[Bug 2510047] New: can't modify file attributes in /etc at startup, with readonly-root

https://bugzilla.redhat.com/show_bug.cgi?id=2510047

Bug ID: 2510047
           Summary: can't modify file attributes in /etc at startup, with
                    readonly-root
           Product: Fedora
           Version: 44
          Hardware: x86_64
                OS: Linux
            Status: NEW
         Component: sssd
          Keywords: Regression
          Severity: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
        QA Contact: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail]
  Target Milestone: ---
    Classification: Fedora

In /usr/lib/systemd/system/sssd.service, we find :

ExecStartPre=+-/bin/chown -f -R -H root:sssd /etc/sssd
ExecStartPre=+-/bin/chmod -f -R g+r /etc/sssd
ExecStartPre=+-/bin/chmod -f g+x /etc/sssd
ExecStartPre=+-/bin/chmod -f g+x /etc/sssd/conf.d
ExecStartPre=+-/bin/chmod -f g+x /etc/sssd/pki

It doesn't work if /etc is read only (with readonly-root for example).
Suggestion : add this line

files /etc/sssd

in /etc/rwtab

Reproducible: Always

[Bug 2510047] can't modify file attributes in /etc at startup, with readonly-root

https://bugzilla.redhat.com/show_bug.cgi?id=2510047

Alexey Tikhonov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?(jacquelin.charbon
                   |                            |[e-mail])

--- Comment #1 from Alexey Tikhonov  ---
Hi.
> ExecStartPre=+-/bin/chown -f -R -H root:sssd /etc/sssd
> ExecStartPre=+-/bin/chmod -f -R g+r /etc/sssd

'-' prefix tells to ignore failures and '-f' suppresses errors, so service will
start.

What is the actual issue?
SSSD doesn't work because of wrong files ownership/permissions of config file?

[Bug 2510047] can't modify file attributes in /etc at startup, with readonly-root

https://bugzilla.redhat.com/show_bug.cgi?id=2510047

Jacquelin Charbonnel  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?(jacquelin.charbon |
                   |[e-mail])           |

--- Comment #2 from Jacquelin Charbonnel  ---
Hi,
Start the service cause worrying lines in journald, giving the impression of a
starting failure
(I'd verify in September if the service really starts, August is vacation
time).
Thx

[Bug 2510047] can't modify file attributes in /etc at startup, with readonly-root

https://bugzilla.redhat.com/show_bug.cgi?id=2510047

Simo Sorce  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?(atikhono@redhat.c
                   |                            |om)

--- Comment #3 from Simo Sorce  ---
@[e-mail] why is this even done on each startup?

This kind of file ownership should be defined in the RPM (so that rpm verify
works correctly as well, and if some old version used a different ownership use
a post-install scriptlet to fix the old permissions.

[Bug 2510047] can't modify file attributes in /etc at startup, with readonly-root

https://bugzilla.redhat.com/show_bug.cgi?id=2510047

--- Comment #4 from Lukas Slebodnik  ---
(In reply to Simo Sorce from comment #3)
> @[e-mail] why is this even done on each startup?
>
> This kind of file ownership should be defined in the RPM (so that rpm verify
> works correctly as well, and if some old version used a different ownership
> use a post-install scriptlet to fix the old permissions.

IIRC `post-install scriptlet` does not work for ostree based distributions.

[Bug 2510047] can't modify file attributes in /etc at startup, with readonly-root

https://bugzilla.redhat.com/show_bug.cgi?id=2510047

Alexey Tikhonov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?(atikhono@redhat.c |
                   |om)                         |

--- Comment #5 from Alexey Tikhonov  ---
(In reply to Simo Sorce from comment #3)
> @[e-mail] why is this even done on each startup?
>
> This kind of file ownership should be defined in the RPM (so that rpm verify
> works correctly as well, and if some old version used a different ownership
> use a post-install scriptlet to fix the old permissions.

It's done in RPM but it didn't work for rpm-ostree based systems.

[Bug 2510047] can't modify file attributes in /etc at startup, with readonly-root

https://bugzilla.redhat.com/show_bug.cgi?id=2510047

--- Comment #6 from Simo Sorce  ---
rpm-ostree should not need post install adjustments, if the file ownership is
declared correctly in the files section it will be already correct on disk.

If this is done in post-install because the sssd group is allocated
dynamically, then the obvious fix here is to get instead a fixed allocated id
so that it is a known group instead.

After all SSSD is basically always installed so a fixed GID is justifiable.