From 1370bcccaed090f36d75e8a8cebb320ea1612b7e Mon Sep 17 00:00:00 2001 From: Lukas Slebodnik Date: Wed, 27 May 2015 14:49:14 +0200 Subject: PROXY: proxy_child should work in non-root mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit According to design page[1], proxy_child should run with root privileges in non-root mode however proxy_child did not have setuid bit. After setting setuid bit proxy_child will be executed with extra privileges. The effective user ID will be 0 but effective group ID will be still the same as egid of sssd_be. Therefore gid of private pipe for proxy_child should be the same. Otherwise proxy_child will fail due to wrong permissions of unix pipe (sbus_client_init -> check_file) [1] https://fedorahosted.org/sssd/wiki/DesignDocs/NotRootSSSD Resolves: https://fedorahosted.org/sssd/ticket/2655 Reviewed-by: Michal Židek --- Makefile.am | 2 ++ 1 file changed, 2 insertions(+) (limited to 'Makefile.am') diff --git a/Makefile.am b/Makefile.am index 1970b812e..9927391fe 100644 --- a/Makefile.am +++ b/Makefile.am @@ -3344,6 +3344,8 @@ if SSSD_USER chmod 4750 $(DESTDIR)$(sssdlibexecdir)/ldap_child -chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/krb5_child chmod 4750 $(DESTDIR)$(sssdlibexecdir)/krb5_child + -chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/proxy_child + chmod 4750 $(DESTDIR)$(sssdlibexecdir)/proxy_child if BUILD_SEMANAGE -chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/selinux_child chmod 4750 $(DESTDIR)$(sssdlibexecdir)/selinux_child -- cgit