SPEC: enabled 'sysusers' for f-41+ #7267

alexey-tikhonov · 2024-04-02T10:58:26Z

No description provided.

alexey-tikhonov · 2024-04-02T11:52:23Z

Hmm... @pbrezina, @sumit-bose,
as a follow up of #7193 (comment) discussion.

%sysusers_create_compat contrib/sssd.sysusers actually works somehow "as is", but not properly:

  Running scriptlet: sssd-common-9.pr7267-04361.fc41.x86_64                                                                         9/9 
  Installing       : sssd-common-9.pr7267-04361.fc41.x86_64                                                                         9/9 
warning: user sssd does not exist - using root
warning: group sssd does not exist - using root
warning: user sssd does not exist - using root
warning: group sssd does not exist - using root
warning: user sssd does not exist - using root
warning: group sssd does not exist - using root
warning: user sssd does not exist - using root
warning: group sssd does not exist - using root
warning: user sssd does not exist - using root
warning: group sssd does not exist - using root
warning: user sssd does not exist - using root
warning: group sssd does not exist - using root
warning: user sssd does not exist - using root
warning: group sssd does not exist - using root
warning: user sssd does not exist - using root
warning: group sssd does not exist - using root
warning: user sssd does not exist - using root
warning: group sssd does not exist - using root
warning: user sssd does not exist - using root
warning: group sssd does not exist - using root
warning: user sssd does not exist - using root
warning: group sssd does not exist - using root
warning: user sssd does not exist - using root
warning: group sssd does not exist - using root
warning: user sssd does not exist - using root
warning: group sssd does not exist - using root

  Running scriptlet: sssd-common-9.pr7267-04361.fc41.x86_64                                                                         9/9 
Created symlink /etc/systemd/system/multi-user.target.wants/sssd.service → /usr/lib/systemd/system/sssd.service.
/usr/bin/chown: invalid user: ‘sssd:sssd’
/usr/bin/chown: invalid user: ‘sssd:sssd’
/usr/bin/chown: invalid user: ‘sssd:sssd’
/usr/bin/chown: invalid user: ‘sssd:sssd’
warning: %post(sssd-common-9.pr7267-04361.fc41.x86_64) scriptlet failed, exit status 1

Error in POSTIN scriptlet in rpm package sssd-common
Creating group 'sssd' with GID 976.
Creating user 'sssd' (User for sssd) with UID 976 and GID 976.

alexey-tikhonov · 2024-04-02T11:53:28Z

Issue is only seen if user didn't exist before, so at a fresh install, not upgrade.

alexey-tikhonov · 2024-04-02T12:03:02Z

I don't find any 'pre' script in INFO/SCRIPTS of 'sssd-common' at all...

What I find is:

$ grep -rn user *
PROVIDES:21:user(sssd) = dSBzc3NkIC0gIlVzZXIgZm9yIHNzc2QiIC8gL3NiaW4vbm9sb2dpbgAA

$ grep -rn group *
PROVIDES:2:group(sssd)

alexey-tikhonov · 2024-04-02T13:19:34Z

Well,

- %sysusers_create_compat contrib/sssd.sysusers
+ %sysusers_create_compat %{buildroot}%{_sysusersdir}/sssd.conf

doesn't help.

@pbrezina, do you have any ideas (besides reverting 736430a)?

pbrezina · 2024-04-02T18:22:31Z

I believe we need to install sssd.sysuser to the proper location on the system.

alexey-tikhonov · 2024-04-02T18:38:15Z

I believe we need to install sssd.sysuser to the proper location on the system.

Isn't it this:

sssd/contrib/sssd.spec.in

Line 736 in 79c384f

    
           install -D -p -m 0644 contrib/sssd.sysusers %{buildroot}%{_sysusersdir}/sssd.conf

and this

sssd/contrib/sssd.spec.in

Line 844 in 79c384f

%{_sysusersdir}/sssd.conf

?

pbrezina

You are right, I forgot we already did this. Then we also need to use that installed file with %sysusers_create_compat, you are still pointing to buildroot which does not exist.

pbrezina · 2024-04-02T20:17:16Z

contrib/sssd.spec.in

@@ -1047,7 +1047,7 @@ install -D -p -m 0644 contrib/sssd.sysusers %{buildroot}%{_sysusersdir}/sssd.con
 %if %{use_sssd_user}
 %pre common
 %if %{use_sysusers}
-%sysusers_create_compat contrib/sssd.sysusers
+%sysusers_create_compat %{buildroot}%{_sysusersdir}/sssd.conf


s/%{buildroot}//

Hi,

but if you remove %{buildroot} you will end up with /usr/lib/sysusers.d/sssd.conf, i.e. referencing a file from the filesystem of the build host.

The %sysuser_create_compat macro is executed at the time the scriptlets for the rpm packages are created and it calls /usr/lib/rpm/sysusers.generate-pre.sh with the sysusers config file as argument and the output

# generated from sssd.sysusers getent group 'sssd' >/dev/null || groupadd -r 'sssd' || : getent passwd 'sssd' >/dev/null || \ useradd -r -g 'sssd' -d '/' -s '/sbin/nologin' -c 'User for sssd' 'sssd' || :

is written into the scriptlet.

Since we install the sysusers config file as well in /usr/lib/sysusers.d/ the %systemd_post macro will create users and groups if then not exists as well. But since we need the user and group so that the files installed by rpm will have proper ownership doing this in %post is too late. And we cannot let systemd do it at install time in %pre because the sysusers config file is not installed at this time.

To cut it short, I still see no other way than having the sysusers config file as additional source file.

bye,
Sumit

Hmm... you are right that %pre is executed before the file is actually installed.

But what difference does it make if we read it from out tarball or from an additional source file? The macro is evaluated before our tarball is extracted?

At this point I wonder if sysusers_create_compat is really better than "manual" user/group creation...

Hmm... you are right that %pre is executed before the file is actually installed.

But what difference does it make if we read it from out tarball or from an additional source file? The macro is evaluated before our tarball is extracted?

Hi,

no, it is evaluated after the tar ball is extracted, after SSSD is build and after content of the BUILD and BUILDROOT directories is removed (I put an ls in the pre section to check this), so there is no extracted or built data available anymore.

HTH

bye,
Sumit

Looks like 736430a needs to be reverted fully, including sssd.sysusers creation by autoconf?

I don't understand why but otherwise build fails with:

error: Bad file: /builddir/build/SOURCES/sssd.sysusers: No such file or directory Bad file: /builddir/build/SOURCES/sssd.sysusers: No such file or directory

This partially reverts 736430a The reason is that 'sysusers_create_compat' macro is evaluated after the tar ball is extracted, after SSSD is built and after content of the BUILD and BUILDROOT directories is removed, so otherwise there is no extracted or built data available anymore. See SSSD#7267 (comment) for details.

alexey-tikhonov · 2024-04-04T16:55:23Z

Recent versions seems to work fine both during package upgrade and fresh install (when user doesn't exist) besides weird

useradd: failed to reset the lastlog entry of UID 972: No such file or directory

alexey-tikhonov · 2024-04-05T11:30:30Z

For 'covscan' job, I've fixed Build source rpm - pr step to use build-sssd-srpm action from pr checkout folder, but it still doesn't provide 'sourcefile':

Run next-actions/build-srpm@master
  with:
    tarball: pr/sssd-pr7267.tar.gz
    specfile: pr/sssd.spec

@pbrezina , what do I miss?

This partially reverts 736430a The reason is that 'sysusers_create_compat' macro is evaluated after the tar ball is extracted, after SSSD is built and after content of the BUILD and BUILDROOT directories is removed, so otherwise there is no extracted or built data available anymore. See SSSD#7267 (comment) for details.

pbrezina · 2024-04-05T12:58:24Z

For 'covscan' job, I've fixed Build source rpm - pr step to use build-sssd-srpm action from pr checkout folder, but it still doesn't provide 'sourcefile':
Run next-actions/build-srpm@master
  with:
    tarball: pr/sssd-pr7267.tar.gz
    specfile: pr/sssd.spec
@pbrezina , what do I miss?

covscan is pullrequest_target, the workflow (yml) file is read from the master branch, not from this pull request. So changes in this pull request are not and can not be reflected.

pullrequest_target has access to credentials where pull_request does not. The copr_build is pull_request_target as well but it includes build-srpm from checked out repository (which might be potential security problem, I'm not sure if the action has access to the credentials as well... maybe we should probably check).

alexey-tikhonov · 2024-04-05T13:41:11Z

Ok, I removed 3rd commit.
So 'covscan' will be red until this PR is merged.

This partially reverts 736430a The reason is that 'sysusers_create_compat' macro is evaluated after the tar ball is extracted, after SSSD is built and after content of the BUILD and BUILDROOT directories is removed, so otherwise there is no extracted or built data available anymore. See SSSD#7267 (comment) for details.

alexey-tikhonov · 2024-04-05T18:13:54Z

Rebased.

pbrezina · 2024-04-05T19:30:48Z

The reason is that 'sysusers_create_compat' macro is evaluated after
the tar ball is extracted, after SSSD is built and after content of
the BUILD and BUILDROOT directories is removed, so otherwise there is
no extracted or built data available anymore.

So what is the available content/directories/paths when the macro is being evaluated? If I got it right, you have rpmbuild directories, but content under BUILD was deleted? Would it be possible to copy the file to SOURCES in %prep or %install? Or to some location that is not deleted?

rpmbuild/BUILD
rpmbuild/RPMS
rpmbuild/SOURCES
rpmbuild/SPECS
rpmbuild/SRPMS

I'm not against adding the source file, I am mostly curious at this point.

This partially reverts 736430a The reason is that 'sysusers_create_compat' macro is evaluated after the tar ball is extracted, after SSSD is built and after content of the BUILD and BUILDROOT directories is removed, so otherwise there is no extracted or built data available anymore. See SSSD#7267 (comment) for details.

Set '/run/sssd/' as 'sssd' user home dir. This is required to accomodate for needs of some Samba libraries that create cache while fetching GPO files.

sumit-bose

Hi,

thanks, the changes work for my. I tested AD GPO access control with the /run/sssd home directory and it is working fine. libsmbclient.so is creating /run/sssd/.cache/samba/gencache.tdb and the two new directories are created with 700 permissions, so even if libsmbclient.so would write something sensitive it would be only readable for the SSSD user (and root). ACK

bye,
Sumit

pbrezina

Ack. Can you please open pull request for Fedora rawhide as well?

pbrezina · 2024-04-11T13:12:08Z

Pushed PR: #7267

master
- 5b9a2f8 - SPEC: define a home dir for 'sssd' user
- 5045e43 - SPEC: enabled 'sysusers' for f-41+
- 01d09bb - SPEC: use sysusers as additional source

This partially reverts 736430a The reason is that 'sysusers_create_compat' macro is evaluated after the tar ball is extracted, after SSSD is built and after content of the BUILD and BUILDROOT directories is removed, so otherwise there is no extracted or built data available anymore. See #7267 (comment) for details. Reviewed-by: Pavel Březina <[email protected]> Reviewed-by: Sumit Bose <[email protected]>

alexey-tikhonov · 2024-04-15T10:44:36Z

Ack. Can you please open pull request for Fedora rawhide as well?

It's sssd-2.9 based, so only once we release sssd-2.10 and rebase rawhide...

alexey-tikhonov added no-backport This should go to target branch only. non-privileged labels Apr 2, 2024

alexey-tikhonov force-pushed the sysusers branch from 71bc4db to 0d8aa66 Compare April 2, 2024 12:25

pbrezina reviewed Apr 2, 2024

View reviewed changes

alexey-tikhonov force-pushed the sysusers branch from 0d8aa66 to c2d4f44 Compare April 3, 2024 08:32

alexey-tikhonov force-pushed the sysusers branch from c2d4f44 to f592de1 Compare April 3, 2024 16:25

alexey-tikhonov force-pushed the sysusers branch from f592de1 to d1f45ea Compare April 3, 2024 16:54

alexey-tikhonov force-pushed the sysusers branch from d1f45ea to 8bee0f0 Compare April 4, 2024 09:47

alexey-tikhonov force-pushed the sysusers branch from 8bee0f0 to 828e61e Compare April 4, 2024 11:18

alexey-tikhonov marked this pull request as ready for review April 4, 2024 16:56

alexey-tikhonov requested review from sumit-bose and pbrezina April 4, 2024 16:56

alexey-tikhonov added Work in Progress Waiting for review and removed Work in Progress labels Apr 4, 2024

alexey-tikhonov force-pushed the sysusers branch from a1e3b52 to 2d8832f Compare April 5, 2024 12:38

alexey-tikhonov force-pushed the sysusers branch from 2d8832f to f70d66e Compare April 5, 2024 13:40

alexey-tikhonov force-pushed the sysusers branch from f70d66e to a0e1bde Compare April 5, 2024 18:12

alexey-tikhonov added 2 commits April 8, 2024 10:45

SPEC: enabled 'sysusers' for f-41+

77ae679

alexey-tikhonov force-pushed the sysusers branch from a0e1bde to 77ae679 Compare April 8, 2024 08:45

SPEC: define a home dir for 'sssd' user

6a317c5

Set '/run/sssd/' as 'sssd' user home dir. This is required to accomodate for needs of some Samba libraries that create cache while fetching GPO files.

andreboscatto assigned pbrezina and sumit-bose Apr 9, 2024

sumit-bose approved these changes Apr 9, 2024

View reviewed changes

pbrezina approved these changes Apr 11, 2024

View reviewed changes

pbrezina added Accepted Ready to push Ready to push and removed Waiting for review labels Apr 11, 2024

pbrezina added Pushed and removed Accepted Ready to push Ready to push labels Apr 11, 2024

pbrezina closed this Apr 11, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SPEC: enabled 'sysusers' for f-41+ #7267

SPEC: enabled 'sysusers' for f-41+ #7267

alexey-tikhonov commented Apr 2, 2024

alexey-tikhonov commented Apr 2, 2024

alexey-tikhonov commented Apr 2, 2024

alexey-tikhonov commented Apr 2, 2024 •

edited

Loading

alexey-tikhonov commented Apr 2, 2024 •

edited

Loading

pbrezina commented Apr 2, 2024

alexey-tikhonov commented Apr 2, 2024

pbrezina left a comment

pbrezina Apr 2, 2024

sumit-bose Apr 3, 2024

pbrezina Apr 3, 2024

alexey-tikhonov Apr 3, 2024

sumit-bose Apr 3, 2024

alexey-tikhonov Apr 3, 2024

alexey-tikhonov commented Apr 4, 2024 •

edited

Loading

alexey-tikhonov commented Apr 5, 2024 •

edited

Loading

pbrezina commented Apr 5, 2024

alexey-tikhonov commented Apr 5, 2024

alexey-tikhonov commented Apr 5, 2024

pbrezina commented Apr 5, 2024

sumit-bose left a comment

pbrezina left a comment

pbrezina commented Apr 11, 2024

alexey-tikhonov commented Apr 15, 2024

SPEC: enabled 'sysusers' for f-41+ #7267

SPEC: enabled 'sysusers' for f-41+ #7267

Conversation

alexey-tikhonov commented Apr 2, 2024

alexey-tikhonov commented Apr 2, 2024

alexey-tikhonov commented Apr 2, 2024

alexey-tikhonov commented Apr 2, 2024 • edited Loading

alexey-tikhonov commented Apr 2, 2024 • edited Loading

pbrezina commented Apr 2, 2024

alexey-tikhonov commented Apr 2, 2024

pbrezina left a comment

Choose a reason for hiding this comment

pbrezina Apr 2, 2024

Choose a reason for hiding this comment

sumit-bose Apr 3, 2024

Choose a reason for hiding this comment

pbrezina Apr 3, 2024

Choose a reason for hiding this comment

alexey-tikhonov Apr 3, 2024

Choose a reason for hiding this comment

sumit-bose Apr 3, 2024

Choose a reason for hiding this comment

alexey-tikhonov Apr 3, 2024

Choose a reason for hiding this comment

alexey-tikhonov commented Apr 4, 2024 • edited Loading

alexey-tikhonov commented Apr 5, 2024 • edited Loading

pbrezina commented Apr 5, 2024

alexey-tikhonov commented Apr 5, 2024

alexey-tikhonov commented Apr 5, 2024

pbrezina commented Apr 5, 2024

sumit-bose left a comment

Choose a reason for hiding this comment

pbrezina left a comment

Choose a reason for hiding this comment

pbrezina commented Apr 11, 2024

alexey-tikhonov commented Apr 15, 2024

alexey-tikhonov commented Apr 2, 2024 •

edited

Loading

alexey-tikhonov commented Apr 2, 2024 •

edited

Loading

alexey-tikhonov commented Apr 4, 2024 •

edited

Loading

alexey-tikhonov commented Apr 5, 2024 •

edited

Loading