[SSSD] [PATCH] Allow running with read only root

Dmitri Pal dpal at redhat.com
Wed Mar 24 14:22:51 UTC 2010


Simo Sorce wrote:
> On Wed, 24 Mar 2010 10:04:14 -0400
> Simo Sorce <ssorce at redhat.com> wrote:
>
>   
>> On Wed, 24 Mar 2010 14:51:07 +0100
>> Jakub Hrozek <jhrozek at redhat.com> wrote:
>>
>>     
>>> Packages /etc/rwtab.d/sssd file that allows SSSD to run on a
>>> read-only root filesystem.
>>>       
>> NACK.
>>
>> The way rwtab normally works is that it creates a tmpfs and symlinks
>> or bind mounts it to the locations given by rwtab.
>>
>> But this means the data will be discarded at the first reboot.
>>
>> SSSD data is not just cache, sssd.ldb has to survive across reboots so
>> this approach is wrong. True sssd will start and work, except you will
>> loose everything on reboot.
>>
>> I do not want to endorse, make it easy or even recommend to create
>> such a broken configuration.
>>
>> /var/lib has to be writable and not shared if you want to run some
>> services, and if you want it read-only/shared/etc you better not use
>> sssd.
>>     
>
>
> Just to be clear, I am not saying we should actively prevent use of
> sssd on stateless machines, but sssd by its very nature is not
> stateless, so if an admin wants to use it in a stateless way he has to
> make the choice consciously and explicitly and evaluate if it makes
> sense or not.
>
> sssd can still give some benefits as it can better cache some things
> reducing load on an ldap server or as a showcase in a livecd, but will
> also loose all the good stuff like being able to login offline after a
> reboot.
>
> So given that sssd would loose a consitent set of its features on a
> stateless machine we shouldn't make it work on there by default IMO.
>
> Simo.
>
>   
Simo,

I think that this limitation should be documented.  It is the admin's
choice to use SSSD on such system or not but if he does he should be
warned and accept limitations that SSSD would not fully function.
I do not see a reason to NACK the patch on the grounds you mentioned. If
there is a better solution sure but if this is the limitation of the
read only system then let us do the best we can offer (which the current
fix provides) than just dismiss the claim as you suggest.

I suggest Steve and original bug reporter to chime in.

Thanks
Dmitri




More information about the sssd-devel mailing list