URL:
https://github.com/SSSD/sssd/pull/5504
Title: #5504: systemd configs: limit process capabilities
alexey-tikhonov commented:
"""
Multihost tests fail on RHEL.
This is expected in some way.
The major issue I see here is that we use upstream spec file that aims F34+/RHEL9 to build
RHEL8 package. That's not gonna work in general.
And I'm not sure it makes sense to run multihost tests on RHEL8 for a package that is
different than package actually used on this target.
@pbrezina , @sgoveas , probably it makes sense to replace RHEL8 with RHEL9-alpha?
Another thing is that even this won't resolve issue entirely: despite our best effort
it seems we will have downstream only patches for RHEL9...
Anyway, I guess current fail:
```
2021-02-15 19:00:08,882 - sssd.testlib.common.qe_class.QeHost.client.cmd58 - DEBUG - Job
for sssd.service failed because the control process exited with error code.
```
is very similar to
https://bugzilla.redhat.com/show_bug.cgi?id=1926304 :
- upstream spec file says to chown files as sssd:sssd
- sssd monitor starts under root
- this patch limits process capabilities so it can't access /var/log/sssd/*, etc
This is gonna be solved with addition of 'CAP_DAC_OVERRIDE' on RHEL platform and
so far I didn't see a reason to make this upstream (because long term plan is to get
feature "running as a non root user" fully supported and get rid of all those
workarounds). But this means multihost will keep failing in upstream PR CI even if we
replace 8 with 9...
"""
See the full comment at
https://github.com/SSSD/sssd/pull/5504#issuecomment-779814324