Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PAC: add 'sssd' user to the list of 'allowed_uids' #7309

Closed
wants to merge 1 commit into from
Closed

PAC: add 'sssd' user to the list of 'allowed_uids' #7309

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions src/man/sssd.conf.5.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2293,11 +2293,22 @@ pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit
responder. User names are resolved to UIDs at
startup.
</para>
<para>
<para condition="with_non_root_user_support">
Default: 0, &sssd_user_name; (only root and SSSD
service users are allowed to access the PAC responder)
</para>
<para condition="without_non_root_user_support">
Default: 0 (only the root user is allowed to access
the PAC responder)
</para>
<para>
<para condition="with_non_root_user_support">
Please note that defaults will be overwritten with this
option. If you still want to allow the root and/or
'&sssd_user_name;' user to access the PAC responder,
which would be the typical case, you have to add those
to the list of allowed UIDs explicitly.
</para>
<para condition="without_non_root_user_support">
Please note that although the UID 0 is used as the
default it will be overwritten with this option. If
you still want to allow the root user to access the
Expand Down
5 changes: 5 additions & 0 deletions src/responder/pac/pacsrv.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,12 @@

#define SSS_PAC_PIPE_NAME "pac"
#define DEFAULT_PAC_FD_LIMIT 8192

#ifdef SSSD_NON_ROOT_USER
#define DEFAULT_ALLOWED_UIDS "0, sssd"
#else
#define DEFAULT_ALLOWED_UIDS "0"
#endif

int pac_process_init(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
Expand Down
Loading