SSSD / sssd

#2370 sssd should run under unprivileged user
Closed: Fixed Opened by jhrozek.

Closed: Fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1113783

Please note that this Bug is private and may not be accessible as it contains confidential Red Hat customer information.

Description of problem:
sssd is currently running as root and should be reimplemented to run under an
unprivileged user.
Version-Release number of selected component (if applicable):
sssd-1.11.2-65
How reproducible:
100%
Steps to Reproduce:
1. systemctl sssd start
2. ps axZ | grep sssd
Actual results:
sssd and all children running as root
Expected results:
sssd and all children running under unprivileged user.
Additional info:

Fields changed

blockedby: =>
blocking: =>
changelog: =>
coverity: =>
design: =>
design_review: => 0
feature_milestone: =>
fedora_test_page: =>
milestone: NEEDS_TRIAGE => SSSD 1.12.1
review: True => 0
selected: =>
testsupdated: => 0

Fields changed

priority: major => blocker

Fields changed

design: => https://fedorahosted.org/sssd/wiki/DesignDocs/NotRootSSSD

Fields changed

owner: somebody => jhrozek
status: new => assigned

Mass-moving all tickets that didn't make 1.12.1 into 1.12.2

milestone: SSSD 1.12.1 => SSSD 1.12.2

We need to do a release as requested by downstream. Moving tickets that are not fixed already or very close to acking to 1.12.3

milestone: SSSD 1.12.2 => SSSD 1.12.3

First round of patches:

  • 2689efa614826d45cab60ea1186d44b8bdd243ad
  • 940c94bc9a29165987cb9d3f71c4a4ec76e7a1fc
  • e718e60607149079e5c8ddc32bdd5c90b1c7a364
  • 3fd66df4813d1410c1a6187c80e3a23395b14aed
  • 4546e283498ffe2511cb566b9159714c671e326b
  • ac40d2f2b2b2fc35c95389f5e28febd580bd2b7a

mark: => 0

Fields changed

patch: 0 => 1

ldap_child and krb5_child changes:
- f3a25949de81f80c136bb073e4a8f504b080c20c
- 77b13371c87702aee3f858f6b2b73826cf5a01bd
- 06f10b2a0ebb26f2460cd445f8040e9205de7500
- 936940720b1b0e701a2317abc4c2d05a78338f33
- 5eef3da14cb34e4cb6356f0b291c066db946f936
- 0348c74bad010d35f92400c749a7acc2fea8b2cb
- 45414c12aa933a33d9a635cc212c448c858c6bab

More Kerberos changes:

  • 35b4b217fa2b91bfc8d58c47024faf41c95fc807
  • 2745b0156f12df7a7eb93d57716233243658e4d9
  • 7c5cd2e7711621af9163a41393e88896a91ac33b
  • 45aeb924ec3ac448bb8d174a5cc061ed98b147c7
  • 476b78b3f66abc7a0f805154ea1a29f54628224a
  • a60f4bb6b321298eb4d1c1c33d1897049a83d357

Build fixes:
- d167039ec78f93828ba65366d86a1ee7774aed3e
- 0a039d574ed0e91d939efd2c0975f6a425942afd
- f9ac9aa5760210b8bbd3d4e667dff5f101f99d62

sssd_be privilege drop patch:

  • 10d571677bf11c8b2c357026f24de40cae3094f5

Most of the work is done, so I'm closing this ticket. There are some additional enhancements tracked by individual tickets. See e.g. the design page for more details.

resolution: => fixed
status: assigned => closed

Metadata Update from @jhrozek:
- Issue assigned to jhrozek
- Issue marked as depending on: #2395
- Issue set to the milestone: SSSD 1.12.3

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3412

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
Lowest
enhancement
SSSD
None
https://bugzilla.redhat.com/show_bug.cgi?id=1113783
0
1
0
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.