Fedora Account System
Red Hat Associate
Red Hat Customer
+++ This bug was initially created as a clone of Bug #1188065 +++ The saslauthd daemon should be running as root only with "pam" authentication method selected (see saslauthd(8)). For other authentication methods there is the user "saslauth" the daeom should be run as. But now there is no possibility how to run saslauthd as another user (AFAIK). In RHEL6, there is a line for this purpose in the /etc/sysconfig/saslauthd file (should be uncommented to take effect): # DAEMONOPTS="--user saslauth" But in RHEL7, this option is lost. Running saslauthd as root is potentionally dangerous and unnecessary. Also the directory /run/saslauthd should be owned by the user saslauth. If saslauthd is running as root, the ownership does not matter. But if the daemon is running as non-privileged user saslauth, the saslauthd daemon is unable to create socket in this directory. The user is able to change ownership, but any update of this package will break working setup by reverting ownership of the directory back to root. --- Additional comment from Petr Lautrbach on 2015-02-04 17:43:42 CET --- Thank you for your report, Milan. DEAMONOPTS is not used anymore since we use systemd units instead of SysV initscripts. The systemd way is to use User= and Group= options in an unit file as you can see in the following example: # mkdir /etc/systemd/system/saslauthd.service.d # cat > /etc/systemd/system/saslauthd.service.d/user.conf <<EOF [Service] User=saslauth Group=saslauth EOF # systemctl daemon-reload # systemctl start saslauthd # systemctl status saslauthd -l saslauthd.service - SASL authentication daemon. Loaded: loaded (/usr/lib/systemd/system/saslauthd.service; disabled) Drop-In: /etc/systemd/system/saslauthd.service.d └─user.conf Active: active (running) since Wed 2015-02-04 17:23:16 CET; 8s ago Process: 10103 ExecStart=/usr/sbin/saslauthd -m $SOCKETDIR -a $MECH $FLAGS (code=exited, status=0/SUCCESS) Main PID: 10104 (saslauthd) With regards to the /run/saslauth, it's really a bug and it will be fixed in the next package update. In the mean time, you can use the following workaround: # cat > /etc/tmpfiles.d/saslauthd.conf <<EOF d /run/saslauthd 0755 saslauth saslauth - EOF # systemd-tmpfiles --create /etc/tmpfiles.d/saslauthd.conf # ls -ld /run/saslauthd/ drwxr-xr-x. 2 saslauth saslauth 80 Feb 4 17:38 /run/saslauthd/
Created attachment 997564 [details] documentation patch Seems solved with dist git commit f85e1a3ecdaac1533d42f74556849f51fef3a853 (in cyrus-sasl-2.1.26-20). We can't ship service configuration using user saslauth as default, because we have PAM mechanism as default. (it would be change, I know, but "safe default"). But at least I would be for mentioning this practice in man saslauthd and/or in its previous location /etc/sysconfig/saslauthd so the users can find how to do this.
I'd rather avoid putting documentation directly to sysconfig file. However, unit file could be changed to use GROUP and USER variables from /etc/sysconfig/saslauthd, e.g.: /etc/sysconfig/saslauthd ... # change this if you want to use another user for saslauthd service USER=root GROUP=root /usr/lib/systemd/system/saslauthd.service ... [Service] User=$USER Group=$GROUP
Unfortunately, this doesn't work, because systemd is not evaluating environment variables in User and Group field. Additionally there is problem with SELinux caused by above mentioned commit (change ownership of /run/saslauthd/), which prevents daemon to start with root (going to revert it). So the resolution is documentation with checklist how to change it permanently and the /run/saslauth will have root:saslauth ownership to be accessible by both of the users.
cyrus-sasl-2.1.26-21.fc22 has been submitted as an update for Fedora 22. https://admin.fedoraproject.org/updates/cyrus-sasl-2.1.26-21.fc22
Package cyrus-sasl-2.1.26-21.fc22: * should fix your issue, * was pushed to the Fedora 22 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing cyrus-sasl-2.1.26-21.fc22' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2015-3857/cyrus-sasl-2.1.26-21.fc22 then log in and leave karma (feedback).
Package cyrus-sasl-2.1.26-22.fc22: * should fix your issue, * was pushed to the Fedora 22 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing cyrus-sasl-2.1.26-22.fc22' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2015-3857/cyrus-sasl-2.1.26-22.fc22 then log in and leave karma (feedback).
cyrus-sasl-2.1.26-22.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.