|
 |
b2d430 |
From 711a29023252013a8451ee1b90f045782fee1a38 Mon Sep 17 00:00:00 2001
|
|
|
b2d430 |
From: Lukas Slebodnik <lslebodn@redhat.com>
|
|
|
b2d430 |
Date: Fri, 19 Aug 2016 10:46:12 +0200
|
|
|
b2d430 |
Subject: [PATCH 118/121] BUILD: Allow to read private pipes for root
|
|
|
b2d430 |
|
|
|
b2d430 |
Root can read anything from any directory even with permissions 000.
|
|
|
b2d430 |
|
|
|
b2d430 |
However SELinux checks discretionary access control (DAC)
|
|
|
b2d430 |
and deny access if access is not allowed for root by DAC.
|
|
|
b2d430 |
The pam_sss use different unix socket /var/lib/sss/pipes/private/pam
|
|
|
b2d430 |
for user with uid 0. Therefore root need to be able read content
|
|
|
b2d430 |
of directory with private pipes.
|
|
|
b2d430 |
|
|
|
b2d430 |
type=AVC msg=audit(08/19/2016 10:58:34.081:3369) : avc: denied
|
|
|
b2d430 |
{ dac_read_search } for pid=20257 comm=vsftpd capability=dac_read_search
|
|
|
b2d430 |
scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
|
|
|
b2d430 |
tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability
|
|
|
b2d430 |
|
|
|
b2d430 |
type=AVC msg=audit(08/19/2016 10:58:34.081:3369) : avc: denied
|
|
|
b2d430 |
{ dac_override } for pid=20257 comm=vsftpd capability=dac_override
|
|
|
b2d430 |
scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
|
|
|
b2d430 |
tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability
|
|
|
b2d430 |
|
|
|
b2d430 |
Resolves:
|
|
|
b2d430 |
https://fedorahosted.org/sssd/ticket/3143
|
|
|
b2d430 |
|
|
|
b2d430 |
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
b2d430 |
---
|
|
|
b2d430 |
Makefile.am | 8 ++++----
|
|
|
b2d430 |
contrib/sssd.spec.in | 2 +-
|
|
|
b2d430 |
2 files changed, 5 insertions(+), 5 deletions(-)
|
|
|
b2d430 |
|
|
|
b2d430 |
diff --git a/Makefile.am b/Makefile.am
|
|
|
b2d430 |
index 6ab4399d5b68644668198bc9b0e3056562a4e51a..b8cd8b64ca8a130a5dd3107e1fb1445310192059 100644
|
|
|
b2d430 |
--- a/Makefile.am
|
|
|
b2d430 |
+++ b/Makefile.am
|
|
|
b2d430 |
@@ -3967,7 +3967,6 @@ SSSD_USER_DIRS = \
|
|
|
b2d430 |
$(DESTDIR)$(keytabdir) \
|
|
|
b2d430 |
$(DESTDIR)$(mcpath) \
|
|
|
b2d430 |
$(DESTDIR)$(pipepath) \
|
|
|
b2d430 |
- $(DESTDIR)$(pipepath)/private \
|
|
|
b2d430 |
$(DESTDIR)$(pubconfpath) \
|
|
|
b2d430 |
$(DESTDIR)$(pubconfpath)/krb5.include.d \
|
|
|
b2d430 |
$(DESTDIR)$(gpocachepath) \
|
|
|
b2d430 |
@@ -3994,16 +3993,17 @@ installsssddirs::
|
|
|
b2d430 |
$(DESTDIR)$(sssddatadir) \
|
|
|
b2d430 |
$(DESTDIR)$(sudolibdir) \
|
|
|
b2d430 |
$(DESTDIR)$(autofslibdir) \
|
|
|
b2d430 |
+ $(DESTDIR)$(pipepath)/private \
|
|
|
b2d430 |
$(SSSD_USER_DIRS) \
|
|
|
b2d430 |
$(NULL);
|
|
|
b2d430 |
if SSSD_USER
|
|
|
b2d430 |
- -chown $(SSSD_USER):$(SSSD_USER) \
|
|
|
b2d430 |
- $(SSSD_USER_DIRS)
|
|
|
b2d430 |
+ -chown $(SSSD_USER):$(SSSD_USER) $(SSSD_USER_DIRS)
|
|
|
b2d430 |
+ -chown $(SSSD_USER) $(DESTDIR)$(pipepath)/private
|
|
|
b2d430 |
endif
|
|
|
b2d430 |
$(INSTALL) -d -m 0700 $(DESTDIR)$(dbpath) $(DESTDIR)$(logpath) \
|
|
|
b2d430 |
- $(DESTDIR)$(pipepath)/private \
|
|
|
b2d430 |
$(DESTDIR)$(keytabdir) \
|
|
|
b2d430 |
$(NULL)
|
|
|
b2d430 |
+ $(INSTALL) -d -m 0750 $(DESTDIR)$(pipepath)/private
|
|
|
b2d430 |
$(INSTALL) -d -m 0755 $(DESTDIR)$(mcpath) $(DESTDIR)$(pipepath) \
|
|
|
b2d430 |
$(DESTDIR)$(pubconfpath) \
|
|
|
b2d430 |
$(DESTDIR)$(pubconfpath)/krb5.include.d $(DESTDIR)$(gpocachepath)
|
|
|
b2d430 |
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
|
|
|
b2d430 |
index f1ff16176cb8ca974b98948958cfa1e9290b0bca..cb68a73e85122b016de7df37bcf4fc232a10a2ac 100644
|
|
|
b2d430 |
--- a/contrib/sssd.spec.in
|
|
|
b2d430 |
+++ b/contrib/sssd.spec.in
|
|
|
b2d430 |
@@ -784,7 +784,7 @@ done
|
|
|
b2d430 |
%ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/group
|
|
|
b2d430 |
%ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/initgroups
|
|
|
b2d430 |
%attr(755,sssd,sssd) %dir %{pipepath}
|
|
|
b2d430 |
-%attr(700,sssd,sssd) %dir %{pipepath}/private
|
|
|
b2d430 |
+%attr(750,sssd,root) %dir %{pipepath}/private
|
|
|
b2d430 |
%attr(755,sssd,sssd) %dir %{pubconfpath}
|
|
|
b2d430 |
%attr(755,sssd,sssd) %dir %{gpocachepath}
|
|
|
b2d430 |
%attr(750,sssd,sssd) %dir %{_var}/log/%{name}
|
|
|
b2d430 |
--
|
|
|
b2d430 |
2.4.11
|
|
|
b2d430 |
|