use systemd-sysusers in RPMs #6807

jonathanspw · 2023-07-03T17:15:29Z

No description provided.

jonathanspw · 2023-07-03T17:24:57Z

I'm not sure how to properly add the new source file (sssd.sysusers) into all of the CI/automated builds.

ikerexxe · 2023-07-14T06:37:39Z

Can you provide some type of background (i.e. description, links) to what you are trying to achieve?

justin-stephenson · 2023-07-14T13:39:26Z

Can you provide some type of background (i.e. description, links) to what you are trying to achieve?

This is about adopting to the new preferred implementation for adding users/groups to replace 'useradd/groupadd' commands.

https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format
https://docs.fedoraproject.org/en-US/packaging-guidelines/UsersAndGroups/#_allocation_strategies

contrib/sssd.spec.in

contrib/sssd.sysusers

justin-stephenson · 2023-07-14T13:41:08Z

I'm not sure how to properly add the new source file (sssd.sysusers) into all of the CI/automated builds.

IIUC we need to add an additional input variable to https://github.com/SSSD/action-build-srpm which accepts a file, that can be used for any additional SourceX files, in this case sssd.sysusers. So that it can be called with:

name: Build source rpm
id: srpm
uses: next-actions/build-srpm@master
with:
tarball: ${{ inputs.working-directory }}/sssd-${{ steps.sanitize.outputs.version }}.tar.gz
specfile: ${{ inputs.working-directory }}/sssd.spec
sourcefile: ${{ inputs.working-directory }}/sssd.sysusers

Do you agree @pbrezina ?

contrib/sssd.sysusers

Signed-off-by: Jonathan <[email protected]>

pbrezina · 2023-08-01T09:18:51Z

I'm not sure how to properly add the new source file (sssd.sysusers) into all of the CI/automated builds.

IIUC we need to add an additional input variable to https://github.com/SSSD/action-build-srpm which accepts a file, that can be used for any additional SourceX files, in this case sssd.sysusers. So that it can be called with:
* name: Build source rpm
  id: srpm
  uses: next-actions/build-srpm@master
  with:
  tarball: ${{ inputs.working-directory }}/sssd-${{ steps.sanitize.outputs.version }}.tar.gz
  specfile: ${{ inputs.working-directory }}/sssd.spec
  sourcefile: ${{ inputs.working-directory }}/sssd.sysusers
Do you agree @pbrezina ?

Yes, but it must be able to take more files not just one.

justin-stephenson · 2023-08-01T18:40:35Z

Do you agree @pbrezina ?

Yes, but it must be able to take more files not just one.

PR Created next-actions/build-srpm#1

justin-stephenson · 2023-08-10T15:34:06Z

I added the changes justin-stephenson@8308be0 to have this pass in CI. @ikerexxe does it look good from your side? If so then @jonathanspw can cherry-pick this commit into this PR.

I am not sure if we want to make this change for RHEL8 and RHEL9, if yes then we need to change this condition in the spec file. I will defer to @alexey-tikhonov on this.

%if 0%{?rhel} >= 9 || 0%{?fedora}

alexey-tikhonov · 2023-08-11T08:51:43Z

contrib/sssd.spec.in

@@ -188,7 +189,8 @@ Requires: (sssd-nfs-idmap = %{version}-%{release} if libnfsidmap)
 Requires: libsss_idmap = %{version}-%{release}
 Requires: libsss_certmap = %{version}-%{release}
 %if 0%{?rhel}
-Requires(pre): shadow-utils
+BuildRequires:  systemd-rpm-macros


Why is it BuildRequires (and not Requires)?

This, and several of your other concerns, are explained in https://docs.fedoraproject.org/en-US/packaging-guidelines/UsersAndGroups/#_allocation_strategies

Guide says "add a BuildRequires" but doesn't actually explain.

alexey-tikhonov · 2023-08-11T08:57:12Z

contrib/sssd.spec.in

@@ -701,6 +703,8 @@ do
    cat $subpackage.lang
 done

+install -D -p -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/sssd.conf


Is this name - 'sssd.conf' - mandated anywhere?
It's confusing because it matches name of SSSD config file.
Would it be possible to use different name for a file with sysuser definition?

I checked _sysusersdir location (/usr/lib/sysusers.d/) and I only saw one exception, which I guess makes it valid to use another extension

Per man sysusers.d

CONFIGURATION DIRECTORIES AND PRECEDENCE Each configuration file shall be named in the style of package.conf or package-part.conf. The second variant should be used when it is desirable to make it easy to override just this part of configuration.

alexey-tikhonov · 2023-08-11T08:57:58Z

contrib/sssd.spec.in

@@ -54,6 +54,7 @@ Summary: System Security Services Daemon
 License: GPLv3+
 URL: https://github.com/SSSD/sssd/
 Source0: %{url}/archive/%{version}/%{name}-%{version}.tar.gz
+Source1: sssd.sysusers


Is this file has to be maintained in downstream dist-git like spec-file?

Yes, similar to https://src.fedoraproject.org/rpms/munge/c/dd0498ebb79605ee6a18100db30b07fddfaf31e4?branch=rawhide

alexey-tikhonov · 2023-08-11T09:01:44Z

contrib/sssd.spec.in

@@ -804,6 +808,10 @@ done
 %{_datadir}/systemtap/tapset/sssd.stp
 %{_datadir}/systemtap/tapset/sssd_functions.stp
 %{_mandir}/man5/sssd-systemtap.5*
+%if 0%{?rhel} >= 9 || 0%{?fedora}


Either I misunderstand something, or this condition is inconsistent:

install above is unconditional.

config is packaged for rhel >= 9 and fedora

below users are created for rhel only (any version)

Frankly I wouldn't touch RHEL8 and RHEL9 and only bring this to F40+/RHEL10

alexey-tikhonov · 2023-08-11T09:03:30Z

contrib/sssd.sysusers

@@ -0,0 +1 @@
+u     sssd   -   "User for sssd"     /               /sbin/nologin


At the beginning of the spec-file we have:

# define SSSD user %if 0%{?rhel} %global sssd_user sssd ...

Would it be possible to avoid copy-paste of 'sssd' user name?

ikerexxe · 2023-08-11T09:41:50Z

I added the changes justin-stephenson@8308be0 to have this pass in CI. @ikerexxe does it look good from your side? If so then @jonathanspw can cherry-pick this commit into this PR.

It's failing for centos stream 8, and if we follow Alexey's proposal it will also fail in centos stream 9. For those distributions we should remove /usr/lib/sysusers.d/sssd.conf file.

pbrezina · 2023-09-07T11:31:48Z

Any update on this one?

justin-stephenson · 2023-09-11T13:36:41Z

if @jonathanspw is okay with it, I can open a new PR and continue to move this forward (I already have a systemd sysusers ticket assigned to me)

jonathanspw · 2023-09-11T14:53:00Z

if @jonathanspw is okay with it, I can open a new PR and continue to move this forward (I already have a systemd sysusers ticket assigned to me)

Sure, whatever keeps things moving forward.

justin-stephenson · 2023-09-15T14:23:58Z

#6925 created to continue this PR.

alexey-tikhonov added Waiting for review no-backport This should go to target branch only. labels Jul 11, 2023

andreboscatto assigned ikerexxe and justin-stephenson Jul 13, 2023

justin-stephenson reviewed Jul 14, 2023

View reviewed changes

contrib/sssd.spec.in Outdated Show resolved Hide resolved

justin-stephenson reviewed Jul 14, 2023

View reviewed changes

contrib/sssd.sysusers Show resolved Hide resolved

ikerexxe reviewed Jul 18, 2023

View reviewed changes

contrib/sssd.sysusers Outdated Show resolved Hide resolved

ikerexxe added Changes requested and removed Waiting for review labels Jul 18, 2023

jonathanspw force-pushed the systemd-sysusers branch 2 times, most recently from 2b91dcd to 578ce13 Compare July 18, 2023 19:24

use systemd-sysusers

8382699

Signed-off-by: Jonathan <[email protected]>

jonathanspw force-pushed the systemd-sysusers branch from 578ce13 to 8382699 Compare July 18, 2023 19:26

alexey-tikhonov reviewed Aug 11, 2023

View reviewed changes

justin-stephenson closed this Sep 15, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

use systemd-sysusers in RPMs #6807

use systemd-sysusers in RPMs #6807

jonathanspw commented Jul 3, 2023

jonathanspw commented Jul 3, 2023

ikerexxe commented Jul 14, 2023

justin-stephenson commented Jul 14, 2023

justin-stephenson commented Jul 14, 2023

pbrezina commented Aug 1, 2023

justin-stephenson commented Aug 1, 2023

justin-stephenson commented Aug 10, 2023

alexey-tikhonov Aug 11, 2023

ikerexxe Aug 11, 2023

alexey-tikhonov Aug 11, 2023

alexey-tikhonov Aug 11, 2023

ikerexxe Aug 11, 2023

justin-stephenson Aug 11, 2023

alexey-tikhonov Aug 11, 2023 •

edited

Loading

justin-stephenson Aug 11, 2023 •

edited

Loading

alexey-tikhonov Aug 11, 2023 •

edited

Loading

alexey-tikhonov Aug 11, 2023

ikerexxe commented Aug 11, 2023

pbrezina commented Sep 7, 2023

justin-stephenson commented Sep 11, 2023

jonathanspw commented Sep 11, 2023

justin-stephenson commented Sep 15, 2023

use systemd-sysusers in RPMs #6807

use systemd-sysusers in RPMs #6807

Conversation

jonathanspw commented Jul 3, 2023

jonathanspw commented Jul 3, 2023

ikerexxe commented Jul 14, 2023

justin-stephenson commented Jul 14, 2023

justin-stephenson commented Jul 14, 2023

pbrezina commented Aug 1, 2023

justin-stephenson commented Aug 1, 2023

justin-stephenson commented Aug 10, 2023

alexey-tikhonov Aug 11, 2023

Choose a reason for hiding this comment

ikerexxe Aug 11, 2023

Choose a reason for hiding this comment

alexey-tikhonov Aug 11, 2023

Choose a reason for hiding this comment

alexey-tikhonov Aug 11, 2023

Choose a reason for hiding this comment

ikerexxe Aug 11, 2023

Choose a reason for hiding this comment

justin-stephenson Aug 11, 2023

Choose a reason for hiding this comment

alexey-tikhonov Aug 11, 2023 • edited Loading

Choose a reason for hiding this comment

justin-stephenson Aug 11, 2023 • edited Loading

Choose a reason for hiding this comment

alexey-tikhonov Aug 11, 2023 • edited Loading

Choose a reason for hiding this comment

alexey-tikhonov Aug 11, 2023

Choose a reason for hiding this comment

ikerexxe commented Aug 11, 2023

pbrezina commented Sep 7, 2023

justin-stephenson commented Sep 11, 2023

jonathanspw commented Sep 11, 2023

justin-stephenson commented Sep 15, 2023

alexey-tikhonov Aug 11, 2023 •

edited

Loading

justin-stephenson Aug 11, 2023 •

edited

Loading

alexey-tikhonov Aug 11, 2023 •

edited

Loading