On Tue, 26 Jan 2016, Sumit Bose wrote:
On Tue, Jan 26, 2016 at 09:09:06AM +0100, Lukas Slebodnik wrote:
> On (25/01/16 18:40), Sumit Bose wrote:
> >On Mon, Jan 25, 2016 at 06:24:54PM +0100, Lukas Slebodnik wrote:
> >> On (25/01/16 18:12), Sumit Bose wrote:
> >> >On Mon, Jan 25, 2016 at 03:35:03PM +0100, Lukas Slebodnik wrote:
> >> >> ehlo,
> >> >>
> >> >> we (Jakub, me) didn't catch this as part of review.
> >> >> I tested on minimal machine. Later I saw conflict when I was
testing
> >> >> latest sssd with freeipa-server.
> >> >>
> >> >> I think we can ignore unowned directory
/usr/share/polkit-1/rules.d
> >> >> or we can add dependecy (soft dependency on fedora) to polkit.
> >> >>
> >> >> LS
> >> >
> >> >I think you see the conflict because of different permissions and
> >> >ownerships of the directory:
> >> >
> >> >polkit:
> >> >drwx------ 2 polkitd root 0 Jul 14 2015
/usr/share/polkit-1/rules.d
> >> >
> >> >sssd-common:
> >> >drwxr-xr-x 2 root root 0 Jan 22 18:28
/usr/share/polkit-1/rules.d
> >> >
> >> >so something like
> >> >
> >> >-%dir %{_datadir}/polkit-1/rules.d
> >> >+%attr(0700,polkitd,root) %dir %{_datadir}/polkit-1/rules.d
> >> >
> >> >should (hopefully) resolve the conflict.
> >> >
> >> No :-(,
> >> @see commit message.
> >
> >ah, sorry for not reading carefully enough. It looks like the other
> >packages which put stuff in /usr/share/polkit-1/rules.d directly or
> >indirectly require polkit.
> Should we depend on polkit as well?
no, because it is only needed if you want to do Smartcard authentication
and SSSD is not running as root.
Then I would suggest to put these files into a
sub-package and make that
sub-package to depend on polkit.
Current situation is definitely a blocker as almost all interactive installs of
Fedora have polkit whether via xorg-x11-drv-intel or rolekit.
Additionally, all IPA clients will have polkit installed due to
ntp/chrony requiring timedatex which requires polkit.
--
/ Alexander Bokovoy