Bug 1189203

+++ This bug was initially created as a clone of Bug #1188065 +++

The saslauthd daemon should be running as root only with "pam" authentication method selected (see saslauthd(8)). For other authentication methods there is the user "saslauth" the daeom should be run as.
But now there is no possibility how to run saslauthd as another user (AFAIK). In RHEL6, there is a line for this purpose in the /etc/sysconfig/saslauthd file (should be uncommented to take effect):

# DAEMONOPTS="--user saslauth"

But in RHEL7, this option is lost. Running saslauthd as root is potentionally dangerous and unnecessary. 

Also the directory /run/saslauthd should be owned by the user saslauth. If saslauthd is running as root, the ownership does not matter. But if the daemon is running as non-privileged user saslauth, the saslauthd daemon is unable to create socket in this directory. The user is able to change ownership, but any update of this package will break working setup by reverting ownership of the directory back to root.


--- Additional comment from Petr Lautrbach on 2015-02-04 17:43:42 CET ---

Thank you for your report, Milan.

DEAMONOPTS is not used anymore since we use systemd units instead of SysV initscripts. The systemd way is to use User= and Group= options in an unit file as you can see in the following example:

# mkdir /etc/systemd/system/saslauthd.service.d
# cat > /etc/systemd/system/saslauthd.service.d/user.conf <<EOF
[Service]
User=saslauth
Group=saslauth
EOF
# systemctl daemon-reload
# systemctl start saslauthd
# systemctl status saslauthd -l
saslauthd.service - SASL authentication daemon.
   Loaded: loaded (/usr/lib/systemd/system/saslauthd.service; disabled)
  Drop-In: /etc/systemd/system/saslauthd.service.d
           └─user.conf
   Active: active (running) since Wed 2015-02-04 17:23:16 CET; 8s ago
  Process: 10103 ExecStart=/usr/sbin/saslauthd -m $SOCKETDIR -a $MECH $FLAGS (code=exited, status=0/SUCCESS)
 Main PID: 10104 (saslauthd)


 With regards to the /run/saslauth, it's really a bug and it will be fixed in the next package update. In the mean time, you can use the following workaround:

# cat > /etc/tmpfiles.d/saslauthd.conf <<EOF
d /run/saslauthd 0755 saslauth saslauth -
EOF
# systemd-tmpfiles --create /etc/tmpfiles.d/saslauthd.conf
# ls -ld /run/saslauthd/
drwxr-xr-x. 2 saslauth saslauth 80 Feb  4 17:38 /run/saslauthd/