SSSD / sssd

#3638 Make Fleet Commander related code work for unprivileged users
Closed: wontfix by pbrezina. Opened by fidencio.

Closed: wontfix
Reopen Issue

As pointed by https://github.com/SSSD/sssd/pull/498#issuecomment-365839135 the Fleet Commander code will have some issues running on environments where the domain's process is unprivileged.

A possible solution for this would be to have different permissions for the deskprofile folder and the folders under this one.

I really would like to hear @simo's opinion on this one!

I would prefer to close this ticket as duplicate of #3621. The use-case from description of this ticket
is already mentioned in #3621 and #3621 has not been closed yet.

BTW it is not RFE but bug
Edited by lslebodn

BTW it is not RFE but bug

"RFE" word has been removed as by your suggestion.
Edited by fidencio

I think it is ok to track this in a separate ticket.

Since the Fleet Commander support is an independent feature it is imo sufficient to document that it currently only works if SSSD runs a root. This ticket already documents this but an entry in a related man page wouldn't hurt either.

@fidencio would you prefer me to open another ticket about the man page entry? Or feel free to do it yourself.
Then we could defer this ticket to make it clear that the functionality doesn't work with an unprivileged user and fix the man page.

Created a new issue and updated the reference in the PR. JFTR: https://pagure.io/SSSD/sssd/issue/3648

Oh, I didn't notice there was a PR already. I'm all set then and I'll move this ticket to Patches Welcome.

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD Patches welcome

Metadata Update from @jhrozek:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1626564

Issue linked to Bugzilla: Bug 1626564

To fix the issue with creating directories with proper ownerships where currently seteuid() is used it might help to call the 'install' command (part of coreutils) with the needed arguments via oddjob. This way we can avoid to write another suid helper binary.

Thank you for taking time to submit this request for SSSD. Unfortunately this issue was not given priority and the team lacks the capacity to work on it at this time.

Given that we are unable to fulfill this request I am closing the issue as wontfix.

If the issue still persist on recent SSSD you can request re-consideration of this decision by reopening this issue. Please provide additional technical details about its importance to you.

Thank you for understanding.

Metadata Update from @pbrezina:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4659

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
High
https://bugzilla.redhat.com/show_bug.cgi?id=1626564
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.