sssd-devel January 2015

sssd-devel@lists.fedorahosted.org

18 participants
89 discussions

[PATCH] SELINUX: Call setuid(0)/setgid(0) to also set the real IDs to root
by Jakub Hrozek 27 Jan '15

27 Jan '15

Hi, Please see the commit message and the ticket description. Also please note that if you're testing with a non-privileged user, you also need to set: allow sssd_selinux_manager_t self:capability setgid; allow sssd_selinux_manager_t self:capability setuid; Otherwise there will be AVC denials.

2 3

[PATCH] Monitor and sbus changes for running SSSD as a non-privileged user
by Jakub Hrozek 27 Jan '15

27 Jan '15

Hi, Attached are patches that perform changes in the monitor process and the low-level sbus and sysdb code required to run the NSS responder as a non-privileged user. Some of the patches call chmod/chown on files owned by the SSSD, so I'd like to request a very careful review. The patches depend on patches from threads: * SSSD: Add the options to specify a UID and GID to run as * Packaging fixes related to non-root SSSD I tried to explain the changes well in the commit messages. See below for some more and especially questions. [PATCH 1/7] SSSD: Load a user to run a service as from configuration Pretty much just loads the sssd user from configuration and stores the uid/gid. One question -- should the individual services or domain have a option to ignore the sssd user? For instance: [sssd] user = sssd group = sssd [nss] # Would run as SSSD [pam] # Would run as root/whatever user monitor runs as ignore_sssd_user = True This would mostly be a fallback for cases where we introduce a bug. I don't think this kind of granularity is needed, the user can just run sssd as root completely: [sssd] user = root group = root [PATCH 2/7] SBUS: Chown the sbus socket if needed Chowns the monitor sbus socket if a non-root sssd user is specified. I don't think we allow more privileges than before, the monitor socket has permissions 0600 and is owned by sssd.sssd, so only the private user and root (who bypasses DAC checks anyway) can access it. In sbus_new_server(), we can open the socket after dbus creates it and call fchmod() and fchown() to avoid some kind of TOCTOU races. But I'm not sure this is needed given that a privileged process will create the pipes. [PATCH 3/7] SBUS: Allow connections from other UIDs A simple patch, allows connections from the sssd user. Please see the commit message for more details. This patch (and the previous) should have a unit test, but currently our sbus tests are tightly tied to the check framework. I need to change the common code to be test framework-agnostic, but I don't want to delay the inclusion of these patches. [PATCH 4/7] BE: Own the sbus socket as the SSSD user Same as the two previous patches, just for the sssd_be process. [PATCH 5/7] MONITOR: Allow confdb to be accessed by nonroot user Confdb is created by the privileged monitor process, but needs to be accessed by nonprivileged responder processes. chown it after creation. [PATCH 6/7] SYSDB: Allow calling chown on the sysdb file from monitor Same as the previous one, just for the sysdb. [PATCH 7/7] NSS: Run as a user specified by monitor With this patch, it's possible to run the NSS responder as a non-privileged user.

4 38

[PATCH] TOOLS: add missing '\n' in debug messages
by Pavel Reichl 27 Jan '15

27 Jan '15

Hello, please see this trivial patch. Thanks!

4 10

[PATCH] IPA: Use attr's dom for users, too
by Jakub Hrozek 27 Jan '15

27 Jan '15

Hi, I found one bug while testing Sumit's patches. To reproduce, request a universal group on an IPA client. The group must have members from two different trusted AD domains.

2 2

[PATCH] IPA: process_members() add ghosts only once
by Sumit Bose 26 Jan '15

26 Jan '15

Hi, this patch fixes an issue caused by https://fedorahosted.org/sssd/ticket/2567 on the IPA client side. If on the IPA server side a group member is returned twice for a universal group the extdom plugin will deliver this duplicated entry to the IPA client. On the client side saving this list to the cache will fail with a LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS error. With this patch the duplicated entries are filtered out. bye, Sumit

2 3

[PATCH] IPA: resolve IPA group-memberships for AD users
by Sumit Bose 26 Jan '15

26 Jan '15

Hi, this patch is a follow-up for the recent HBAC fixes. It turned out that the originalMemberOf attributes of AD users for IPA groups can be removed by some user lookups. To reproduce call # sss_cache -E # id aduser(a)ad.domain # ldbsearch -H /var/lib/sss/db/cache_ipa.domain.ldb name=aduser(a)ad.domain memberof originalMemberOf here originalMemberOf should be available for all AD and IPA groups. # sss_cache -E # getent passwd aduser(a)ad.domain # ldbsearch -H /var/lib/sss/db/cache_ipa.domain.ldb name=aduser(a)ad.domain memberof originalMemberOf now originalMemberOf only show AD groups. bye, Sumit

2 3

[PATCHES] AD: support for AD site override
by Pavel Reichl 26 Jan '15

26 Jan '15

Please see attached patches. Thanks.

6 16

[PATCH] sysdb: remove ghosts in all sub-domains as well
by Sumit Bose 23 Jan '15

23 Jan '15

Hi, this patch fixes an issue with the handling of universal groups. You can reproduce it with the following steps either with the AD provider in an AD forest with multiple domains or with the IPA provider and trust to an AD forest with multiple domains and a universal group: - start with an empty cache - getent group universal_group(a)dom1.ad - ldbsearch -H /path/to/cache name=universal_group(a)dom1.ad the cached object only has ghost members because no users are resolved - getent passwd group_member(a)dom2.ad - ldbsearch -H /path/to/cache name=universal_group(a)dom1.ad if a group member from a different domain than the group itself is resolved the ghost entry is not removed. bye, Sumit

2 3

[PATCHES] sbus: move some general code from ifp to sbus
by Pavel Březina 23 Jan '15

23 Jan '15

Hi, Patch 0001: Moves few object path functions from IFP to sbus. Patch 0002: Adds a new function that retrieves unescaped object name. Patch 0003: Fixes a potential memory leak.

2 4

[PATCH] BUILD: Include python-test.py in the tarball
by Jakub Hrozek 23 Jan '15

23 Jan '15

Hi, I think we forgot to include one file in the tarball. Patches that touch the file can't be applied downstream.

2 2

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel January 2015