summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorLukas Slebodnik <lslebodn@redhat.com>2015-05-27 14:49:14 +0200
committerJakub Hrozek <jhrozek@redhat.com>2015-05-31 19:35:27 +0200
commit1370bcccaed090f36d75e8a8cebb320ea1612b7e (patch)
treebea3a3e65a994920561174ec2b45ba1479052e9c /src
parentee44aac95e42c3cb634876286a2aa4960ac69a2b (diff)
downloadsssd-1370bcccaed090f36d75e8a8cebb320ea1612b7e.tar.gz
sssd-1370bcccaed090f36d75e8a8cebb320ea1612b7e.tar.xz
sssd-1370bcccaed090f36d75e8a8cebb320ea1612b7e.zip
PROXY: proxy_child should work in non-root mode
According to design page[1], proxy_child should run with root privileges in non-root mode however proxy_child did not have setuid bit. After setting setuid bit proxy_child will be executed with extra privileges. The effective user ID will be 0 but effective group ID will be still the same as egid of sssd_be. Therefore gid of private pipe for proxy_child should be the same. Otherwise proxy_child will fail due to wrong permissions of unix pipe (sbus_client_init -> check_file) [1] https://fedorahosted.org/sssd/wiki/DesignDocs/NotRootSSSD Resolves: https://fedorahosted.org/sssd/ticket/2655 Reviewed-by: Michal Židek <mzidek@redhat.com>
Diffstat (limited to 'src')
-rw-r--r--src/providers/proxy/proxy_init.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/providers/proxy/proxy_init.c b/src/providers/proxy/proxy_init.c
index 791942420..0a6b11d4a 100644
--- a/src/providers/proxy/proxy_init.c
+++ b/src/providers/proxy/proxy_init.c
@@ -515,7 +515,7 @@ int sssm_proxy_auth_init(struct be_ctx *bectx,
goto done;
}
- ret = sbus_new_server(ctx, bectx->ev, sbus_address, 0, 0,
+ ret = sbus_new_server(ctx, bectx->ev, sbus_address, 0, bectx->gid,
false, &ctx->sbus_srv, proxy_client_init, ctx);
if (ret != EOK) {
DEBUG(SSSDBG_FATAL_FAILURE, "Could not set up sbus server.\n");