diff --git a/sssd.spec b/sssd.spec index 41ffc2d..724de9e 100644 --- a/sssd.spec +++ b/sssd.spec @@ -123,6 +123,13 @@ Obsoletes: sssd-common < %version-%release %define mcpath %sssdstatedir/mc %define ldbdir %(pkg-config ldb --variable=modulesdir) + +%if 0%{?suse_version} >= 1600 +%define permissions_path %_datadir/permissions/permissions.d/ +%else +%define permissions_path %_sysconfdir/permissions.d/ +%endif + # Both SSSD and cifs-utils provide an idmap plugin for cifs.ko # %%_sysconfdir/cifs-utils/idmap-plugin should be a symlink to one of the 2 idmap plugins # * cifs-utils one is the default (priority 20) @@ -477,7 +484,7 @@ sed -i '1s@#!.*python.*@#!%_bindir/python3.11@' "$b/%_libexecdir/%name/sss_analy %endif echo 'u sssd - "System Security Services Daemon" /run/sssd /sbin/nologin' >system-user-sssd.conf -mkdir -p "$b/%_sysusersdir" "$b/etc/permissions.d" +mkdir -p "$b/%_sysusersdir" cp -a system-user-sssd.conf "$b/%_sysusersdir/" %sysusers_generate_pre system-user-sssd.conf random system-user-sssd.conf install -Dpm 0644 contrib/sssd-tmpfiles.conf "%buildroot/%_tmpfilesdir/%name.conf" @@ -486,7 +493,8 @@ install -Dpm 0644 contrib/sssd-tmpfiles.conf "%buildroot/%_tmpfilesdir/%name.con # https://www.openwall.com/lists/oss-security/2024/12/19/1 # # should match entry from %%files list -cat >"$b/etc/permissions.d/sssd" <<-EOF +mkdir -p "$b/%permissions_path" +cat >"$b/%permissions_path/sssd" <<-EOF %_libexecdir/sssd/sssd_pam root:sssd 0750 +capabilities cap_dac_read_search=p %_libexecdir/sssd/selinux_child root:sssd 0750 @@ -647,7 +655,7 @@ fi %_unitdir/sssd-sudo.service %_sysusersdir/*sssd* %_tmpfilesdir/*sssd* -%_sysconfdir/permissions.d/* +%permissions_path/sssd %_datadir/polkit-1/ %_bindir/sss_ssh_* %_sbindir/sssd