https://bugzilla.redhat.com/show_bug.cgi?id=2334868
Alexey Tikhonov atikhono@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Doc Type|--- |If docs needed, set a value
--- Comment #2 from Alexey Tikhonov atikhono@redhat.com --- Hi,
(In reply to Carl Roth from comment #0)
- the three-way merge for /etc files done by ostree does not preserve file
permissions, and does not update directory permissions. When /usr/etc/sssd changed from 0700 to 0750, this was not reflected in /etc/sssd.
This is the main reason for sssd.service chown/chmod gimmicks...
- the ExecStartPre= statements in sssd.service are a bit optimistic. The
chown and chmod commands don't work with the current service settings (User= and Group=). They currently fail but this is masked by the '-f' option.
All chown/chmod are prefixed with "+": ``` If the executable path is prefixed with "+" then the process is executed with full privileges. In this mode privilege restrictions configured with User=, Group=, CapabilityBoundingSet= or the various file system namespacing options (such as PrivateDevices=, PrivateTmp=) are not applied to the invoked command line ```
(In reply to Cédric Bellegarde from comment #1)
-ExecStartPre=+-/bin/chmod -f -R g+r /etc/sssd +ExecStartPre=+-/bin/find /etc/sssd -type d -exec /bin/chmod -f 750 {} ; +ExecStartPre=+-/bin/find /etc/sssd -type f -exec /bin/chmod -f 440 {} ;
hm... is this about missing g+x for /etc/sssd?