RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1814603 - 389-base-ds expected file permissions in package don't match final runtime permissions [rhel-7.8.z]
Summary: 389-base-ds expected file permissions in package don't match final runtime pe...
Keywords:
Status: CLOSED NEXTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: 389-ds-base
Version: 7.6
Hardware: All
OS: Linux
high
unspecified
Target Milestone: rc
: ---
Assignee: mreynolds
QA Contact: RHDS QE
URL:
Whiteboard:
Depends On: 1700987
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-03-18 11:04 UTC by RAD team bot copy to z-stream
Modified: 2023-12-15 17:32 UTC (History)
10 users (show)

Fixed In Version: 389-ds-base-1.3.10.1-12.el7_8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1700987
Environment:
Last Closed: 2020-07-29 13:23:01 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description RAD team bot copy to z-stream 2020-03-18 11:04:29 UTC 
This bug has been copied from bug #1700987 and has been proposed to be backported to 7.8 z-stream (EUS).
Comment 4 Viktor Ashirov 2020-06-02 13:21:47 UTC 
Build tested: 389-ds-base-1.3.10.1-11.el7_8.x86_64

After instance is created, 'rpm -V' reports following discrepancies:

# rpm -V 389-ds-base 
......G..    /etc/dirsrv
.M...UG..  g /var/lock/dirsrv


Matus, is this expected?
Comment 5 Matus Honek 2020-06-02 13:50:16 UTC 
(In reply to Viktor Ashirov from comment #4)
> ......G..    /etc/dirsrv

This is unexpected, I think. What group owns the directory?

> .M...UG..  g /var/lock/dirsrv

It looks like the SPEC file change has not been backported (the change from 389-ds-base.spec.in in the patch needs to be applied to the downstream SPEC file).
Comment 6 Viktor Ashirov 2020-06-02 14:08:05 UTC 
(In reply to Matus Honek from comment #5)
> (In reply to Viktor Ashirov from comment #4)
> > ......G..    /etc/dirsrv
> 
> This is unexpected, I think. What group owns the directory?
After package installation it's root:
# ls -la /etc/ | grep dirsrv 
drwxrwxr-x. 5 root root   4096 Jun  2 13:17 dirsrv

But after instance creation it's dirsrv:
# ls -la /etc/ | grep dirsrv
drwxrwxr-x. 6 root dirsrv   4096 Jun  2 13:20 dirsrv

> 
> > .M...UG..  g /var/lock/dirsrv
> 
> It looks like the SPEC file change has not been backported (the change from
> 389-ds-base.spec.in in the patch needs to be applied to the downstream SPEC
> file).

Right, the patch in downstream just modifies 389-ds-base.spec.in.

Moving to ASSIGNED.
Comment 7 Viktor Ashirov 2020-06-11 14:18:33 UTC 
Build tested: 389-ds-base-1.3.10.1-13.el7_8.x86_64

After instance is created, I still see discrepancies:
# rpm -V 389-ds-base 
......G..    /etc/dirsrv
.....UG..  g /var/lock/dirsrv

Moving to ASSIGNED.
Comment 8 Viktor Ashirov 2020-06-11 20:10:36 UTC 
As discussed in the meeting, the original issue was about file/directory permissions, not about ownership.
Issue with the ownership will be addressed later. Marking as VERIFIED.
Comment 9 Viktor Ashirov 2020-06-15 12:41:56 UTC 
Upgrading to this package with redhat-ds packages installed fails:

# yum update 389-ds-base
...
Running transaction check
Transaction check succeeded.
Running transaction test
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: Transaction check error:
  file /usr/lib64/dirsrv from install of 389-ds-base-libs-1.3.10.1-13.el7_8.x86_64 conflicts with file from package 389-admin-1.1.46-1.el7dsrv.x86_64

It started after 389-ds-base-1.3.10.1-10.

Moving to ASSIGNED.
Comment 11 mreynolds 2020-06-16 20:12:11 UTC 
(In reply to Viktor Ashirov from comment #9)
> Upgrading to this package with redhat-ds packages installed fails:
> 
> # yum update 389-ds-base
> ...
> Running transaction check
> Transaction check succeeded.
> Running transaction test
> The downloaded packages were saved in cache until the next successful
> transaction.
> You can remove cached packages by executing 'dnf clean packages'.
> Error: Transaction check error:
>   file /usr/lib64/dirsrv from install of
> 389-ds-base-libs-1.3.10.1-13.el7_8.x86_64 conflicts with file from package
> 389-admin-1.1.46-1.el7dsrv.x86_64
> 
> It started after 389-ds-base-1.3.10.1-10.
> 
> Moving to ASSIGNED.

I don't see how the file permissions fix from https://pagure.io/389-ds-base/pull-request/50941 would impact /usr/lib64/dirsrv.  It only touches /etc and /var directories...
Note You need to log in before you can comment on or make changes to this bug.