Fields changed

description: The interface need to have a mode in which it enforces some security checks on the file it is going to read.

Here is the part of the IRC discation that lead to creation of this ticket:

For the log config files, it would probably be smart to ensure that it will only load those that are unreadable/writeable by anyone but root.
sgallagh, good point but then it should be a part of the INI interface.
sgallagh, something like "enforce security flag"
sgallagh, that will force the checks when ini file is open
dpal: Not a bad idea.
sgallagh, I will add a ticket to capture this idea
dpal: Rather than just a security flag, it should probably be a mask.
dpal: That way users of the interface can specify which portions of the file must be unreadable and by whom.
sgallagh, portions of the file? You mean sections on the INI?
sorry, bad choice of words
in terms of rwxrwxr-- (for example).
sgallagh, in general - ownership and permission rules for the file
It should be possible with a mask to say "Only open this if only owner and group has write access" or, more restrictively "Only if owner has read access"
and owner is root
or root and admin
Yeah, that would be another parameter. Valid user id.
Or group id
it would be one parameter - security descriptor :)
One would create security descriptor with rules and pass it in.
If the argument is NULL - no checks, if security descriptor is passed, the file will be validated based on the rules defined in the descriptor.
sgallagh, something like this...

Simo brought a point that SELinux would do. So this is an ER for consider in future when we port to other platforms. => The interface need to have a mode in which it enforces some security checks on the file it is going to read.

Here is the part of the IRC discussion that lead to creation of this ticket:

For the log config files, it would probably be smart to ensure that it will only load those that are unreadable/writeable by anyone but root.

sgallagh, good point but then it should be a part of the INI interface.

sgallagh, something like "enforce security flag"

sgallagh, that will force the checks when ini file is open

dpal: Not a bad idea.

sgallagh, I will add a ticket to capture this idea

dpal: Rather than just a security flag, it should probably be a mask.

dpal: That way users of the interface can specify which portions of the file must be unreadable and by whom.

sgallagh, portions of the file? You mean sections on the INI?

sorry, bad choice of words

in terms of rwxrwxr-- (for example).

sgallagh, in general - ownership and permission rules for the file

It should be possible with a mask to say "Only open this if only owner and group has write access" or, more restrictively "Only if owner has read access"

and owner is root

or root and admin

Yeah, that would be another parameter. Valid user id.

Or group id

it would be one parameter - security descriptor :)

One would create security descriptor with rules and pass it in.

If the argument is NULL - no checks, if security descriptor is passed, the file will be validated based on the rules defined in the descriptor.

sgallagh, something like this...

Simo brought a point that SELinux would do. So this is an ER for consider in future when we port to other platforms.

Fields changed

component: SSSD => INI Parser
owner: somebody => dpal

This is required for ELAPI troubleshooting tool.

doc: => 0
docupdated: => 0
proposed: => 1.3
tests: => 0
testsupdated: => 0

The checks are there now. See the metadata related part of the interface.

Commit: bf7247298136660f512bd1a96f68be1487f425b6

Should be reworked on top of the new interface.

milestone: SSSD Deferred => Tools 1.0

Fields changed

rhbz: => 0

The new interface also has this function.

blockedby: =>
blocking: =>
coverity: =>
feature_milestone: =>
milestone: Tools Backlog => Tools 1.0
patch: => 0

Fields changed

design: =>
design_review: => 0
fedora_test_page: =>
resolution: => fixed
status: new => closed