From 186276c157f35827a017c740dd778c912dbcef30 Mon Sep 17 00:00:00 2001 From: Fabiano Fidêncio Date: Feb 15 2018 15:12:19 +0000 Subject: FleetCommander: Explain better the perms of the created dirs This commit has the intented to explain better the perms of the dirs that have to be created by SSSD when taking advantage of FleetCommander integration and also explicitly says that we depend on CAP_SETUID and CAP_SETGID. Signed-off-by: Fabiano Fidêncio --- diff --git a/design_pages/fleet_commander_integration.rst b/design_pages/fleet_commander_integration.rst index 8b059b3..bbbcc54 100644 --- a/design_pages/fleet_commander_integration.rst +++ b/design_pages/fleet_commander_integration.rst @@ -97,6 +97,33 @@ per-user JSON file would be stored at ``/var/lib/sss/deskprofile///.json``. The ```` directories need to be owned by the user being logged in. +The structure of the the created dirs follow:: + + /var/lib/sss/deskprofile///.json + ------------ -------- ---------- ------------------ + | | | | + v | | | + Created by sssd package as | | | + root:root (or sssd:sssd) | | | + and has permissions 0751 | | | + | | | + v | | + Owned by user:user_group | | + and has permissions 0751 | | + | | + | | + v | + Owned by user:user_group | + and has permissions 0700 | + | + v + Owned by user:user_group + and has permissions 0400 + +Please, keep in mind that this feature relies on CAP_SETUID and +CAP_SETGID to properly work as expected and relies on SSSD being run +as privileged user (root). + The ```` file must include the priority as a number which is read from the rule's ``prio`` attribute. The Fleet Commander client component will then process the JSON files in this priority. The