>From 77e217b071ba3629a92e26c8f55361ef0264fcc4 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Tue, 5 Aug 2014 13:53:20 +0200 Subject: [PATCH 2/2] RPM: Change file ownership to sssd.sssd Adds a private SSSD user in the %pre section of SSSD specfile. Also changes the ownsership of SSSD private directories to sssd.sssd. Does not change the configure time default, so SSSD will still run as root. The file and directory ownership does not widen, because the directories are still only accessible by the private user (whose shell is /sbin/nologin) and of course the root user. --- contrib/sssd.spec.in | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index 529304205274ad39e4281e3d298222420d5eb439..e3161d723e04ebb25dec768c92be6079042ce9b4 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -603,17 +603,17 @@ rm -rf $RPM_BUILD_ROOT %dir %{sssdstatedir} %dir %{_localstatedir}/cache/krb5rcache -%attr(700,root,root) %dir %{dbpath} -%attr(755,root,root) %dir %{mcpath} -%ghost %attr(0644,root,root) %verify(not md5 size mtime) %{mcpath}/passwd -%ghost %attr(0644,root,root) %verify(not md5 size mtime) %{mcpath}/group -%attr(755,root,root) %dir %{pipepath} -%attr(755,root,root) %dir %{pubconfpath} -%attr(755,root,root) %dir %{gpocachepath} -%attr(700,root,root) %dir %{pipepath}/private -%attr(750,root,root) %dir %{_var}/log/%{name} -%attr(711,root,root) %dir %{_sysconfdir}/sssd -%ghost %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/sssd/sssd.conf +%attr(700,sssd,sssd) %dir %{dbpath} +%attr(755,sssd,sssd) %dir %{mcpath} +%ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/passwd +%ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/group +%attr(755,sssd,sssd) %dir %{pipepath} +%attr(755,sssd,sssd) %dir %{pubconfpath} +%attr(755,sssd,sssd) %dir %{gpocachepath} +%attr(700,sssd,sssd) %dir %{pipepath}/private +%attr(750,sssd,sssd) %dir %{_var}/log/%{name} +%attr(711,sssd,sssd) %dir %{_sysconfdir}/sssd +%ghost %attr(0600,sssd,sssd) %config(noreplace) %{_sysconfdir}/sssd/sssd.conf %if (0%{?use_systemd} == 1) %attr(755,root,root) %dir %{_sysconfdir}/systemd/system/sssd.service.d %config(noreplace) %{_sysconfdir}/systemd/system/sssd.service.d/journal.conf @@ -802,6 +802,10 @@ rm -rf $RPM_BUILD_ROOT %{_libdir}/%{name}/modules/libwbclient.so %{_libdir}/pkgconfig/wbclient_sssd.pc +%pre common +getent group sssd >/dev/null || groupadd -r sssd +getent passwd sssd >/dev/null || useradd -r -g sssd -d / -s /sbin/nologin -c "User for sssd" sssd + %if (0%{?use_systemd} == 1) # systemd %post common -- 1.9.3