr(-,root,root,-)
%doc COPYING
-%{_libexecdir}/%{servicename}/proxy_child
+%attr(4750,root,sssd) %{_libexecdir}/%{servicename}/proxy_child
%{_libdir}/%{name}/libsss_proxy.so
%files dbus
diff --git a/src/providers/proxy/proxy_init.c b/src/providers/proxy/proxy_init.c
index 791942420d2dd09d5d0ee1ca27e4969149f85ba3..0a6b11d4a3f102782322c913d280b26fe47aecab 100644
--- a/src/providers/proxy/proxy_init.c
+++ b/src/providers/proxy/proxy_init.c
@@ -515,7 +515,7 @@ int sssm_proxy_auth_init(struct be_ctx *bectx,
goto done;
}
- ret = sbus_new_server(ctx, bectx->ev, sbus_address, 0, 0,
+ ret = sbus_new_server(ctx, bectx->ev, sbus_address, 0, bectx->gid,
false, &ctx->sbus_srv, proxy_client_init, ctx);
if (ret != EOK) {
DEBUG(SSSDBG_FATAL_FAILURE, "Could not set up sbus server.\n");
--
2.4.1
More information about the sssd-devel
mailing list