[SSSD] [PATCH] PROXY: proxy_child should work in non-root mode

Lukas Slebodnik lslebodn at redhat.com
Wed May 27 18:22:53 UTC 2015


On (27/05/15 20:20), Michal Židek wrote:
>On 05/27/2015 03:06 PM, Lukas Slebodnik wrote:
>>ehlo,
>>
>>BTW crash in sssd_be (#2654) was cased by missing setuid bit in proxy_child.
>>
>>Attached patch fixes proxy_child in non-root mode
>>so now design page and reality are the same in this case. :-)
>>
>>LS
>>
>
>I tested your patches. It did not work for me (the suid was not set for
>/usr/libexec/sssd/proxy_child). You should amend the Makefile.am (see line
>3316).
>
Good catch.
I tested with rpms and spec file would set correct permisions.

LS
-------------- next part --------------
>From 01cfeed4e12e88ac094135434105e5f480468bfc Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn at redhat.com>
Date: Wed, 27 May 2015 14:49:14 +0200
Subject: [PATCH] PROXY: proxy_child should work in non-root mode

According to design page[1], proxy_child should run
with root privileges in non-root mode however proxy_child
did not have setuid bit.

After setting setuid bit proxy_child will be executed with extra privileges.
The effective user ID will be 0 but effective group ID will be still
the same as egid of sssd_be. Therefore gid of private pipe for
proxy_child should be the same. Otherwise proxy_child will fail
due to wrong permissions of unix pipe (sbus_client_init -> check_file)

[1] https://fedorahosted.org/sssd/wiki/DesignDocs/NotRootSSSD

Resolves:
https://fedorahosted.org/sssd/ticket/2655
---
 Makefile.am                      | 2 ++
 contrib/sssd.spec.in             | 2 +-
 src/providers/proxy/proxy_init.c | 2 +-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 322f49887877351f4869ebf35a8a2c3dcdcf0ce5..0cfe5bd6bc1668867c8bd72bd252abe697fdb7ed 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -3318,6 +3318,8 @@ if SSSD_USER
 	chmod 4750 $(DESTDIR)$(sssdlibexecdir)/ldap_child
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/krb5_child
 	chmod 4750 $(DESTDIR)$(sssdlibexecdir)/krb5_child
+	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/proxy_child
+	chmod 4750 $(DESTDIR)$(sssdlibexecdir)/proxy_child
 if BUILD_SEMANAGE
 	-chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/selinux_child
 	chmod 4750 $(DESTDIR)$(sssdlibexecdir)/selinux_child
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index 3cae1178783f7043ed31365e22abe5e884fa58b9..d4b2a93000ffa03cb135a4595a9669d008313836 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -780,7 +780,7 @@ rm -rf $RPM_BUILD_ROOT
 %files proxy
 %defattr(-,root,root,-)
 %doc COPYING
-%{_libexecdir}/%{servicename}/proxy_child
+%attr(4750,root,sssd) %{_libexecdir}/%{servicename}/proxy_child
 %{_libdir}/%{name}/libsss_proxy.so
 
 %files dbus
diff --git a/src/providers/proxy/proxy_init.c b/src/providers/proxy/proxy_init.c
index 791942420d2dd09d5d0ee1ca27e4969149f85ba3..0a6b11d4a3f102782322c913d280b26fe47aecab 100644
--- a/src/providers/proxy/proxy_init.c
+++ b/src/providers/proxy/proxy_init.c
@@ -515,7 +515,7 @@ int sssm_proxy_auth_init(struct be_ctx *bectx,
         goto done;
     }
 
-    ret = sbus_new_server(ctx, bectx->ev, sbus_address, 0, 0,
+    ret = sbus_new_server(ctx, bectx->ev, sbus_address, 0, bectx->gid,
                           false, &ctx->sbus_srv, proxy_client_init, ctx);
     if (ret != EOK) {
         DEBUG(SSSDBG_FATAL_FAILURE, "Could not set up sbus server.\n");
-- 
2.4.1



More information about the sssd-devel mailing list