spec: change passkey_child owner

[ikerexxe]

passkey_child owner was incorrectly set to $sssd_user:$sssd_user, when it should be root:$sssd_user. Correcting it.

Fixes: 30daa0c ("spec: update to include passkey")

[alexey-tikhonov]

ACK, thanks.

[alexey-tikhonov]

Actually... it's unclear if group should be '%{sssd_user}'

Currently the logic is following:

• non-privileged binaries are root:root and '-rwxr-xr-x' - executable by anyone
• privileged binaries (+ 'proxy_child') are root:sssd and '-rwxr-x---' - executable only by user and group

The idea is to restrict UIDs able to run privileged binaries.

Since 'passkey_child' isn't privileged, following this logic it should be 'root:root'
Another question, if it actually makes any sense to allow it to be executable by anyone... Maybe for debug purposes? As it happens with 'p11_child'.

Another note: if we stick to root:sssd, then Makefile.am :: install-exec-hook also should be updated:
https://github.com/SSSD/sssd/blob/master/Makefile.am#L5584
to have consistent results for rpm and 'make install'.

[ikerexxe]

mmm I don't have a strong position in any sense. @sumit-bose WDYT?

[sumit-bose]

Hi,

I think it would make sense to follow Alexey's "non-privileged binaries" reasoning and use root as group as well.

About "executable by anyone", since users should be able to register their keys with the sssctl or ipa command I guess this is needed.

HTH

bye,
Sumit

[alexey-tikhonov]

About "executable by anyone", since users should be able to register their keys with the sssctl or ipa command I guess this is needed.

Ah, indeed, thank you.

@ikerexxe , then please make it root:root, as 'p11_child'.

[alexey-tikhonov]

Pushed PR: #7431

• master
  • bb72b53 - spec: change passkey_child owner
• sssd-2-9
  • ee8de7e - spec: change passkey_child owner