Bug 1814603

Summary:	389-base-ds expected file permissions in package don't match final runtime permissions [rhel-7.8.z]
Product:	Red Hat Enterprise Linux 7	Reporter:	RAD team bot copy to z-stream <autobot-eus-copy>
Component:	389-ds-base	Assignee:	mreynolds
Status:	CLOSED NEXTRELEASE	QA Contact:	RHDS QE <ds-qe-bugs>
Severity:	unspecified	Docs Contact:
Priority:	high
Version:	7.6	CC:	mhonek, mreynolds, msauton, nkinder, pasik, rmullett, spichugi, tbordaz, tmihinto, vashirov
Target Milestone:	rc	Keywords:	ZStream
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	389-ds-base-1.3.10.1-12.el7_8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1700987	Environment:
Last Closed:	2020-07-29 13:23:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1700987
Bug Blocks:

Description RAD team bot copy to z-stream 2020-03-18 11:04:29 UTC

This bug has been copied from bug #1700987 and has been proposed to be backported to 7.8 z-stream (EUS).

Comment 4 Viktor Ashirov 2020-06-02 13:21:47 UTC

Build tested: 389-ds-base-1.3.10.1-11.el7_8.x86_64

After instance is created, 'rpm -V' reports following discrepancies:

# rpm -V 389-ds-base 
......G..    /etc/dirsrv
.M...UG..  g /var/lock/dirsrv


Matus, is this expected?

Comment 5 Matus Honek 2020-06-02 13:50:16 UTC

(In reply to Viktor Ashirov from comment #4)
> ......G..    /etc/dirsrv

This is unexpected, I think. What group owns the directory?

> .M...UG..  g /var/lock/dirsrv

It looks like the SPEC file change has not been backported (the change from 389-ds-base.spec.in in the patch needs to be applied to the downstream SPEC file).

Comment 6 Viktor Ashirov 2020-06-02 14:08:05 UTC

(In reply to Matus Honek from comment #5)
> (In reply to Viktor Ashirov from comment #4)
> > ......G..    /etc/dirsrv
> 
> This is unexpected, I think. What group owns the directory?
After package installation it's root:
# ls -la /etc/ | grep dirsrv 
drwxrwxr-x. 5 root root   4096 Jun  2 13:17 dirsrv

But after instance creation it's dirsrv:
# ls -la /etc/ | grep dirsrv
drwxrwxr-x. 6 root dirsrv   4096 Jun  2 13:20 dirsrv

> 
> > .M...UG..  g /var/lock/dirsrv
> 
> It looks like the SPEC file change has not been backported (the change from
> 389-ds-base.spec.in in the patch needs to be applied to the downstream SPEC
> file).

Right, the patch in downstream just modifies 389-ds-base.spec.in.

Moving to ASSIGNED.

Comment 7 Viktor Ashirov 2020-06-11 14:18:33 UTC

Build tested: 389-ds-base-1.3.10.1-13.el7_8.x86_64

After instance is created, I still see discrepancies:
# rpm -V 389-ds-base 
......G..    /etc/dirsrv
.....UG..  g /var/lock/dirsrv

Moving to ASSIGNED.

Comment 8 Viktor Ashirov 2020-06-11 20:10:36 UTC

As discussed in the meeting, the original issue was about file/directory permissions, not about ownership.
Issue with the ownership will be addressed later. Marking as VERIFIED.

Comment 9 Viktor Ashirov 2020-06-15 12:41:56 UTC

Upgrading to this package with redhat-ds packages installed fails:

# yum update 389-ds-base
...
Running transaction check
Transaction check succeeded.
Running transaction test
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: Transaction check error:
  file /usr/lib64/dirsrv from install of 389-ds-base-libs-1.3.10.1-13.el7_8.x86_64 conflicts with file from package 389-admin-1.1.46-1.el7dsrv.x86_64

It started after 389-ds-base-1.3.10.1-10.

Moving to ASSIGNED.

Comment 11 mreynolds 2020-06-16 20:12:11 UTC

(In reply to Viktor Ashirov from comment #9)
> Upgrading to this package with redhat-ds packages installed fails:
> 
> # yum update 389-ds-base
> ...
> Running transaction check
> Transaction check succeeded.
> Running transaction test
> The downloaded packages were saved in cache until the next successful
> transaction.
> You can remove cached packages by executing 'dnf clean packages'.
> Error: Transaction check error:
>   file /usr/lib64/dirsrv from install of
> 389-ds-base-libs-1.3.10.1-13.el7_8.x86_64 conflicts with file from package
> 389-admin-1.1.46-1.el7dsrv.x86_64
> 
> It started after 389-ds-base-1.3.10.1-10.
> 
> Moving to ASSIGNED.

I don't see how the file permissions fix from https://pagure.io/389-ds-base/pull-request/50941 would impact /usr/lib64/dirsrv.  It only touches /etc and /var directories...