use systemd-sysusers

Signed-off-by: Jonathan <[email protected]>

.github/actions/build-sssd-srpm/action.yml

@@ -38,6 +38,7 @@ runs:
       tar -cvzf "$name.tar.gz" --transform "s,^,$name/," *
 
       cp contrib/sssd.spec.in ./sssd.spec
+      cp contrib/sssd.sysusers ./sssd.sysusers
 
       sed -iE "s/@PACKAGE_NAME@/sssd/g" ./sssd.spec
       sed -iE "s/@PACKAGE_VERSION@/${{ steps.sanitize.outputs.version }}/g" ./sssd.spec

contrib/sssd.spec.in

@@ -36,6 +36,12 @@
 %global build_passkey 0
 %endif
 
+%if 0%{?rhel} >= 10
+%global use_sysusers 1
+%else
+%global use_sysusers 0
+%endif
+
 # we don't want to provide private python extension libs
 %define __provides_exclude_from %{python3_sitearch}/.*\.so$
 
@@ -54,6 +60,9 @@ Summary: System Security Services Daemon
 License: GPLv3+
 URL: https://github.com/SSSD/sssd/
 Source0: %{url}/archive/%{version}/%{name}-%{version}.tar.gz
+%if %{use_sysusers}
+Source1: sssd.sysusers
+%endif
 
 ### Patches ###
 # Place your patches here:
@@ -189,8 +198,13 @@ Requires: (sssd-nfs-idmap = %{version}-%{release} if libnfsidmap)
 Requires: libsss_idmap = %{version}-%{release}
 Requires: libsss_certmap = %{version}-%{release}
 %if 0%{?rhel}
+%if %{use_sysusers}
+BuildRequires:  systemd-rpm-macros
+%{?sysusers_requires_compat}
+%else
 Requires(pre): shadow-utils
 %endif
+%endif
 %{?systemd_requires}
 
 ### Provides ###
@@ -702,6 +716,10 @@ do
     cat $subpackage.lang
 done
 
+%if %{use_sysusers}
+install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf
+%endif
+
 %files
 %license COPYING
 
@@ -805,6 +823,10 @@ done
 %{_datadir}/systemtap/tapset/sssd.stp
 %{_datadir}/systemtap/tapset/sssd_functions.stp
 %{_mandir}/man5/sssd-systemtap.5*
+%if %{use_sysusers}
+%{_sysusersdir}/sssd.conf
+%endif
+
 
 %if 0%{?rhel}
 %files polkit-rules
@@ -1004,9 +1026,13 @@ done
 
 %if 0%{?rhel}
 %pre common
+%if %{use_sysusers}
+%sysusers_create_compat %{SOURCE1}
+%else
 getent group sssd >/dev/null || groupadd -r sssd
 getent passwd sssd >/dev/null || useradd -r -g sssd -d / -s /sbin/nologin -c "User for sssd" sssd
 %endif
+%endif
 
 %post common
 %systemd_post sssd.service

contrib/sssd.sysusers

@@ -0,0 +1 @@
+u     sssd   -   "User for sssd"     /               /sbin/nologin