|
 |
d6181b |
From 9339c445b4b98a28146ff834fec2af42bd3a6340 Mon Sep 17 00:00:00 2001
|
|
|
d6181b |
From: Sumit Bose <sbose@redhat.com>
|
|
|
d6181b |
Date: Mon, 5 Aug 2019 17:05:00 +0200
|
|
|
d6181b |
Subject: [PATCH 16/16] BE: make sure child log files have the right
|
|
|
d6181b |
permissions
|
|
|
d6181b |
|
|
|
d6181b |
If SSSD runs a unprivileged user we should make sure the log files for
|
|
|
d6181b |
child processes have the right permission so that the child process can
|
|
|
d6181b |
write to them.
|
|
|
d6181b |
|
|
|
d6181b |
Related to https://pagure.io/SSSD/sssd/issue/4056
|
|
|
d6181b |
|
|
|
d6181b |
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
d6181b |
---
|
|
|
d6181b |
src/providers/data_provider_be.c | 23 +++++++++++++++++++++++
|
|
|
d6181b |
1 file changed, 23 insertions(+)
|
|
|
d6181b |
|
|
|
d6181b |
diff --git a/src/providers/data_provider_be.c b/src/providers/data_provider_be.c
|
|
|
d6181b |
index 6dce8286d..ce00231ff 100644
|
|
|
d6181b |
--- a/src/providers/data_provider_be.c
|
|
|
d6181b |
+++ b/src/providers/data_provider_be.c
|
|
|
d6181b |
@@ -554,6 +554,27 @@ done:
|
|
|
d6181b |
return ret;
|
|
|
d6181b |
}
|
|
|
d6181b |
|
|
|
d6181b |
+static void fix_child_log_permissions(uid_t uid, gid_t gid)
|
|
|
d6181b |
+{
|
|
|
d6181b |
+ int ret;
|
|
|
d6181b |
+ const char *child_names[] = { "krb5_child",
|
|
|
d6181b |
+ "ldap_child",
|
|
|
d6181b |
+ "selinux_child",
|
|
|
d6181b |
+ "ad_gpo_child",
|
|
|
d6181b |
+ "proxy_child",
|
|
|
d6181b |
+ NULL };
|
|
|
d6181b |
+ size_t c;
|
|
|
d6181b |
+
|
|
|
d6181b |
+ for (c = 0; child_names[c] != NULL; c++) {
|
|
|
d6181b |
+ ret = chown_debug_file(child_names[c], uid, gid);
|
|
|
d6181b |
+ if (ret != EOK) {
|
|
|
d6181b |
+ DEBUG(SSSDBG_MINOR_FAILURE,
|
|
|
d6181b |
+ "Cannot chown the [%s] debug file, "
|
|
|
d6181b |
+ "debugging might not work!\n", child_names[c]);
|
|
|
d6181b |
+ }
|
|
|
d6181b |
+ }
|
|
|
d6181b |
+}
|
|
|
d6181b |
+
|
|
|
d6181b |
static void dp_initialized(struct tevent_req *req)
|
|
|
d6181b |
{
|
|
|
d6181b |
struct tevent_signal *tes;
|
|
|
d6181b |
@@ -609,6 +630,8 @@ static void dp_initialized(struct tevent_req *req)
|
|
|
d6181b |
"Cannot chown the debug files, debugging might not work!\n");
|
|
|
d6181b |
}
|
|
|
d6181b |
|
|
|
d6181b |
+ fix_child_log_permissions(be_ctx->uid, be_ctx->gid);
|
|
|
d6181b |
+
|
|
|
d6181b |
ret = become_user(be_ctx->uid, be_ctx->gid);
|
|
|
d6181b |
if (ret != EOK) {
|
|
|
d6181b |
DEBUG(SSSDBG_FUNC_DATA,
|
|
|
d6181b |
--
|
|
|
d6181b |
2.20.1
|
|
|
d6181b |
|