SSSD / sssd

#3621 FleetCommander integration must not require capability DAC_OVERRIDE
Closed: Fixed Opened by lslebodn.

Closed: Fixed
Reopen Issue

Manual pages for linux capabilities says

       CAP_DAC_OVERRIDE
              Bypass file read, write, and execute permission checks.  (DAC is
              an abbreviation of "discretionary access control".)

It is a dangerous capability which root has by default but it makes it much harder to run daemon in non-privilege mode.

The related design page[1] says a very little to the related file directory structure

So each per-user JSON file would be stored at /var/lib/sss/deskprofile/<domain>/<username>/<profilename>.json. The <username> directories need to be owned by the user being logged in.

it woudl be good to elaborate there more and specify who should have which access to files (rw, ro, ...)

[1] https://docs.pagure.org/SSSD.sssd/design_pages/fleet_commander_integration.html

Assigning to author of this feature to at least update design page.

Metadata Update from @lslebodn:
- Issue assigned to fidencio

PR: https://github.com/SSSD/sssd/pull/498
Edited by lslebodn

Metadata Update from @fidencio:
- Custom field patch adjusted to on

Design page PR: https://pagure.io/SSSD/docs/pull-request/62

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.16.2

Metadata Update from @jhrozek:
- Issue tagged with: PR

master:

  • f0cbe890adf696d8318373203580d709f3d38d8c
  • 1a011c4f20e80f2bcb4d10a4d690b3a88c2fd70d
  • 07ae0da06c0d94a3198e484d0de28c9282c4d6cd
  • 2c5b03913c54234efdabcff83de368bae72dc799
  • b576b290d3d7e165269edf36d6be27bc1441a688
  • 0fce902c563c3b54f2e67235668273ff7ff40752

Bug fix found by coverity:

  • 0633e97cfd6a696c19e19219e3de1cda7c7ee7b4
Edited by lslebodn

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.16.1 (was: SSSD 1.16.2)

Design page has been updated, PRs have been merged.
There's already another ticket to track Fleet Commander usage when running SSSD as unprivileged user.

I'm closing this ticket.

Metadata Update from @fidencio:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

And here's the reference to the other ticket mentioned: https://pagure.io/SSSD/sssd/issue/3638

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4642

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata

PR

None
None
None
None
on
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.