Bug 2105177

Summary:	dbus-common: sysusers entry does not match specfile setup
Product:	[Fedora] Fedora	Reporter:	Luca BRUNO <lucab>
Component:	dbus	Assignee:	Colin Walters <walters>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	36	CC:	amigadave, caillon+fedoraproject, gnome-sig, mclasen, mzeuom, rstrode, sandmann, tgunders, travier, walters
Target Milestone:	---	Keywords:	Reopened
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	dbus-1.14.0-2.fc37 dbus-1.14.0-5.fc38 dbus-1.14.0-5.fc37	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-08-22 19:03:00 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Luca BRUNO 2022-07-08 08:18:46 UTC

[This is a copy of https://bugzilla.redhat.com/show_bug.cgi?id=2090397 for Fedora]

The dbus specfile creates a `dbus` user and group with `81` as static IDs:
https://src.osci.redhat.com/rpms/dbus/blob/rhel-8.6.0/f/dbus.spec#_295

However the `dbus-common` package ships a sysusers.d fragment under `/usr/lib/sysusers.d/dbus` which creates a user/group with dynamic ID allocation:
```
# sysusers.d snippet for creating the D-Bus system user automatically
# at boot on systemd-based systems that ship with an unpopulated
# /etc. See sysusers.d(5) for details.

u dbus - "System Message Bus"
```

To fix misalignment, it would be good to update the sysusers fragment to use `81` as the UID/GID too.

Comment 1 David King 2022-07-14 08:14:18 UTC

I changed dbus in rawhide to use the upstream sysusers.d configuration, which prefers dynamic IDs.

Comment 2 Luca BRUNO 2022-07-14 09:04:32 UTC

> I changed dbus in rawhide to use the upstream sysusers.d configuration, which prefers dynamic IDs.

Thanks for the quick reaction. However I don't think that *in this specific case* it is the good way to go.

In particular, I see that the `dbus-daemon` package is shipping a setGID binary at `/usr/libexec/dbus-1/dbus-daemon-launch-helper` owned by the `dbus` group:
```
%files daemon
[...]	
%attr(4750,root,dbus) %{_libexecdir}/dbus-1/dbus-daemon-launch-helper
```

After the "dynamic GID" change you just pushed, this binary will now get a different GID on each system where the package gets installed/composed.

This is troublesome for the push towards deterministic/reproducible composes, and it introduces additional issues for transactional systems doing sandboxed/out-of-band composes (where the GID may change across runs).
I pretty much welcome the specfile switch toward a sysusers.d fragment, but I'd recommend sticking to the Fedora allocated UID/GID `81` for that (overriding/patching the upstream content).

(I didn't manage to trace down this ID allocation through history, but I do feel that it may have been requested to cover this exact setGID binary too).

Comment 3 Timothée Ravier 2022-07-26 16:16:10 UTC

I'm re-opening this one as this impacts all rpm-ostree based variants of Fedora and as Luca mentioned we need to use a static ID as we have SetGID binaries in the package.

Comment 4 Luca BRUNO 2022-08-03 12:35:07 UTC

I eventually found some time to do the packaging changes myself, PR at https://src.fedoraproject.org/rpms/dbus/pull-request/16.

Comment 5 Fedora Update System 2022-08-22 19:00:09 UTC

FEDORA-2022-23b7130499 has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2022-23b7130499

Comment 6 Fedora Update System 2022-08-22 19:01:37 UTC

FEDORA-2022-58c18a7300 has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2022-58c18a7300

Comment 7 Fedora Update System 2022-08-22 19:03:00 UTC

FEDORA-2022-58c18a7300 has been pushed to the Fedora 38 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2022-08-22 22:39:20 UTC

FEDORA-2022-23b7130499 has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.