mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-07-27 01:44:44 +00:00
2d3da2d72c
SSSD 2.10+ runs under non-privileged user 'sssd' and relies on system capabilities to get access to certain resources like /etc/krb5.keytab. Not having these capabilities result in SSSD not starting. Podman has reduced the capabilities granted to containers, and to be able to start SSSD it is needed to add DAC_READ_SEARCH back. This patch adds file infra/images/shdefaults to store the defaults used by ansible-freeipa shell utilities in a contral location. See: https://github.com/containers/podman/discussions/24904#discussioncomment-11718823 Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
9 lines
256 B
Bash
9 lines
256 B
Bash
#!/bin/bash -eu
|
|
# This file is meant to be source'd by other scripts
|
|
|
|
# Set default capabilities options for freeipa containers.
|
|
# Use +CAP to add the capability and -CAP to drop the capability.
|
|
CAP_DEFAULTS=(
|
|
"+DAC_READ_SEARCH" # Required for SSSD
|
|
)
|