Bug 1702658

Summary: TPS tests fail for sssd-common in RHEL 8 (rpm -V sssd-common)
Product: Red Hat Enterprise Linux 8 Reporter: Michal Zidek <mzidek>
Component: sssdAssignee: Michal Zidek <mzidek>
Status: CLOSED ERRATA QA Contact: sssd-qe <sssd-qe>
Severity: medium Docs Contact:
Priority: medium    
Version: 8.0CC: apeetham, grajaiya, jhrozek, lslebodn, mkosek, mzidek, pbrezina, sgoveas, toneata, tscherf
Target Milestone: rcFlags: jhrozek: mirror+
Target Release: 8.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: sssd-2.2.0-7.el8 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-11-05 22:34:25 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Michal Zidek 2019-04-24 11:38:56 UTC
RHEL 8 packages fail TPS tests.

result: verify test: FAIL:
sssd-common.aarch64: /var/lib/sss/mc/passwd .....UG.. g [tps:B]
sssd-common.aarch64: /var/lib/sss/mc/initgroups .....UG.. g [tps:B]
sssd-common.aarch64: /var/lib/sss/mc/group .....UG.. g [tps:B]
TPS verify test analysis tags:
tps:a -- verify errors on both arches
tps:b -- verify error on file not present in alternative arch
tps:c -- verify error on preferred binary/ELF file
tps:d -- significant type of verify error


It can be reproduced with rpm --verify sssd-common on RHEL 8.

Fixing this requires following spec file change.

@@ -889,12 +889,12 @@ done
 %dir %{sssdstatedir}
 %dir %{_localstatedir}/cache/krb5rcache
 %attr(700,sssd,sssd) %dir %{dbpath}
-%attr(755,sssd,sssd) %dir %{mcpath}
+%attr(775,sssd,sssd) %dir %{mcpath}
 %attr(700,root,root) %dir %{secdbpath}
 %attr(751,root,root) %dir %{deskprofilepath}
-%ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/passwd
-%ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/group
-%ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/initgroups
+%ghost %attr(0664,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/passwd
+%ghost %attr(0664,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/group
+%ghost %attr(0664,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/initgroups
 %attr(755,sssd,sssd) %dir %{pipepath}
 %attr(750,sssd,root) %dir %{pipepath}/private
 %attr(755,sssd,sssd) %dir %{pubconfpath}
@@ -903,7 +903,7 @@ done
 %attr(700,sssd,sssd) %dir %{_sysconfdir}/sssd
 %attr(711,sssd,sssd) %dir %{_sysconfdir}/sssd/conf.d
 %attr(711,root,root) %dir %{_sysconfdir}/sssd/pki
-%ghost %attr(0600,sssd,sssd) %config(noreplace) %{_sysconfdir}/sssd/sssd.conf
+%ghost %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/sssd/sssd.conf
 %dir %{_sysconfdir}/logrotate.d
 %config(noreplace) %{_sysconfdir}/logrotate.d/sssd
 %dir %{_sysconfdir}/rwtab.d

Comment 1 Michal Zidek 2019-04-24 11:49:55 UTC
Steeve found this with the TPS tests for the latest RHEL 8 0day build. So this needs to be fixed in RHEL 8 0day as well. Can we have 0day clone of this BZ as well? I know it is quite late in the z-stream cycle (tomorrow is REL_PREP deadline), but I do not think we can release a package that fails rpm --verify.

Comment 4 Michal Zidek 2019-08-03 01:44:56 UTC
This is already fixed in the current version in distgit in the 8.1.0. No patches needed, I will put the current version into "Fixed in version" field.

Comment 6 Amith 2019-09-10 01:11:59 UTC
Verified the bug with SSSD version: sssd-common-2.2.0-19.el8.s390x

Also with version: sssd-common-2.2.0-11.el8.x86_64 and sssd-common-2.2.0-19.el8.aarch64

# rpm -q sssd-common; rpm --verify sssd-common; echo $?
sssd-common-2.2.0-11.el8.x86_64
0
---------------------------

# rpm -q sssd-common; rpm --verify sssd-common; echo $?
sssd-common-2.2.0-19.el8.s390x
0

----------------------------

# rpm -q sssd-common; rpm --verify sssd-common; echo $?
sssd-common-2.2.0-19.el8.aarch64
0

The bug looks fixed hence marking it verified.

Comment 8 errata-xmlrpc 2019-11-05 22:34:25 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:3651