diff options
author | Jakub Hrozek <jhrozek@redhat.com> | 2014-10-07 11:30:01 +0200 |
---|---|---|
committer | Jakub Hrozek <jhrozek@redhat.com> | 2014-10-22 15:44:17 +0200 |
commit | 5960687483a5d3d99093c9d6ab64e11c9bde7f7b (patch) | |
tree | e5b06570880583f579635b7112eae16dee235ed5 /src/sbus | |
parent | a10ac1d0a7210def232205a48c53a075930e82f6 (diff) | |
download | sssd-5960687483a5d3d99093c9d6ab64e11c9bde7f7b.tar.gz sssd-5960687483a5d3d99093c9d6ab64e11c9bde7f7b.tar.xz sssd-5960687483a5d3d99093c9d6ab64e11c9bde7f7b.zip |
SBUS: Chown the sbus socket if needed
When setting up the sbus server, we might need to chown the sbus socket
to make sure non-root peers, running as the SSSD user are able to access
the file.
Reviewed-by: Pavel Reichl <preichl@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Diffstat (limited to 'src/sbus')
-rw-r--r-- | src/sbus/sbus_client.c | 15 | ||||
-rw-r--r-- | src/sbus/sssd_dbus.h | 1 | ||||
-rw-r--r-- | src/sbus/sssd_dbus_server.c | 18 |
3 files changed, 30 insertions, 4 deletions
diff --git a/src/sbus/sbus_client.c b/src/sbus/sbus_client.c index 6cf5002dc..8ad4c0f36 100644 --- a/src/sbus/sbus_client.c +++ b/src/sbus/sbus_client.c @@ -32,6 +32,8 @@ int sbus_client_init(TALLOC_CTX *mem_ctx, struct sbus_connection *conn = NULL; int ret; char *filename; + uid_t check_uid; + gid_t check_gid; /* Validate input */ if (server_address == NULL) { @@ -45,8 +47,17 @@ int sbus_client_init(TALLOC_CTX *mem_ctx, return EIO; } - ret = check_file(filename, - 0, 0, S_IFSOCK|S_IRUSR|S_IWUSR, 0, NULL, true); + check_uid = geteuid(); + check_gid = getegid(); + + /* Ignore ownership checks when the server runs as root. This is the + * case when privileged monitor is setting up sockets for unprivileged + * responders */ + if (check_uid == 0) check_uid = -1; + if (check_gid == 0) check_gid = -1; + + ret = check_file(filename, check_uid, check_gid, + S_IFSOCK|S_IRUSR|S_IWUSR, 0, NULL, true); if (ret != EOK) { DEBUG(SSSDBG_CRIT_FAILURE, "check_file failed for [%s].\n", filename); return EIO; diff --git a/src/sbus/sssd_dbus.h b/src/sbus/sssd_dbus.h index 372521a35..d01926368 100644 --- a/src/sbus/sssd_dbus.h +++ b/src/sbus/sssd_dbus.h @@ -132,6 +132,7 @@ sbus_new_interface(TALLOC_CTX *mem_ctx, int sbus_new_server(TALLOC_CTX *mem_ctx, struct tevent_context *ev, const char *address, + uid_t uid, gid_t gid, bool use_symlink, struct sbus_connection **server, sbus_server_conn_init_fn init_fn, void *init_pvt_data); diff --git a/src/sbus/sssd_dbus_server.c b/src/sbus/sssd_dbus_server.c index 3a7de8ff0..18fb98df6 100644 --- a/src/sbus/sssd_dbus_server.c +++ b/src/sbus/sssd_dbus_server.c @@ -181,6 +181,7 @@ remove_socket_symlink(const char *symlink_name) int sbus_new_server(TALLOC_CTX *mem_ctx, struct tevent_context *ev, const char *address, + uid_t uid, gid_t gid, bool use_symlink, struct sbus_connection **_server, sbus_server_conn_init_fn init_fn, @@ -260,9 +261,22 @@ int sbus_new_server(TALLOC_CTX *mem_ctx, if ((stat_buf.st_mode & ~S_IFMT) != (S_IRUSR|S_IWUSR)) { ret = chmod(filename, (S_IRUSR|S_IWUSR)); if (ret != EOK) { + ret = errno; + DEBUG(SSSDBG_CRIT_FAILURE, + "chmod failed for [%s]: [%d][%s].\n", filename, ret, + sss_strerror(ret)); + ret = EIO; + goto done; + } + } + + if (stat_buf.st_uid != uid || stat_buf.st_gid != gid) { + ret = chown(filename, uid, gid); + if (ret != EOK) { + ret = errno; DEBUG(SSSDBG_CRIT_FAILURE, - "chmod failed for [%s]: [%d][%s].\n", filename, errno, - strerror(errno)); + "chown failed for [%s]: [%d][%s].\n", filename, ret, + sss_strerror(ret)); ret = EIO; goto done; } |