summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTimothy Pearson <kb9vqf@pearsoncomputing.net>2019-03-07 18:04:46 -0600
committerTimothy Pearson <kb9vqf@pearsoncomputing.net>2019-03-07 18:05:26 -0600
commitb2d89e08d03d6f50ee68bc0f07bafd2acb184575 (patch)
tree00806114a9e39f588b191d0372734348fc5a7d37
parent10472c4c2b98b22c0d8309e3f21ae2df32a6538a (diff)
downloadlibtdeldap-b2d89e08d03d6f50ee68bc0f07bafd2acb184575.tar.gz
libtdeldap-b2d89e08d03d6f50ee68bc0f07bafd2acb184575.zip
Fix access to ldap configuration files on non-controller (workstation) systems
-rw-r--r--src/libtdeldap.cpp16
1 files changed, 13 insertions, 3 deletions
diff --git a/src/libtdeldap.cpp b/src/libtdeldap.cpp
index bf744dc..c217398 100644
--- a/src/libtdeldap.cpp
+++ b/src/libtdeldap.cpp
@@ -3375,9 +3375,19 @@ int LDAPManager::writeLDAPConfFile(LDAPRealmConfig realmcfg, LDAPMachineRole mac
delete systemconfig;
- if (chmod(KDE_CONFDIR "/ldap/ldapconfigrc", S_IRUSR|S_IWUSR|S_IRGRP) < 0) {
- if (errstr) *errstr = TQString("Unable to change permissions of \"%1\"").arg(KDE_CONFDIR "/ldap/ldapconfigrc");
- return -1;
+ if ((machineRole == ROLE_PRIMARY_REALM_CONTROLLER) || (machineRole == ROLE_SECONDARY_REALM_CONTROLLER)) {
+ // The file may contain multi-master replication secrets, therefore only root should be able to read it
+ if (chmod(KDE_CONFDIR "/ldap/ldapconfigrc", S_IRUSR|S_IWUSR|S_IRGRP) < 0) {
+ if (errstr) *errstr = TQString("Unable to change permissions of \"%1\"").arg(KDE_CONFDIR "/ldap/ldapconfigrc");
+ return -1;
+ }
+ }
+ else {
+ // Normal users should be allowed to read realm configuration data in order to launch realm administration utilities
+ if (chmod(KDE_CONFDIR "/ldap/ldapconfigrc", S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH) < 0) {
+ if (errstr) *errstr = TQString("Unable to change permissions of \"%1\"").arg(KDE_CONFDIR "/ldap/ldapconfigrc");
+ return -1;
+ }
}
return 0;