Fedora Account System
Red Hat Associate
Red Hat Customer
In /usr/lib/systemd/system/sssd.service, we find : ExecStartPre=+-/bin/chown -f -R -H root:sssd /etc/sssd ExecStartPre=+-/bin/chmod -f -R g+r /etc/sssd ExecStartPre=+-/bin/chmod -f g+x /etc/sssd ExecStartPre=+-/bin/chmod -f g+x /etc/sssd/conf.d ExecStartPre=+-/bin/chmod -f g+x /etc/sssd/pki It doesn't work if /etc is read only (with readonly-root for example). Suggestion : add this line files /etc/sssd in /etc/rwtab Reproducible: Always
Hi. > ExecStartPre=+-/bin/chown -f -R -H root:sssd /etc/sssd > ExecStartPre=+-/bin/chmod -f -R g+r /etc/sssd '-' prefix tells to ignore failures and '-f' suppresses errors, so service will start. What is the actual issue? SSSD doesn't work because of wrong files ownership/permissions of config file?
Hi, Start the service cause worrying lines in journald, giving the impression of a starting failure (I'd verify in September if the service really starts, August is vacation time). Thx
@atikhono why is this even done on each startup? This kind of file ownership should be defined in the RPM (so that rpm verify works correctly as well, and if some old version used a different ownership use a post-install scriptlet to fix the old permissions.
(In reply to Simo Sorce from comment #3) > @atikhono why is this even done on each startup? > > This kind of file ownership should be defined in the RPM (so that rpm verify > works correctly as well, and if some old version used a different ownership > use a post-install scriptlet to fix the old permissions. IIRC `post-install scriptlet` does not work for ostree based distributions.
(In reply to Simo Sorce from comment #3) > @atikhono why is this even done on each startup? > > This kind of file ownership should be defined in the RPM (so that rpm verify > works correctly as well, and if some old version used a different ownership > use a post-install scriptlet to fix the old permissions. It's done in RPM but it didn't work for rpm-ostree based systems.
rpm-ostree should not need post install adjustments, if the file ownership is declared correctly in the files section it will be already correct on disk. If this is done in post-install because the sssd group is allocated dynamically, then the obvious fix here is to get instead a fixed allocated id so that it is a known group instead. After all SSSD is basically always installed so a fixed GID is justifiable.