Bug 845078 - Reserve static UID/GID for OpenStack heat daemon
Summary: Reserve static UID/GID for OpenStack heat daemon
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: setup
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Ondrej Vasik
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-08-01 16:51 UTC by Steven Dake
Modified: 2016-04-27 02:19 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-08-06 11:23:40 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Steven Dake 2012-08-01 16:51:27 UTC
Description of problem:
As per:

  http://fedoraproject.org/wiki/Packaging:UsersAndGroups

The heat package requires a static UID/GID combination for security concerns.  We would rather not dynamically allocate this UID/GID as it could cause problems during upgrade or backup and we wish to quiet rpmlint.
  
Version-Release number of selected component (if applicable):
Rawhide - targeted at F18

Additional info:
Heat is a network facing daemon which contains sensitive user information in its persistent storage area.  The persistent storage area is /var/lib/heat.  The current packaging uses root permissions.  We absolutely don't want heat to run as root user, so our alternative is a dynamic UID/GID which would result in problems during the upgrade or backup process.

The uid/gid combo desired is 'openstack-heat'.

Thanks
-steve

Comment 1 Ondrej Vasik 2012-08-05 19:33:04 UTC
Just to be sure - so the reserved user/group name should be openstack-heat and homedir should be /var/lib/heat? Which package will be responsible for the user/group creation? Shell should be /sbin/nologin , right?

Comment 2 Steven Dake 2012-08-05 21:56:15 UTC
yes user/group are openstack-heat, homedir should be /var/lib/heat.  Shell should be /sbin/nologin.  The package responsible for creation can either be setup or heat, depending on what you think is appropriate.

Regards
-steve

Comment 3 Ondrej Vasik 2012-08-06 11:23:40 UTC
heat package is more appropriate for the user/group creation. I have reserved 187:187 uidgid pair for openstack-heat in setup-2.8.57-1.fc18 , feel free to use this static id in your next heat build. Closing RAWHIDE.

Comment 4 Jeff Peeler 2013-05-28 22:30:37 UTC
Note that this was renamed to just "heat" in bug 923858.


Note You need to log in before you can comment on or make changes to this bug.