diff options
Diffstat (limited to 'src/sbus')
-rw-r--r-- | src/sbus/sbus_client.c | 15 | ||||
-rw-r--r-- | src/sbus/sssd_dbus.h | 1 | ||||
-rw-r--r-- | src/sbus/sssd_dbus_server.c | 18 |
3 files changed, 30 insertions, 4 deletions
diff --git a/src/sbus/sbus_client.c b/src/sbus/sbus_client.c index 6cf5002dc..8ad4c0f36 100644 --- a/src/sbus/sbus_client.c +++ b/src/sbus/sbus_client.c @@ -32,6 +32,8 @@ int sbus_client_init(TALLOC_CTX *mem_ctx, struct sbus_connection *conn = NULL; int ret; char *filename; + uid_t check_uid; + gid_t check_gid; /* Validate input */ if (server_address == NULL) { @@ -45,8 +47,17 @@ int sbus_client_init(TALLOC_CTX *mem_ctx, return EIO; } - ret = check_file(filename, - 0, 0, S_IFSOCK|S_IRUSR|S_IWUSR, 0, NULL, true); + check_uid = geteuid(); + check_gid = getegid(); + + /* Ignore ownership checks when the server runs as root. This is the + * case when privileged monitor is setting up sockets for unprivileged + * responders */ + if (check_uid == 0) check_uid = -1; + if (check_gid == 0) check_gid = -1; + + ret = check_file(filename, check_uid, check_gid, + S_IFSOCK|S_IRUSR|S_IWUSR, 0, NULL, true); if (ret != EOK) { DEBUG(SSSDBG_CRIT_FAILURE, "check_file failed for [%s].\n", filename); return EIO; diff --git a/src/sbus/sssd_dbus.h b/src/sbus/sssd_dbus.h index 372521a35..d01926368 100644 --- a/src/sbus/sssd_dbus.h +++ b/src/sbus/sssd_dbus.h @@ -132,6 +132,7 @@ sbus_new_interface(TALLOC_CTX *mem_ctx, int sbus_new_server(TALLOC_CTX *mem_ctx, struct tevent_context *ev, const char *address, + uid_t uid, gid_t gid, bool use_symlink, struct sbus_connection **server, sbus_server_conn_init_fn init_fn, void *init_pvt_data); diff --git a/src/sbus/sssd_dbus_server.c b/src/sbus/sssd_dbus_server.c index 3a7de8ff0..18fb98df6 100644 --- a/src/sbus/sssd_dbus_server.c +++ b/src/sbus/sssd_dbus_server.c @@ -181,6 +181,7 @@ remove_socket_symlink(const char *symlink_name) int sbus_new_server(TALLOC_CTX *mem_ctx, struct tevent_context *ev, const char *address, + uid_t uid, gid_t gid, bool use_symlink, struct sbus_connection **_server, sbus_server_conn_init_fn init_fn, @@ -260,9 +261,22 @@ int sbus_new_server(TALLOC_CTX *mem_ctx, if ((stat_buf.st_mode & ~S_IFMT) != (S_IRUSR|S_IWUSR)) { ret = chmod(filename, (S_IRUSR|S_IWUSR)); if (ret != EOK) { + ret = errno; + DEBUG(SSSDBG_CRIT_FAILURE, + "chmod failed for [%s]: [%d][%s].\n", filename, ret, + sss_strerror(ret)); + ret = EIO; + goto done; + } + } + + if (stat_buf.st_uid != uid || stat_buf.st_gid != gid) { + ret = chown(filename, uid, gid); + if (ret != EOK) { + ret = errno; DEBUG(SSSDBG_CRIT_FAILURE, - "chmod failed for [%s]: [%d][%s].\n", filename, errno, - strerror(errno)); + "chown failed for [%s]: [%d][%s].\n", filename, ret, + sss_strerror(ret)); ret = EIO; goto done; } |