|
 |
905b4d |
From f28c0df2ba8d3ba4632e3fa5cb395635470d3639 Mon Sep 17 00:00:00 2001
|
|
|
905b4d |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
905b4d |
Date: Fri, 24 Oct 2014 22:44:17 +0200
|
|
|
905b4d |
Subject: [PATCH 83/92] BUILD: Install krb5_child as suid if running under
|
|
|
905b4d |
non-privileged user
|
|
|
905b4d |
MIME-Version: 1.0
|
|
|
905b4d |
Content-Type: text/plain; charset=UTF-8
|
|
|
905b4d |
Content-Transfer-Encoding: 8bit
|
|
|
905b4d |
|
|
|
905b4d |
If sssd_be is running unprivileged, then krb5_child must be setuid to be
|
|
|
905b4d |
able to access the keytab and become arbitrary user.
|
|
|
905b4d |
|
|
|
905b4d |
Related:
|
|
|
905b4d |
https://fedorahosted.org/sssd/ticket/2370
|
|
|
905b4d |
|
|
|
905b4d |
Reviewed-by: Sumit Bose <sbose@redhat.com>
|
|
|
905b4d |
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
|
|
|
905b4d |
---
|
|
|
905b4d |
Makefile.am | 2 ++
|
|
|
905b4d |
contrib/sssd.spec.in | 2 +-
|
|
|
905b4d |
2 files changed, 3 insertions(+), 1 deletion(-)
|
|
|
905b4d |
|
|
|
905b4d |
diff --git a/Makefile.am b/Makefile.am
|
|
|
905b4d |
index b85341f5845c3cffab8a2c95b1be1d32517316e8..5f265dcefd16ce4efdde4d62f3cd5d02dbce255f 100644
|
|
|
905b4d |
--- a/Makefile.am
|
|
|
905b4d |
+++ b/Makefile.am
|
|
|
905b4d |
@@ -2872,6 +2872,8 @@ endif
|
|
|
905b4d |
if SSSD_USER
|
|
|
905b4d |
chgrp $(SSSD_USER) $(sssdlibexecdir)/ldap_child
|
|
|
905b4d |
chmod 4750 $(sssdlibexecdir)/ldap_child
|
|
|
905b4d |
+ chgrp $(SSSD_USER) $(sssdlibexecdir)/krb5_child
|
|
|
905b4d |
+ chmod 4750 $(sssdlibexecdir)/krb5_child
|
|
|
905b4d |
if BUILD_SEMANAGE
|
|
|
905b4d |
chgrp $(SSSD_USER) $(sssdlibexecdir)/selinux_child
|
|
|
905b4d |
chmod 4750 $(sssdlibexecdir)/selinux_child
|
|
|
905b4d |
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
|
|
|
905b4d |
index 5bfb16707c22dc65376581c88b8eb898949e726f..4734d124817cac860b7f6d9633b043df5aa591e8 100644
|
|
|
905b4d |
--- a/contrib/sssd.spec.in
|
|
|
905b4d |
+++ b/contrib/sssd.spec.in
|
|
|
905b4d |
@@ -646,7 +646,7 @@ rm -rf $RPM_BUILD_ROOT
|
|
|
905b4d |
%doc COPYING
|
|
|
905b4d |
%{_libdir}/%{name}/libsss_krb5_common.so
|
|
|
905b4d |
%attr(4750,root,sssd) %{_libexecdir}/%{servicename}/ldap_child
|
|
|
905b4d |
-%{_libexecdir}/%{servicename}/krb5_child
|
|
|
905b4d |
+%attr(4750,root,sssd) %{_libexecdir}/%{servicename}/krb5_child
|
|
|
905b4d |
|
|
|
905b4d |
%files krb5 -f sssd_krb5.lang
|
|
|
905b4d |
%defattr(-,root,root,-)
|
|
|
905b4d |
--
|
|
|
905b4d |
1.9.3
|
|
|
905b4d |
|