From f3dd66fe97ca5938f7bd19d051092ef92d7efad4 Mon Sep 17 00:00:00 2001 From: Alexey Tikhonov Date: Wed, 27 Nov 2024 15:42:45 +0100 Subject: [PATCH] KRB5: 'krb5_child' doesn't require effective capabilities --- Makefile.am | 2 +- contrib/sssd.spec.in | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile.am b/Makefile.am index 7d1ea27047..eed526250e 100644 --- a/Makefile.am +++ b/Makefile.am @@ -5554,7 +5554,7 @@ if SSSD_USER -$(SETCAP) cap_dac_read_search=p $(DESTDIR)$(sssdlibexecdir)/ldap_child -chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/krb5_child chmod 750 $(DESTDIR)$(sssdlibexecdir)/krb5_child - -$(SETCAP) cap_dac_read_search,cap_setuid,cap_setgid=ep $(DESTDIR)$(sssdlibexecdir)/krb5_child + -$(SETCAP) cap_dac_read_search,cap_setuid,cap_setgid=p $(DESTDIR)$(sssdlibexecdir)/krb5_child -chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/proxy_child chmod 750 $(DESTDIR)$(sssdlibexecdir)/proxy_child -chgrp $(SSSD_USER) $(DESTDIR)$(sssdlibexecdir)/sssd_pam diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index 66798a3fa6..9700c7210b 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -914,7 +914,7 @@ install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf %license COPYING %attr(775,%{sssd_user},%{sssd_user}) %dir %{pubconfpath}/krb5.include.d %attr(0750,root,%{sssd_user}) %caps(cap_dac_read_search=p) %{_libexecdir}/%{servicename}/ldap_child -%attr(0750,root,%{sssd_user}) %caps(cap_dac_read_search,cap_setuid,cap_setgid=ep) %{_libexecdir}/%{servicename}/krb5_child +%attr(0750,root,%{sssd_user}) %caps(cap_dac_read_search,cap_setuid,cap_setgid=p) %{_libexecdir}/%{servicename}/krb5_child %files krb5 -f sssd_krb5.lang %license COPYING