#3890 SSSD changes the memory cache file ownership away from the SSSD user when running as root
Closed: Fixed 5 years ago by jhrozek. Opened 5 years ago by jhrozek.

In case SSSD is compiled --with-sssd-user but run as root (which is the default on RHEL and derivatives), then the memory cache will be owned by the user that sssd_nss runs as, so root.

This conflicts with the packaging which specifies sssd.sssd as the owner. And in turn, this means that users can't reliably assess the package integrity using rpm -V.

We can't just switch the file ownership as this would just revert the problem. But we can chown the memory cache files to sssd.sssd on runtime, provided that the nss process would be a member of the sssd group and the memory cache files were writable by the group.


Metadata Update from @jhrozek:
- Issue assigned to jhrozek

5 years ago

Metadata Update from @jhrozek:
- Issue tagged with: PR

5 years ago

Not closing yet because we still need a 1.16 backport

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 2.1

5 years ago

Metadata Update from @jhrozek:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1576524

5 years ago

Metadata Update from @jhrozek:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

5 years ago

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4876

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Login to comment on this ticket.

Metadata