On (07/01/16 12:00), Lukas Slebodnik wrote:
>On (07/01/16 11:17), Jakub Hrozek wrote:
>>On Thu, Jan 07, 2016 at 10:27:29AM +0100, Lukas Slebodnik wrote:
>>> On (06/01/16 18:21), Lukas Slebodnik wrote:
>>> >ehlo,
>>> >
>>> >attached patch should fix warnings with ad provider
>>> >and without installed package sssd-ipa
>>> >
>>> >[sssd[be[domain.com]]] [sss_write_domain_mappings] (0x0200): Mapping
file for domain [
domain.com] is
[/var/lib/sss/pubconf/krb5.include.d/domain_realm_domain.com]
>>> >[sssd[be[domain.com]]] [sss_write_domain_mappings] (0x0040): creating
the temp file [/var/lib/sss/pubconf/krb5.include.d/domain_realm_domain.comkd2iik] for
domain-realm mappings failed
>>> >[sssd[be[domain.com]]] [sss_write_domain_mappings] (0x0080): Could not
remove file [/var/lib/sss/pubconf/krb5.include.d/domain_realm_domain.comkd2iik]: [2]:
Aucun fichier ou dossier de ce type
>>> >
>>> >LS
>>>
>>> >From 446c1c82b79310ae1f6494d4b219316d6ed8ec01 Mon Sep 17 00:00:00 2001
>>> >From: Lukas Slebodnik <lslebodn(a)redhat.com>
>>> >Date: Wed, 6 Jan 2016 18:09:16 +0100
>>> >Subject: [PATCH] SPEC: Change package ownership of
>>> > %{pubconfpath}/krb5.include.d
>>> >
>>> >krb5 domain mapping files are stored to the directory
>>> >%{pubconfpath}/krb5.include.d. It can be stored by ipa or ad provider.
>>> >However this directory was owned by sub-package sssd-ipa. And ad
provider
>>> >can be installed without this package. Therefore
%{pubconfpath}/krb5.include.d
>>> >should be owned by common dependency.
>>> >---
>>> > contrib/sssd.spec.in | 2 +-
>>> > 1 file changed, 1 insertion(+), 1 deletion(-)
>>> >
>>> >diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
>>> >index
710ba92209d4a4d6e45b63bf7bf693fd5ec5f490..5f6880a1d30454f365ea6c596299a13b6b3121fe 100644
>>> >--- a/contrib/sssd.spec.in
>>> >+++ b/contrib/sssd.spec.in
>>> >@@ -733,6 +733,7 @@ rm -rf $RPM_BUILD_ROOT
>>> > %ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime)
%{mcpath}/initgroups
>>> > %attr(755,sssd,sssd) %dir %{pipepath}
>>> > %attr(755,sssd,sssd) %dir %{pubconfpath}
>>> >+%attr(755,root,root) %dir %{pubconfpath}/krb5.include.d
>>> I only moved this line from one package to another.
>>> But I wonder why the directory is owned by root.
>>> sssd will not be able to write domain mappings in non-root mode.
>>
>>This looks like a bug, when I install from source, the directory is
>>owned by sssd.sssd.
>>
>Yes, this directory part of "array" SSSD_USER_DIRS in makefile
>So it had correct permissions.
>
>Updated patch is attached.
>
>>btw when I tested this, I think I found another issue -- we try to bump
>>the mtime of /etc/krb5.conf, but since the file is only writable by
>>root, we fail:
>> (Thu Jan 7 10:11:00 2016) [sssd[be[ipa.test]]] [sss_write_domain_mappings]
(0x0200): Mapping file for domain [ipa.test] is
[/var/lib/sss/pubconf/krb5.include.d/domain_realm_ipa_test]
>> (Thu Jan 7 10:12:04 2016) [sssd[be[ipa.test]]] [sss_krb5_touch_config]
(0x0020): Unable to change mtime of "/etc/krb5.conf" [13]: Permission denied
>>
>>I wonder if we should open krb.conf during startup and then call
>>futimens() instead?
>>
>file a bug.
>
>LS
>From dfa40c69dd3d347df5e9137b72f330eb5b09e5b7 Mon Sep 17 00:00:00 2001
>From: Lukas Slebodnik <lslebodn(a)redhat.com>
>Date: Wed, 6 Jan 2016 18:09:16 +0100
>Subject: [PATCH] SPEC: Change package ownership of
> %{pubconfpath}/krb5.include.d
>
>krb5 domain mapping files are stored to the directory
>%{pubconfpath}/krb5.include.d. It can be stored by ipa or ad provider.
>However this directory was owned by sub-package sssd-ipa. And ad provider
>can be installed without this package. Therefore %{pubconfpath}/krb5.include.d
>should be owned by common dependency.
>
>The owner of this directory was also fixed to sssd.
>It's already done by make install. It was changed only in spec file.
>---
> contrib/sssd.spec.in | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
>index
710ba92209d4a4d6e45b63bf7bf693fd5ec5f490..0a318316d2f0c0ad81c9c339b775dbc1d3692056 100644
>--- a/contrib/sssd.spec.in
>+++ b/contrib/sssd.spec.in
>@@ -733,6 +733,7 @@ rm -rf $RPM_BUILD_ROOT
> %ghost %attr(0644,sssd,sssd) %verify(not md5 size mtime) %{mcpath}/initgroups
> %attr(755,sssd,sssd) %dir %{pipepath}
> %attr(755,sssd,sssd) %dir %{pubconfpath}
>+%attr(755,sssd,sssd) %dir %{pubconfpath}/krb5.include.d
I thought a little bit and it might be better to move this
directory into sssd-krb5-common instead on sssd-common.
What do you think?
I guess yes, I'm trying to remember why we put it into sssd-common in
the first place..I wonder if sssd-krb5-common was added after the
initial split?