From 289f38041aea74bc152cd9983a9c6b7184e342fe Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Mon, 15 Aug 2016 14:10:23 +0200 Subject: [PATCH 3/3] BUILD: Ship systemd service file for sssd-secrets Adds two new files: sssd-secrets.socket and sssd-secrets.service. These can be used to socket-acticate the secrets responder even without explicitly starting it in the sssd config file. The specfile activates the socket after installation which means that the admin would just be able to use the secrets socket and the sssd_secrets responder would be started automatically by systemd. The sssd-secrets responder is started as root, mostly because I didn't think of an easy way to pass the uid/gid to the responders without asking about the sssd user identity in the first place. But nonetheless, the sssd-secrets responder wasn't tested as non-root and at least the initialization should be performed as root for the time being. --- Makefile.am | 21 +++++++++++++++++++-- contrib/sssd.spec.in | 5 +++++ src/sysv/systemd/sssd-secrets.service.in | 8 ++++++++ src/sysv/systemd/sssd-secrets.socket.in | 8 ++++++++ 4 files changed, 40 insertions(+), 2 deletions(-) create mode 100644 src/sysv/systemd/sssd-secrets.service.in create mode 100644 src/sysv/systemd/sssd-secrets.socket.in diff --git a/Makefile.am b/Makefile.am index b1488c4506dc8ac957f71a9007b1e15121a4126b..3e7d172351a80c21753d21a23f1c94228dfbebf0 100644 --- a/Makefile.am +++ b/Makefile.am @@ -3853,7 +3853,10 @@ systemdunit_DATA = systemdconf_DATA = if HAVE_SYSTEMD_UNIT systemdunit_DATA += \ - src/sysv/systemd/sssd.service + src/sysv/systemd/sssd.service \ + src/sysv/systemd/sssd-secrets.socket \ + src/sysv/systemd/sssd-secrets.service \ + $(NULL) if WITH_JOURNALD systemdconf_DATA += \ src/sysv/systemd/journal.conf @@ -3891,6 +3894,7 @@ edit_cmd = $(SED) \ -e 's|@sbindir[@]|$(sbindir)|g' \ -e 's|@environment_file[@]|$(environment_file)|g' \ -e 's|@localstatedir[@]|$(localstatedir)|g' \ + -e 's|@libexecdir[@]|$(libexecdir)|g' \ -e 's|@prefix[@]|$(prefix)|g' replace_script = \ @@ -3902,7 +3906,10 @@ replace_script = \ EXTRA_DIST += \ src/sysv/systemd/sssd.service.in \ - src/sysv/systemd/journal.conf.in + src/sysv/systemd/journal.conf.in \ + src/sysv/systemd/sssd-secrets.socket.in \ + src/sysv/systemd/sssd-secrets.service.in \ + $(NULL) src/sysv/systemd/sssd.service: src/sysv/systemd/sssd.service.in Makefile @$(MKDIR_P) src/sysv/systemd/ @@ -3912,6 +3919,14 @@ src/sysv/systemd/journal.conf: src/sysv/systemd/journal.conf.in Makefile @$(MKDIR_P) src/sysv/systemd/ $(replace_script) +src/sysv/systemd/sssd-secrets.socket: src/sysv/systemd/sssd-secrets.socket.in Makefile + @$(MKDIR_P) src/sysv/systemd/ + $(replace_script) + +src/sysv/systemd/sssd-secrets.service: src/sysv/systemd/sssd-secrets.service.in Makefile + @$(MKDIR_P) src/sysv/systemd/ + $(replace_script) + SSSD_USER_DIRS = \ $(DESTDIR)$(dbpath) \ $(DESTDIR)$(keytabdir) \ @@ -4127,6 +4142,8 @@ endif done; rm -Rf ldb_mod_test_dir rm -f $(builddir)/src/sysv/systemd/sssd.service + rm -f $(builddir)/src/sysv/systemd/sssd-secrets.socket + rm -f $(builddir)/src/sysv/systemd/sssd-secrets.service rm -f $(builddir)/src/sysv/systemd/journal.conf CLEANFILES += *.X */*.X */*/*.X diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index a9a43560e61acf1cb4b2388d50303587252c2c19..b58eebba54a82a041f72507b430ceca708a34632 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -746,6 +746,8 @@ done %{_sbindir}/sssd %if (0%{?use_systemd} == 1) %{_unitdir}/sssd.service +%{_unitdir}/sssd-secrets.socket +%{_unitdir}/sssd-secrets.service %else %{_initrddir}/%{name} %endif @@ -1077,12 +1079,15 @@ getent passwd sssd >/dev/null || useradd -r -g sssd -d / -s /sbin/nologin -c "Us # systemd %post common %systemd_post sssd.service +%systemd_post sssd-secrets.socket %preun common %systemd_preun sssd.service +%systemd_preun sssd-secrets.socket %postun common %systemd_postun_with_restart sssd.service +%systemd_postun_with_restart sssd-secrets.socket %else # sysv diff --git a/src/sysv/systemd/sssd-secrets.service.in b/src/sysv/systemd/sssd-secrets.service.in new file mode 100644 index 0000000000000000000000000000000000000000..119c9bb4b37b672159db707aa11a6d11215f29bf --- /dev/null +++ b/src/sysv/systemd/sssd-secrets.service.in @@ -0,0 +1,8 @@ +[Unit] +Description=SSSD Secrets Service responder + +[Install] +Also=sssd-secrets.socket + +[Service] +ExecStart=@libexecdir@/sssd/sssd_secrets --uid 0 --gid 0 --debug-to-files diff --git a/src/sysv/systemd/sssd-secrets.socket.in b/src/sysv/systemd/sssd-secrets.socket.in new file mode 100644 index 0000000000000000000000000000000000000000..682e8f6e0fa58092a90259523f9f2f59e0131435 --- /dev/null +++ b/src/sysv/systemd/sssd-secrets.socket.in @@ -0,0 +1,8 @@ +[Unit] +Description=SSSD Secrets Service responder socket + +[Socket] +ListenStream=@localstatedir@/run/secrets.socket + +[Install] +WantedBy=sockets.target -- 2.4.11