Bug 2397255

Summary:	systemd presets request - authselect-apply-changes.service
Product:	[Fedora] Fedora	Reporter:	Pavel Březina <pbrezina>
Component:	fedora-release	Assignee:	Stephen Gallagher <sgallagh>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	alciregi, fedoraproject, kevin, mboddu, pbrobinson, samyak.jn11, sgallagh, thrcka, zbyszek
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	fedora-release-43-0.23	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-10-04 00:17:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2396016

Description Pavel Březina 2025-09-22 09:43:52 UTC

* Does the service require post-rpm-installation configuration in order to be useful (for example, does it need manual edits to a configuration file)?

No

* Does the service listen on a network socket for connections originating on a separate physical or virtual machine?

No

* Is the service non-persistent (i.e. run once at startup and exit)?

Yes

* What is the exact name (or names) of the systemd unit files to be enabled?

authselect-apply-changes.service

* Is this request for all Fedora deliverables or only for some Editions (list them)?

Fedora 43+

===

This is required to solve https://bugzilla.redhat.com/show_bug.cgi?id=2396016

Authselect, on upgrade, runs RPM scriptlet that updates PAM/nsswitch configuration. This is required to automatically move users using authselect to new configuration and avoid system lock out. This works on regular system, but not on Silverblue/ostree systems as RPM scriptlets are not run there. For this, I need to switch to a systemd service that updates the configuration on boot and the service has to be enabled by default.

Comment 1 Stephen Gallagher 2025-09-23 19:53:13 UTC

Pavel, can you point me at where this authselect-apply-changes.service file lives? I don't see it in either the upstream or downstream repositories for authselect. If it hasn't been written yet, let's do that first. I'll be happy to assist.

Comment 2 Pavel Březina 2025-09-24 11:08:30 UTC

Hi Stephen, currently it is in pull request: https://github.com/authselect/authselect/pull/421

File itself: https://github.com/authselect/authselect/pull/421/files#diff-03ea047c43f0ffe4d9aa0ff034c1b67019f4682d93065fdd0ea1f0bda5133c52

It is acked, I'm just waiting for Alexander Bokovoy to test it in his real environment, then I will merge it and do the builds.

Comment 3 Pavel Březina 2025-09-30 13:30:59 UTC

Hi Stephen, I merged the changes to Fedora 43 and rawhide. Koji builds and bodhi updates will be created automatically by packit soon

Comment 4 Pavel Březina 2025-10-01 11:18:32 UTC

https://bodhi.fedoraproject.org/updates/FEDORA-2025-617342aa98

Comment 5 Fedora Update System 2025-10-02 14:59:36 UTC

FEDORA-2025-2929dc6708 (fedora-release-43-0.23) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-2929dc6708

Comment 6 Fedora Update System 2025-10-03 01:35:18 UTC

FEDORA-2025-2929dc6708 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-2929dc6708`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-2929dc6708

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2025-10-04 00:17:08 UTC

FEDORA-2025-2929dc6708 (fedora-release-43-0.23) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.