On Wed, 24 Mar 2010 10:04:14 -0400
Simo Sorce <ssorce(a)redhat.com> wrote:
On Wed, 24 Mar 2010 14:51:07 +0100
Jakub Hrozek <jhrozek(a)redhat.com> wrote:
> Packages /etc/rwtab.d/sssd file that allows SSSD to run on a
> read-only root filesystem.
NACK.
The way rwtab normally works is that it creates a tmpfs and symlinks
or bind mounts it to the locations given by rwtab.
But this means the data will be discarded at the first reboot.
SSSD data is not just cache, sssd.ldb has to survive across reboots so
this approach is wrong. True sssd will start and work, except you will
loose everything on reboot.
I do not want to endorse, make it easy or even recommend to create
such a broken configuration.
/var/lib has to be writable and not shared if you want to run some
services, and if you want it read-only/shared/etc you better not use
sssd.
Just to be clear, I am not saying we should actively prevent use of
sssd on stateless machines, but sssd by its very nature is not
stateless, so if an admin wants to use it in a stateless way he has to
make the choice consciously and explicitly and evaluate if it makes
sense or not.
sssd can still give some benefits as it can better cache some things
reducing load on an ldap server or as a showcase in a livecd, but will
also loose all the good stuff like being able to login offline after a
reboot.
So given that sssd would loose a consitent set of its features on a
stateless machine we shouldn't make it work on there by default IMO.
Simo.
--
Simo Sorce * Red Hat, Inc * New York