#4056 permission denied on logs when running sssd as non-root user
Closed: Fixed by sbose. Opened by sbose.

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 8): Bug 1733372

Description of problem:
Attempting to switch sssd from running as root to running as sssd user results
in errors about sssd accessing log files.
[root@rhel8-2 sssd]# vim /etc/sssd/sssd.conf
[root@rhel8-2 sssd]# systemctl restart sssd
Broadcast message from systemd-journald@rhel8-2.example.com (Thu 2019-07-25
15:20:54 CDT):
sssd[pam][8080]: Could not open file [/var/log/sssd/p11_child.log]. Error:
[13][Permission denied]
Version-Release number of selected component (if applicable):
sssd-2.2.0-3.el8.x86_64
How reproducible:
always
Steps to Reproduce:
1.  setup sssd with debug_level = 9 on all sections
2.  in [sssd] add "user = sssd"
3.  systemctl restart sssd
Actual results:
Errors like above and does not start
Expected results:
no errors and runs.  Also, chowns all logs to running user.
Additional info:
Jakub found that it was just missing for child log files I think.

Metadata Update from @sbose:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1733372

Metadata Update from @sbose:
- Issue assigned to sbose

PR: https://github.com/SSSD/sssd/pull/859

Metadata Update from @sbose:
- Custom field patch adjusted to on

Commit 9339c445 relates to this ticket

Commit 8119ee21 relates to this ticket

Commit e9091aba relates to this ticket

Master:

  • 9339c445b4b98a28146ff834fec2af42bd3a6340
  • 8119ee216a9471ed2f01b16ed17068f5dc8b83cb
  • e9091aba9c0cbcc1f00f5f0656c200554cc485a3

Metadata Update from @sbose:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/5024

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata